VULNERABILITY

The automaker uses a developer-friendly platform to secure the supply chain.

Discover how Software supply chain security has serious ramifications for teams in charge of installing software in connected cars. Real-world risks to.

Top Cyber Industry Defenses Spike CO2 Emissions

Two specific areas of cybersecurity — backups and identity and access management (IAM) — are responsible for nearly half (45%) of the cybersecurity.

SolarWinds WHD Attacks Draw Attention to the Dangers of Vulnerable Apps

New vulnerabilities in SolarWinds Web Help Desk (WHD) are being exploited by threat actors, highlighting the dangers of applications that are accessible.

Microsoft Patches 6 Actively Exploited Zero-Days

Six of the 59 vulnerabilities Microsoft revealed in its most recent security update are already being actively exploited by attackers, so security teams.

BYOVD Bundles With Ransomware Payload by Reynolds

The bring-your-own-vulnerable-driver (BYOVD) technique has been reimagined by an emergent ransomware group. The Symantec and Carbon Black Threat Hunter.

Warlock Gang Breaches SmarterTools Via SmarterMail Bugs

A breach that happened as a result of vulnerabilities that SmarterTools fixed last month was recently revealed This article explores smartermail instance.

Shai-hulud: The Unspoken Price of Supply Chain Incidents

Although thousands of software packages and repositories have been compromised by numerous malware attacks targeting open source software components, it.

Safe Use Is Complicated by OpenClaws Gregarious Insecurities

Discover how The open source agentic AI assistant OpenClaw, which is accessible through GitHub, is gaining popularity. Dane Sherrets, a staff innovation.

Data Tool to Triage Exploited Vulnerabilities Can Make KEV More Useful

Not every software vulnerability is the same. With over 48,100 vulnerabilities in 2025, up 21% from the year before, IT and security teams are trying to.

EnCase Driver Weaponized as EDR Killers Persist

Even though the driver's digital certificate was revoked over ten years ago, threat actors are still using the Windows kernel driver of a forensic tool to.

Moltbook, an agentic AI website, has numerous security flaws.

The database used to store all user secrets, personally identifiable information (PII), and other information was made public by an experimental.

Sandbox escape and arbitrary code execution are made possible by a critical vm2 Node.js flaw.

The widely used vm2 Node.js library has been found to have a critical sandbox escape vulnerability that, if successfully exploited, could enable

China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines

Threat actors who speak Chinese are suspected of using a compromised SonicWall VPN appliance as a first point of access to launch a VMware ESXi exploit that may have been created as early

Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions

To fix several security flaws affecting on-premise versions of Apex Central for Windows, including a serious flaw that could lead to arbitrary code execution, Trend Micro has released secu

CISA Retires 10 Emergency Cybersecurity Directives Issued Between 2019 and 2024

Ten emergency directives (Eds) issued between 2019 and 2024 are being retired, the U.S This article explores emergency directives eds. . Cybersecurity and Infrastructure Security Agency (C

Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release

Updates for a medium-severity security vulnerability have been made available by Cisco This article explores vulnerability available cisco. . The licensing feature contains the vulnerabili

Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Cybersecurity researchers have disclosed details of multiple critical-severity security flaws affecting Coolify, an open-source, self-hosting platform. The flaws could result in authentica

China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes

UAT-7290, a China-nexus threat actor, has been linked to espionage-focused intrusions against organizations in Southeastern Europe and South Asia This article explores attacks uat 7290. .

ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories

There is never a quiet moment on the internet This article explores escalation vulnerability windows. . There are new security issues, scams, and hacks every week.

The stories this

The State of Trusted Open Source

The reliable source for open source, Chainguard, has a unique perspective on how contemporary businesses actually use open source software and where they encounter operational difficulties

CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited

Two security vulnerabilities affecting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView have been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybers

Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control

Another n8n security vulnerability has been revealed by Cyera Research Labs. An unauthorized remote attacker can take total control of vulnerable instances thanks to this vulnerability. A

n8n Warns of CVSS 10.0 RCE Vulnerability Affecting Self-Hosted and Cloud Versions

A maximum-severity security vulnerability that, if successfully exploited, could lead to authenticated remote code execution (RCE) has been reported by n8n. The vulnerability is rated 10.0

Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication

To fix several vulnerabilities in its Backup & Replication software, Veeam has released security updates. This article addresses a "critical" problem that might lead to remote code executi

Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers

Legacy D-Link DSL gateway routers have a recently identified critical security flaw that is being actively exploited in the wild. Command injection in the "dnscfg.cgi" endpoint is the subj

Critical AdonisJS Bodyparser Flaw (CVSS 9.2) Enables Arbitrary File Write on Servers

A remote attacker may be able to write any file on the server due to a vulnerability in the AdonisJS package. The function "MultipartFile.move(location, options)" that permits a file to be

CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity flaw impacting Sierra Wireless AirLink ALEOS routers to its Known Exploited Vulnerabilities (KEV) catalo

Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw

Google updates the Chrome browser to fix three security issues. One of the defects, which has a high severity rating, has been actively exploited in the wild. The fixes are also recommended f

Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability

Two hacking groups with ties to China have been observed weaponizing the newly disclosed security flaw in React Server Components (RSC) The vulnerability in question is CVE-2025-55182 (CVSS s

Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs

CrowdStrike says DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China. The Chinese AI company previously attract