📌Free Article Link

A practical and beginner-friendly deep dive into Cross-Site Scripting (XSS) attacks and how to prevent them

Meta has finalized its acquisition of voice AI startup PlayAI, integrating its team to enhance Meta AI, virtual characters, and voice tech for smart glasses, boosting its "AI Superintelligence" initiative.

1Password offers a recurring free one-year Family Plan. Learn how to circumvent the expiration by exporting/importing data to a new account, extending free premium access.

A new round of the weekly Security Affairs newsletter is out! Every week, the best security articles from Security Affairs in your email box

Security researchers have identified a severe pre-authentication SQL injection vulnerability in Fortinet's FortiWeb Fabric Connector.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape

In today’s rapidly evolving digital landscape, the frequency and complexity of cyberattacks are increasing, making it crucial to stay informed about emerging threats.

Hackers exploit critical Wing FTP flaw (CVE-2025-47812) for remote code execution with root/system rights after details leaked on June 30.

Google Gemini for Workspace can be exploited to generate email summaries that appear legitimate but include malicious instructions or warnings that direct users to phishing sites without using attachments or direct links.

The search feature for the Windows 10 emoji panel is broken after installing the KB5062554 cumulative update released Tuesday, making it not possible to look up emojis by name or keyword.

A malicious campaign on GitHub is distributing Lumma Stealer via fake "Free VPN for PC" and "Minecraft Skin Changer" repositories, using obfuscation and process injection for stealthy delivery.

Darktrace uncovers a crypto scam using fake software startups (AI, gaming, Web3 themes) with professional online presences to distribute Electron malware (Windows) and Atomic Stealer (macOS) for crypto theft.

Google exposes a vast phishing campaign hijacking Booking.com reservation chats to steal credit card details from travelers, impacting thousands globally since Nov 2023.

A supply chain attack injected backdoor malware into Gravity Forms plugin downloads from the official website. The backdoor allows RCE and creates admin accounts.

Axis warns of a critical flaw (CVE-2025-30023, CVSS 9.0) in Camera Station Pro/5 and Device Manager, allowing authenticated RCE via protocol deserialization. Update immediately.

CERT/CC warns of critical flaws in Gigabyte UEFI firmware, allowing SMRAM writes and SMM code execution. Patch immediately to prevent firmware implants and Secure Boot bypass.

Unit 42 exposes SLOW#TEMPEST, a new malware variant using advanced CFG obfuscation and indirect function calls to evade static analysis, making it nearly impossible to detect.

CYFIRMA unveils RenderShock, a zero-click attack strategy exploiting silent OS background processes like file previews and search indexing to execute malware and steal credentials without user interaction.

Fortinet released a critical patch for FortiWeb (CVE-2025-25257). This unauthenticated SQL injection flaw allows remote code execution. PoC Releases!

SpaceX invests $2B in xAI to accelerate Grok AI development and Tesla integration. Grok 4 offers multimodal input/multi-agent support, but faced recent hate speech controversy.