Network Security
Sophos has patched five vulnerabilities in Sophos Firewall that could allow remote attackers to execute arbitrary code.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Dropped on Patch Tuesday, the exploit allows any user to spawn a shell with System privileges.
Vulnerabilities
The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild.
Vulnerabilities
Intel has informed customers about several high-severity vulnerabilities that can lead to privilege escalation and even code execution.
Vulnerabilities
The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.
Vulnerabilities
Fresh security updates for Chrome and Firefox resolve multiple high-severity memory safety vulnerabilities.
Vulnerabilities
Cisco says it is aware of attempted exploitation of critical ISE vulnerabilities leading to unauthenticated remote code execution.
Vulnerabilities
CISA has added two recent SysAid vulnerabilities, CVE-2025-2776 and CVE-2025-2775, to its KEV catalog.
ICS/OT
Eight vulnerabilities, including ones allowing full control over a device, have been discovered and patched in Helmholz REX 100 industrial routers.
Malware & Threats
More details emerged on the ToolShell zero-day attacks targeting SharePoint servers, but confusion remains over the vulnerabilities.
Vulnerabilities
Microsoft has started releasing updates to fix the exploited SharePoint zero-days tracked as CVE-2025-53770 and CVE-2025-53771.
Vulnerabilities
Hackers are exploiting a zero-day vulnerability in CrushFTP to gain administrative privileges on vulnerable servers via HTTPS.
Threat Intelligence
Enterprises running SharePoint servers should not wait for a fix for CVE-2025-53770 and should commence threat hunting to search for compromise immediately.
Vulnerabilities
Dozens of FortiWeb instances have been hacked after PoC targeting a recent critical vulnerability was shared publicly.
Vulnerabilities
The CitrixBleed 2 vulnerability in NetScaler may expose organizations to compromise even if patches have been applied.
Vulnerabilities
Four CVEs disclosed at the Pwn2Own Berlin 2025 hacking competition have been patched in VMware products.
Vulnerabilities
Cisco has released patches for multiple vulnerabilities, including a critical flaw in Cisco ISE that leads to remote code execution (RCE).
Vulnerabilities
Oracle’s July 2025 Critical Patch Update contains 309 security patches that address approximately 200 unique CVEs.
Artificial Intelligence
Google refused to share any details on how its Big Sleep AI foiled efforts to exploit a SQLite vulnerability in the wild.
Vulnerabilities
Google has released a Chrome 138 security update that patches a zero-day, the fifth resolved in the browser this year.
Vulnerabilities
CISA considers the recently disclosed CitrixBleed 2 vulnerability an unacceptable risk and has added it to the KEV catalog.
Vulnerabilities
Two Gravity Forms WordPress plugin versions available on the official download page were injected with malware in a supply chain attack.
Vulnerabilities
Wing FTP Server vulnerability CVE-2025-47812 can be exploited for arbitrary command execution with root or system privileges.
Vulnerabilities
Researchers demonstrated GPUHammer — a Rowhammer attack against GPUs — by degrading the accuracy of machine learning models.
Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default.
RegisterCodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps!
RegisterExpert Insights
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)
You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win.
(Danelle Au)
Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge.
(Torsten George)