Cyber Security
Cybersecurity
Italian Spyware Vendor Linked to Chrome Zero-Day Attacks
An Italian spyware vendor has been linked to Google Chrome zero-day attacks targeting Android and Windows users, exploiting CVE-2025-1234 to deliver advanced surveillance tools globally.
Cybersecurity
QNAP Warns Windows Backup Software Impacted by ASP.NET Flaw
QNAP warned that its Windows-based NetBak Replicator backup software is vulnerable to the critical ASP.NET flaw CVE-2024-43491, urging users to apply Microsoft’s latest security patches ...
Cybersecurity
NCX Exchange Data Leak Exposes User Wallets, Passwords, and Authentication Keys
NCX exchange exposed over 5 million records including wallet addresses, hashed passwords, 2FA codes and KYC documents—highlighting serious custodial risk and credential exploitation potential.
Cybersecurity
Dublin Airport Attack Claimed by Russian Ransomware Group Everest
Russian-linked ransomware group claims to have stolen 1.5 million records from Dublin Airport’s passenger systems, raising urgent concerns around aviation supply-chain cybersecurity and travel-data exposure.
Cybersecurity
HSBC USA Data Breach Exposes Sensitive Customer Financial Information
HSBC USA confirmed a cybersecurity breach exposing sensitive financial and personal data through unauthorized vendor access. The bank strengthened encryption, monitoring, and multi-layered authentication systems ...
Cybersecurity
Pwn2Own Ireland 2025: $1M Reward for 73 Zero-Day Exploits Uncovered
Pwn2Own Ireland 2025 awarded over $1 million for 73 zero-day discoveries across phones, NAS devices, and smart tech. The Summoning Team won “Master of Pwn,” ...
Application Security
OpenAI Atlas Omnibox Vulnerability: Prompt Injection Flaw Exposes Unauthorized Access Risks
Researchers discovered a prompt injection flaw in OpenAI’s ChatGPT Atlas browser that lets attackers manipulate its AI agent via malformed omnibox input. The bug exposes ...
Identity and Access Management
Keycard Emerges from Stealth: $38M Funding Fuels IAM Innovation for AI Agents
San Francisco startup Keycard has emerged from stealth with $38M in funding to launch an IAM platform built for AI agents. Designed to secure autonomous ...
Product Reviews
SailPoint Identity Risk Review: Intelligent Identity Threat Detection
SailPoint Identity Risk delivers advanced visibility into identity-based threats across human and machine accounts. It unifies access intelligence, behavioral analytics, and risk-based policy automation for ...
Application Security
Massive Gmail Data Breach Exposes 183 Million User Credentials
A massive Gmail breach exposed 183 million user credentials compiled by Synthient, prompting cybersecurity warnings about reused passwords and urging users to enable multi-factor authentication.
Application Security
RedTiger Toolkit Weaponized to Steal Discord Tokens and Crypto Wallets
Malware built on the RedTiger red-teaming toolkit is actively stealing Discord tokens, browser credentials and crypto wallet data, enabling account takeover even after victims reset ...
Application Security
SS7 Alarm: TCAP Tag Exploit Lets Attackers Intercept SMS and Track Users
Researchers uncovered a TCAP-layer SS7 bypass that lets attackers intercept SMS, reroute calls, manipulate billing, and track locations by embedding extended TCAP tags to evade ...
Cybersecurity
NPC Probes GCash Data Breach As E-Wallet Denies Leakage
The Philippine privacy regulator is investigating GCash over unauthorized user transactions while the e-wallet operator denies any data leak, raising concerns about mobile wallet security ...
Application Security
WhatsApp Hack Uncovers 2 Low-Risk Vulnerabilities, No Arbitrary Code Execution
Meta has patched two low-risk WhatsApp flaws—CVE-2025-55177 and CVE-2025-30401—affecting desktop and mobile sync features. Both required user interaction and posed no remote code execution risk, ...
CVE Vulnerability Alerts
TP-Link Patches Critical Omada Gateway Vulnerabilities Preventing Remote Attacks
TP-Link has patched four critical flaws—two enabling unauthenticated remote code execution—affecting Omada gateway devices. The vulnerabilities (CVE-2025-6542, -6541, -7850, -7851) impact multiple ER, G, and ...
Application Security
CoPhish Exploit via Microsoft Copilot: OAuth Token Theft Exposes Trusted Domains
A new phishing technique called “CoPhish” exploits Microsoft Copilot Studio to deliver OAuth-based attacks through legitimate Microsoft domains. By embedding malicious login flows in Copilot ...
Application Security
GutenKit, Hunk Companion, WP Ghost Exploits Drive New WordPress RCE Surge
A global wave of remote code execution attacks is targeting outdated WordPress plugins, including GutenKit, Hunk Companion, and WP Ghost. Despite available patches, sluggish updates ...
Application Security
Exploitable Bug in Rust async-tar Library — TARmageddon Gives Attackers RCE
The TARmageddon flaw (CVE-2025-62518) in Rust’s async-tar and tokio-tar libraries allows remote code execution via desynchronized TAR parsing. Exploited through nested archives, it threatens CI/CD, ...
CVE Vulnerability Alerts
Critical WSUS Flaw (CVE-2025-61884) Drives Elevated RCE Attacks on Windows Server
A critical RCE flaw, CVE-2025-59287, in Microsoft WSUS allows unauthenticated attackers to gain SYSTEM access via unsafe deserialization. Despite patches, active exploitation continues, prompting urgent ...
Application Security
Hackers Exploit “SessionReaper” Flaw in Adobe Magento to Hijack E-Commerce Stores
SessionReaper (CVE-2025-54236) is being actively exploited in Adobe Commerce and Magento stores, enabling account takeover and web-shell deployment as more than 60% of installations remain ...
Application Security
Microsoft Patches Exploited Exchange XSS as Secure Boot Deadline Looms
CVE Vulnerability Alerts
Check Point VPN CVE-2026-50751 Exploited by Qilin Before Patch Release
TOP CYBERSECURITY HEADLINES
Application Security
Gogs 0.14.3 Patches Critical RCE Zero-Day After 10 Days Without Fix
Cybersecurity
TVING Data Breach Triggers South Korean Government Probe
This Week’s Security Spotlight
Application Security
Claude Opus Finds 4-Year Zcash Flaw Enabling Silent Coin Forgery
CVE Vulnerability Alerts
CISA Orders Serv-U CVE-2026-28318 Patch After Active Exploitation
CVE Vulnerability Alerts
Cisco SD-WAN Manager Hit by 7th Zero-Day of 2026, No Patch
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Palo Alto Networks Uncovers 194,000-Domain Smishing Campaign Linked to “Smishing Triad”
A global smishing campaign of unprecedented scale has been uncovered by Palo Alto Networks, revealing the vast operations of a Chinese-speaking threat actor known as ...
Coveware Reports Historic Drop in Ransomware Payments: Only 23% of Victims Paid in Q3 2025
The global ransomware economy is collapsing under growing resistance from its targets. According to new data from cybersecurity firm Coveware, the third quarter of 2025 ...
Firefox Add-Ons Must Declare Data Collection—or Be Rejected
Mozilla is taking a decisive step toward transparency and user control by requiring all Firefox extensions to disclose how they collect and handle personal data. ...
Chainguard’s $3.5 Billion Valuation Signals Massive Investor Confidence in Secure-by-Default Software
Chainguard, the Kirkland, Washington-based cybersecurity company, has announced a landmark $280 million growth funding round led by General Catalyst’s Customer Value Fund (CVF), pushing its ...
Italian Spyware Vendor Linked to Chrome Zero-Day Attacks
An Italian spyware vendor has been linked to Google Chrome zero-day attacks targeting Android and Windows users, exploiting CVE-2025-1234 to deliver advanced surveillance tools globally.
QNAP Warns Windows Backup Software Impacted by ASP.NET Flaw
QNAP warned that its Windows-based NetBak Replicator backup software is vulnerable to the critical ASP.NET flaw CVE-2024-43491, urging users to apply Microsoft’s latest security patches ...
NCX Exchange Data Leak Exposes User Wallets, Passwords, and Authentication Keys
NCX exchange exposed over 5 million records including wallet addresses, hashed passwords, 2FA codes and KYC documents—highlighting serious custodial risk and credential exploitation potential.
Dublin Airport Attack Claimed by Russian Ransomware Group Everest
Russian-linked ransomware group claims to have stolen 1.5 million records from Dublin Airport’s passenger systems, raising urgent concerns around aviation supply-chain cybersecurity and travel-data exposure.
HSBC USA Data Breach Exposes Sensitive Customer Financial Information
HSBC USA confirmed a cybersecurity breach exposing sensitive financial and personal data through unauthorized vendor access. The bank strengthened encryption, monitoring, and multi-layered authentication systems ...
Pwn2Own Ireland 2025: $1M Reward for 73 Zero-Day Exploits Uncovered
Pwn2Own Ireland 2025 awarded over $1 million for 73 zero-day discoveries across phones, NAS devices, and smart tech. The Summoning Team won “Master of Pwn,” ...
OpenAI Atlas Omnibox Vulnerability: Prompt Injection Flaw Exposes Unauthorized Access Risks
Researchers discovered a prompt injection flaw in OpenAI’s ChatGPT Atlas browser that lets attackers manipulate its AI agent via malformed omnibox input. The bug exposes ...
Keycard Emerges from Stealth: $38M Funding Fuels IAM Innovation for AI Agents
San Francisco startup Keycard has emerged from stealth with $38M in funding to launch an IAM platform built for AI agents. Designed to secure autonomous ...
SailPoint Identity Risk Review: Intelligent Identity Threat Detection
SailPoint Identity Risk delivers advanced visibility into identity-based threats across human and machine accounts. It unifies access intelligence, behavioral analytics, and risk-based policy automation for ...
Massive Gmail Data Breach Exposes 183 Million User Credentials
A massive Gmail breach exposed 183 million user credentials compiled by Synthient, prompting cybersecurity warnings about reused passwords and urging users to enable multi-factor authentication.
RedTiger Toolkit Weaponized to Steal Discord Tokens and Crypto Wallets
Malware built on the RedTiger red-teaming toolkit is actively stealing Discord tokens, browser credentials and crypto wallet data, enabling account takeover even after victims reset ...
SS7 Alarm: TCAP Tag Exploit Lets Attackers Intercept SMS and Track Users
Researchers uncovered a TCAP-layer SS7 bypass that lets attackers intercept SMS, reroute calls, manipulate billing, and track locations by embedding extended TCAP tags to evade ...
NPC Probes GCash Data Breach As E-Wallet Denies Leakage
The Philippine privacy regulator is investigating GCash over unauthorized user transactions while the e-wallet operator denies any data leak, raising concerns about mobile wallet security ...
WhatsApp Hack Uncovers 2 Low-Risk Vulnerabilities, No Arbitrary Code Execution
Meta has patched two low-risk WhatsApp flaws—CVE-2025-55177 and CVE-2025-30401—affecting desktop and mobile sync features. Both required user interaction and posed no remote code execution risk, ...
$1 Million WhatsApp Exploit Withdrawn—Researcher Silent, Meta Calls It “Low-Risk”
The Pwn2Own Ireland 2025 hacking competition was set to feature one of its most anticipated moments — a $1 million zero-click remote code execution exploit ...
OpenAI Atlas Omnibox Jailbreak Exposes New AI Security Flaw
A serious vulnerability has been discovered in the OpenAI Atlas omnibox, a hybrid interface designed to handle both URLs and user prompts. Researchers at NeuralTrust ...