A critical use-after-free vulnerability (CVE-2026-50263) has been discovered in the X.Org Server’s CreateSaverWindow function, allowing authenticated local attackers to read sensitive information from freed memory regions. The flaw affects multiple Linux distributions and Unix-like systems still run
Microsoft has significantly evolved its Cloud-Native Application Protection Platform (CNAPP) capabilities, aligning with industry-leading cloud security solutions. The enhancement consolidates multiple security tools into a unified platform, offering comprehensive visibility, risk assessment, and th
A critical zero-day vulnerability in Cisco systems is being actively exploited by malicious threat actors who have successfully gained the highest level of administrative access at a communications service provider. The exploitation has granted attackers complete control over critical network infras
CISA has added CVE-2025-67038 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation of a critical authentication bypass vulnerability in Lantronix EDS5000 terminal servers. The flaw allows unauthenticated attackers to gain administrative access remotely, posing severe
A sophisticated phishing campaign dubbed “EvilTokens” is leveraging client-side DOM manipulation and JavaScript encryption to evade traditional static analysis tools. By deferring malicious code execution until runtime within the victim’s browser, attackers successfully bypass email security gateway
A critical vulnerability dubbed “PixelSmash” has been discovered in FFmpeg, one of the world’s most widely used multimedia processing frameworks. The flaw (CVE-2024-XXXXX) enables attackers to achieve remote code execution through specially crafted video files. With FFmpeg integrated into thousands
Cybercriminals are exploiting tax season anxieties by distributing malicious Income Tax Assessment Notices that deliver Remote Access Trojan (RAT) malware to Windows systems. These sophisticated phishing campaigns leverage social engineering tactics, disguising malware as legitimate tax documents to
A newly identified threat actor known as GhostShell has emerged with targeted phishing campaigns against Ukraine’s drone defense sector. The group employs advanced social engineering techniques combined with malicious payloads designed to compromise critical defense infrastructure. This campaign rep
CISA has added multiple critical Ubiquiti UniFi OS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting these flaws in the wild. The vulnerabilities, carrying maximum CVSS scores, allow unauthenticated remote code execution and comp
CISA’s updated Trusted Internet Connections (TIC) 3.0 guidance now explicitly incorporates Secure Access Service Edge (SASE) architectures as a pathway to modernize federal network security. This guidance enables agencies to transition from legacy perimeter-based security to cloud-native zero trust