OWASP has launched CVE Lite CLI, a lightweight command-line vulnerability scanner designed to help developers quickly identify known vulnerabilities in their project dependencies. This open-source tool provides fast, offline-capable CVE scanning without the overhead of enterprise solutions, making s
Oxford University has confirmed a second security breach within weeks, this time compromising student data through its career services platform. The incident exposed personal information of students and alumni who used the university’s career management system. This follows a separate breach earlier
CISA has issued an urgent warning about active exploitation of a critical vulnerability in SolarWinds Serv-U file transfer software. Threat actors are leveraging this flaw to crash servers, causing widespread service disruptions. Organizations running affected versions must immediately apply patches
The Silent Ransom Group (SRG) has adopted DNS fast flux infrastructure to evade detection and takedown attempts. This technique rapidly rotates IP addresses associated with command-and-control domains, making it significantly harder for defenders to block malicious infrastructure. The shift represen
A sophisticated Chinese Advanced Persistent Threat (APT) group has deployed a previously unknown malware framework designed specifically for maintaining long-term access to compromised networks. The multi-stage implant demonstrates advanced evasion techniques, modular architecture, and infrastructur
Cisco SD-WAN infrastructure is being actively exploited through a newly discovered zero-day vulnerability with no patch currently available. Threat actors are targeting management interfaces to gain unauthorized access to enterprise networks. Organizations running Cisco SD-WAN must implement immedia
A sophisticated Android spyware campaign dubbed “Asin” is actively targeting Arabic-speaking users through malicious applications masquerading as legitimate news readers, PDF viewers, and war map trackers. The malware establishes persistent surveillance capabilities, exfiltrating sensitive data incl
A critical bug in Microsoft 365’s cloud infrastructure inadvertently bypassed Windows driver auto-update controls, triggering widespread service degradation across enterprise environments. The vulnerability allowed unauthorized driver updates to push through despite administrator-configured update p
The “Nightmare Eclipse” incident has reignited long-standing tensions between security researchers and software vendors over responsible disclosure practices. A critical vulnerability discovery turned contentious when disagreements over patch timelines, credit attribution, and public disclosure led
A sophisticated social engineering campaign is actively targeting US law firms, with threat actors impersonating IT support personnel to gain initial access. Attackers are leveraging phone calls and remote access tools to infiltrate networks, steal sensitive client data, and deploy ransomware. This