Application Security
A researcher has pointed out that only instances using a newer feature are impacted by CVE-2025-55182.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild.
Vulnerabilities
Intel has informed customers about several high-severity vulnerabilities that can lead to privilege escalation and even code execution.
Vulnerabilities
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
Vulnerabilities
The vulnerabilities could be exploited to leak credentials for external SQL connections or crash an agent service.
Vulnerabilities
A critical-severity vulnerability in the King Addons for Elementor plugin for WordPress has been exploited to take over websites.
Endpoint Security
Windows now displays in the properties tab of LNK files critical information that could reveal malicious code.
Vulnerabilities
Chrome 143 stable was released with patches for 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.
Mobile & Wireless
Google warns that two out of the 107 vulnerabilities patched in Android this month have been exploited in limited, targeted attacks.
ICS/OT
CISA has added CVE-2021-26829 to its Known Exploited Vulnerabilities (KEV) catalog.
Cloud Security
Five flaws in the open source tool may lead to path traversal attacks, remote code execution, denial-of-service, and tag manipulation.
Vulnerabilities
CISA has added CVE-2025-61757 to its Known Exploited Vulnerabilities (KEV) catalog.
Vulnerabilities
CVE-2025-61757 is an unauthenticated remote code execution vulnerability affecting Oracle Identity Manager.
Vulnerabilities
The vulnerabilities could be exploited to cause a denial-of-service (DoS) condition, execute arbitrary code, or access arbitrary files and directories.
Artificial Intelligence
SquareX claims to have found a way to abuse a hidden Comet API to execute local commands, but Perplexity says the research is fake.
Data Protection
Researchers demonstrated a now-patched vulnerability that could have been used to enumerate all WhatsApp accounts.
Vulnerabilities
A proof-of-concept (PoC) exploit targeting the high-severity remote code execution (RCE) bug exists.
Vulnerabilities
SolarWinds Serv-U is affected by vulnerabilities that can be exploited for remote code execution.
Vulnerabilities
An OS command injection flaw, the exploited zero-day allows attackers to execute arbitrary code on the underlying system.
Vulnerabilities
The total amount of money given to bug bounty hunters by the social media giant has reached $25 million.
Vulnerabilities
The flaw was reported by Google's Threat Analysis Group and was likely exploited by a commercial spyware vendor.
Vulnerabilities
The exploitation of the recent XWiki vulnerability has expanded to botnets, cryptocurrency miners, scanners, and custom tools.
Network Security
Security firms say the flaw has been actively exploited for weeks, even as Fortinet quietly shipped fixes and CISA added the bug to its...
Artificial Intelligence
Other noteworthy stories that might have slipped under the radar: EchoGram attack undermines AI guardrails, Asahi brewer still crippled after ransomware attack, Sora 2...
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)