ShadowPad malware is being delivered through an actively exploited WSUS vulnerability, granting attackers full system access.

APT31 secretly targeted Russian IT from 2022–2025 using cloud services, social media commands, and CloudyLoader malware to ...

CISA adds exploited Oracle Identity Manager CVSS 9.8 flaw to KEV catalog as agencies rush to patch zero-day attacks.

APT24 and Autumn Dragon launch multi-year espionage campaigns using BADAUDIO, supply chain attacks, and new CVE-2025-8088 ...

Fortinet has warned of a new security flaw in FortiWeb that it said has been exploited in the wild. The medium-severity ...

The vulnerability, tracked as CVE-2025-41115, carries a CVSS score of 10.0. It resides in the System for Cross-domain ...

Salesforce has warned of detected "unusual activity" related to Gainsight-published applications connected to the platform.

Matrix Push C2 abuses browser notifications for fileless, cross-platform phishing, while Velociraptor misuse rises after a ...

TamperedChef spreads through fake installers and SEO abuse, delivering a persistent JavaScript backdoor across multiple ...

Meta expands WhatsApp security research, reveals $4M payouts, new proxy tool, and patched high-severity flaws.

The vulnerability in question is CVE-2025-11001 (CVSS score: 7.0), which allows remote attackers to execute arbitrary code.

Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack ...