Google will finally allow you to change your @ gmail .com address.

CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution.

Fake MAS Windows activation domain used to spread PowerShell malware.

Ten former Samsung employees arrested for industrial espionage charges for giving China chipmaker 10nm tech — executives and researchers allegedly leaked DRAM technology to China-based CXMT, resulting in trillions of losses in Korean Won.

Eurostar Accused Researchers of Blackmail for Reporting AI Chatbot Flaws.

US shuts down phisherfolk’s $14.6M password-hoarding platform.

MongoDB warns admins to patch severe RCE flaw immediately.

Evasive Panda APT poisons DNS requests to deliver MgBot.

New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper.

''NHS Warns of PoC Exploit for 7-Zip Symbolic Link–Based RCE Vulnerability''.

Spotify cracks down on unlawful scraping of 86 million songs.

Utair - 401,400 breached accounts.

Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection.

Trust Wallet confirms extension hack led to $7 million crypto theft.

Mark Zuckerberg and Meta are lobbying the Canadian government to implement mandatory digital IDs, pushing for regulations that would require age verification at the app store level.

MongoDB fixed a server flaw that lets unauthenticated users read uninitialized heap memory.

The bug, CVE-2025-14847 (8.7), affects releases from 3.6 through 8.2 and is tied to zlib compression handling.

Handala claims hack of Netanyahu chief of staff’s phone.

The hacker group Handala claimed it hacked the phone of Israeli Benjamin Netanyahu’s chief of staff, Tzachi Braverman, alleging long-term access to his device and warning it may release files, audio, and video purportedly linking Netanyahu’s inner circle to corruption and misconduct.

Handala on 27 December, when the group posted an ominous message directed at Netanyahu ahead of a planned trip to Florida to meet US President Donald Trump, ending with the warning: “Tik Tok…Tik Tok.”

Attackers turned npm into phishing infrastructure over five months.

27 npm packages were used as CDN-hosted lures mimicking document sharing and Microsoft sign-in pages, targeting sales staff at 25 industrial and healthcare firms.

MongoDB servers are under active exploitation via CVE-2025-14847, a pre-auth memory leak.

Censys found 87,000 exposed instances. The default zlib compression flaw can leak passwords and API keys over time.