Cyber Security
Application Security
WordPress Security Plugin Vulnerability Exposes Private Server Files to Site Subscribers
A flaw in the Anti-Malware Security and Brute-Force Firewall plugin let WordPress subscribers access private server files, prompting urgent updates to prevent data exposure.
Cybersecurity
Phoenix Contact UPS Vulnerabilities: Critical Flaws May Cause Denial-of-Service
Critical flaws in Phoenix Contact’s QUINT4 UPS devices could let attackers shut down power or steal credentials. One unpatched Modbus flaw risks remote “power denial” ...
Cybersecurity
Fuji Electric HMI Configurator Flaws: Industrial Software Vulnerabilities Expose Hack Risks
Fuji Electric’s Monitouch V-SFT, Tellus Lite V-Simulator, and V-Server Lite tools contain critical flaws (CVE-2024-11787, others) enabling remote code execution. CISA urges urgent patching.
Cybersecurity
Atroposia Malware Now Comes With Built-In Local Vulnerability Scanner
Atroposia is a newly surfaced malware-as-a-service kit that integrates remote access, credential theft and a built-in vulnerability scanner, enabling low-skill attackers to execute advanced campaigns.
Endpoint Security
TEE.Fail Attack Undermines Confidential Computing on Intel, AMD, and NVIDIA CPUs
The TEE.Fail side-channel attack allows extraction of cryptographic keys from Intel SGX, AMD SEV-SNP and NVIDIA GPU confidential environments via low-cost DDR5 memory bus interposers.
CVE Vulnerability Alerts
CISA Alerts to Actively Exploited Vulnerabilities in DELMIA Apriso by Dassault Systèmes
CISA warns that two vulnerabilities in DELMIA Apriso (CVE-2025-6204 and CVE-2025-6205) are under active exploitation, urging immediate patching across manufacturing operations.
Application Security
Microsoft Faces Lawsuit Over Misleading Customers Into Copilot-Enhanced Microsoft 365 Subscriptions
The Australian regulator alleges Microsoft misled 2.7 million consumers into Copilot-integrated Microsoft 365 plans by concealing a cheaper Classic tier, prompting legal action and potential ...
Cybersecurity
Qilin Ransomware Leverages WSL to Deploy Linux Encryptors on Windows Systems
Qilin ransomware now exploits the Windows Subsystem for Linux to deploy Linux encryptors on Windows hosts, blending BYOVD attacks and remote-management tools for stealth/
Cybersecurity
Dentsu Confirms Data Breach Exposing Employee Payroll and Personal Information
Dentsu has confirmed a cyberattack on its UK operations via Merkle’s servers, exposing employee payroll and personal details, raising identity theft and phishing concerns.
Cybersecurity
Palo Alto Networks Unveils AI Security Suite: Cortex Cloud 2.0 & Prisma AIRS 2.0 Launched
Palo Alto Networks has launched Cortex Cloud 2.0 and Prisma AIRS 2.0—AI-driven platforms for cloud and AI application security. Combining automation, real-time threat detection, and ...
Cybersecurity
Italian Spyware Vendor Linked to Chrome Zero-Day Attacks
An Italian spyware vendor has been linked to Google Chrome zero-day attacks targeting Android and Windows users, exploiting CVE-2025-1234 to deliver advanced surveillance tools globally.
Cybersecurity
QNAP Warns Windows Backup Software Impacted by ASP.NET Flaw
QNAP warned that its Windows-based NetBak Replicator backup software is vulnerable to the critical ASP.NET flaw CVE-2024-43491, urging users to apply Microsoft’s latest security patches ...
Cybersecurity
NCX Exchange Data Leak Exposes User Wallets, Passwords, and Authentication Keys
NCX exchange exposed over 5 million records including wallet addresses, hashed passwords, 2FA codes and KYC documents—highlighting serious custodial risk and credential exploitation potential.
Cybersecurity
Dublin Airport Attack Claimed by Russian Ransomware Group Everest
Russian-linked ransomware group claims to have stolen 1.5 million records from Dublin Airport’s passenger systems, raising urgent concerns around aviation supply-chain cybersecurity and travel-data exposure.
Cybersecurity
HSBC USA Data Breach Exposes Sensitive Customer Financial Information
HSBC USA confirmed a cybersecurity breach exposing sensitive financial and personal data through unauthorized vendor access. The bank strengthened encryption, monitoring, and multi-layered authentication systems ...
Cybersecurity
Pwn2Own Ireland 2025: $1M Reward for 73 Zero-Day Exploits Uncovered
Pwn2Own Ireland 2025 awarded over $1 million for 73 zero-day discoveries across phones, NAS devices, and smart tech. The Summoning Team won “Master of Pwn,” ...
Application Security
OpenAI Atlas Omnibox Vulnerability: Prompt Injection Flaw Exposes Unauthorized Access Risks
Researchers discovered a prompt injection flaw in OpenAI’s ChatGPT Atlas browser that lets attackers manipulate its AI agent via malformed omnibox input. The bug exposes ...
Identity and Access Management
Keycard Emerges from Stealth: $38M Funding Fuels IAM Innovation for AI Agents
San Francisco startup Keycard has emerged from stealth with $38M in funding to launch an IAM platform built for AI agents. Designed to secure autonomous ...
Product Reviews
SailPoint Identity Risk Review: Intelligent Identity Threat Detection
SailPoint Identity Risk delivers advanced visibility into identity-based threats across human and machine accounts. It unifies access intelligence, behavioral analytics, and risk-based policy automation for ...
Application Security
Massive Gmail Data Breach Exposes 183 Million User Credentials
A massive Gmail breach exposed 183 million user credentials compiled by Synthient, prompting cybersecurity warnings about reused passwords and urging users to enable multi-factor authentication.
Cybersecurity
ShinyHunters Claims Breach of Florida DMV DAVID Database
Application Security
GoldFactory and Mantax Otax Target Indonesian Android Bank Users
CVE Vulnerability Alerts
Aurora Ransomware Operators Use Cursor AI to Execute Network Attacks
TOP CYBERSECURITY HEADLINES
Application Security
UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor
Application Security
Attackers Use BYOD Weaknesses to Access M365 via Graph API
This Week’s Security Spotlight
Application Security
OpenAI Agents Made 18,000 Unauthorized Edits to German Wiki
Application Security
Judge Rules Pentagon Actions Against Anthropic Unlawful
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Phoenix Contact UPS Vulnerabilities: Critical Flaws May Cause Denial-of-Service
Critical flaws in Phoenix Contact’s QUINT4 UPS devices could let attackers shut down power or steal credentials. One unpatched Modbus flaw risks remote “power denial” ...
Fuji Electric HMI Configurator Flaws: Industrial Software Vulnerabilities Expose Hack Risks
Fuji Electric’s Monitouch V-SFT, Tellus Lite V-Simulator, and V-Server Lite tools contain critical flaws (CVE-2024-11787, others) enabling remote code execution. CISA urges urgent patching.
Atroposia Malware Now Comes With Built-In Local Vulnerability Scanner
Atroposia is a newly surfaced malware-as-a-service kit that integrates remote access, credential theft and a built-in vulnerability scanner, enabling low-skill attackers to execute advanced campaigns.
TEE.Fail Attack Undermines Confidential Computing on Intel, AMD, and NVIDIA CPUs
The TEE.Fail side-channel attack allows extraction of cryptographic keys from Intel SGX, AMD SEV-SNP and NVIDIA GPU confidential environments via low-cost DDR5 memory bus interposers.
CISA Alerts to Actively Exploited Vulnerabilities in DELMIA Apriso by Dassault Systèmes
CISA warns that two vulnerabilities in DELMIA Apriso (CVE-2025-6204 and CVE-2025-6205) are under active exploitation, urging immediate patching across manufacturing operations.
Microsoft Faces Lawsuit Over Misleading Customers Into Copilot-Enhanced Microsoft 365 Subscriptions
The Australian regulator alleges Microsoft misled 2.7 million consumers into Copilot-integrated Microsoft 365 plans by concealing a cheaper Classic tier, prompting legal action and potential ...
Qilin Ransomware Leverages WSL to Deploy Linux Encryptors on Windows Systems
Qilin ransomware now exploits the Windows Subsystem for Linux to deploy Linux encryptors on Windows hosts, blending BYOVD attacks and remote-management tools for stealth/
Dentsu Confirms Data Breach Exposing Employee Payroll and Personal Information
Dentsu has confirmed a cyberattack on its UK operations via Merkle’s servers, exposing employee payroll and personal details, raising identity theft and phishing concerns.
Palo Alto Networks Unveils AI Security Suite: Cortex Cloud 2.0 & Prisma AIRS 2.0 Launched
Palo Alto Networks has launched Cortex Cloud 2.0 and Prisma AIRS 2.0—AI-driven platforms for cloud and AI application security. Combining automation, real-time threat detection, and ...
Operation ForumTroll: Chrome Zero-Day Tied to Italian Spyware Developer Memento Labs
A newly uncovered cyber-espionage operation known as Operation ForumTroll has revealed the resurgence of commercial spyware in state-sponsored surveillance campaigns. According to new research from ...
Palo Alto Networks Uncovers 194,000-Domain Smishing Campaign Linked to “Smishing Triad”
A global smishing campaign of unprecedented scale has been uncovered by Palo Alto Networks, revealing the vast operations of a Chinese-speaking threat actor known as ...
Coveware Reports Historic Drop in Ransomware Payments: Only 23% of Victims Paid in Q3 2025
The global ransomware economy is collapsing under growing resistance from its targets. According to new data from cybersecurity firm Coveware, the third quarter of 2025 ...
Firefox Add-Ons Must Declare Data Collection—or Be Rejected
Mozilla is taking a decisive step toward transparency and user control by requiring all Firefox extensions to disclose how they collect and handle personal data. ...
Chainguard’s $3.5 Billion Valuation Signals Massive Investor Confidence in Secure-by-Default Software
Chainguard, the Kirkland, Washington-based cybersecurity company, has announced a landmark $280 million growth funding round led by General Catalyst’s Customer Value Fund (CVF), pushing its ...
Italian Spyware Vendor Linked to Chrome Zero-Day Attacks
An Italian spyware vendor has been linked to Google Chrome zero-day attacks targeting Android and Windows users, exploiting CVE-2025-1234 to deliver advanced surveillance tools globally.
QNAP Warns Windows Backup Software Impacted by ASP.NET Flaw
QNAP warned that its Windows-based NetBak Replicator backup software is vulnerable to the critical ASP.NET flaw CVE-2024-43491, urging users to apply Microsoft’s latest security patches ...
NCX Exchange Data Leak Exposes User Wallets, Passwords, and Authentication Keys
NCX exchange exposed over 5 million records including wallet addresses, hashed passwords, 2FA codes and KYC documents—highlighting serious custodial risk and credential exploitation potential.
Dublin Airport Attack Claimed by Russian Ransomware Group Everest
Russian-linked ransomware group claims to have stolen 1.5 million records from Dublin Airport’s passenger systems, raising urgent concerns around aviation supply-chain cybersecurity and travel-data exposure.
HSBC USA Data Breach Exposes Sensitive Customer Financial Information
HSBC USA confirmed a cybersecurity breach exposing sensitive financial and personal data through unauthorized vendor access. The bank strengthened encryption, monitoring, and multi-layered authentication systems ...
Pwn2Own Ireland 2025: $1M Reward for 73 Zero-Day Exploits Uncovered
Pwn2Own Ireland 2025 awarded over $1 million for 73 zero-day discoveries across phones, NAS devices, and smart tech. The Summoning Team won “Master of Pwn,” ...