Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
This week, cyber attackers are moving quickly, and businesses need to stay alert. They’re finding new weaknesses in popular software and coming up with clever …
What is a CSRF Vulnerability?
CSRF, or Cross-Site Request Forgery , is one of those vulnerabilities that's deceptively simple but can wreak havoc if left unaddressed. Think about it: your u…
Gentoo: Mozilla NSS Standard TLS RSA Decryption Timing Flaw GLSA-202509-05
A vulnerability has been discovered in NSS, which can lead to the recovery of private data.
How the Browser Became the Main Cyber Battleground
Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:Compromise an endpoint via softw…
Google AI "Big Sleep" Stops Exploitation of Critical SQLite Vulnerability Before Hackers Act
Google on Tuesday revealed that its large language model (LLM)-assisted vulnerability discovery framework identified a security flaw in the SQLite open-source …
Debian 11: DLA-4240-1 important: redis DoS and remote code execution
Two issues were discovered in Redis, the key-value database: * CVE-2025-32023: An authenticated user may have used a specially-crafted string to trigger a stac…
Linux Initramfs Vulnerability Undermines Encryption Protections
Linux admins, take a moment to breathe. We all know the mantra''full-disk encryption is the gold standard for safeguarding data at rest. But what if I told you…
BERT Ransomware Weaponizes Cross-Platform Flaws to Target Linux, Windows, ESXi
Ransomware is nothing new to us as Linux admins and infosec folks''it's pretty much part of the modern threat landscape now. But when I say "BERT ransomware," …
Fedora 42 chromium critical: CVE-2025-6555, 6556, 6557 issues
Update to 138.0.7204.49 CVE-2025-6555: Use after free in Animation CVE-2025-6556: Insufficient policy enforcement in Loader CVE-2025-6557: Insufficient data va…
Fedora 41 FEDORA-2025-e4b1668bdd critical: chromium use after free
Update to 138.0.7204.49 CVE-2025-6555: Use after free in Animation CVE-2025-6556: Insufficient policy enforcement in Loader CVE-2025-6557: Insufficient data va…
China-linked Salt Typhoon Exploits Critical Cisco Vulnerability to Target Canadian Telecom
The Canadian Centre for Cyber Security and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber attacks mounted by the China…
Critical Flaws Discovered in X.Org X Server and Xwayland
Let's cut to the chase''if you're running any system with X.Org X server or Xwayland versions prior to the latest patches , your setup may be dangerously expos…
Fedora 41: 2025-a5f56fe8ff critical: roundcubemail RCE issue
This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix Post-Auth RCE vi…
Redefining Cyber Value: Why Business Impact Should Lead the Security Conversation
Security teams face growing demands with more tools, more data, and higher expectations than ever. Boards approve large security budgets, yet still ask the sam…
HPE Issues Security Patch for StoreOnce Bug Allowing Remote Authentication Bypass
Hewlett Packard Enterprise (HPE) has released security updates to address as many as eight vulnerabilities in its StoreOnce data backup and deduplication solut…
Fedora 42: 2025-99055e8fe5 critical: systemd local information disclosure
Fix for local information disclosure in systemd-coredump (CVE-2025-4598) Fixes for systemd itself, run0, systemd-networkd, "secure" pager, man pages, shell com…
DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints
The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's (MSP) SimpleHelp remote monitoring and management (R…
Mageia 2025-0163: iputils
ping in iputils through 20240905 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a…
Mageia 2025-0159: chromium-browser-stable
Heap buffer overflow in HTML. (CVE-2025-4096) Out of bounds memory access in DevTools. (CVE-2025-4050) Insufficient data validation in DevTools. (CVE-2025-4051…
Go-Based Malware Deploys XMRig Miner on Linux Hosts via Redis Configuration Abuse
Cybersecurity researchers are calling attention to a new Linux cryptojacking campaign that's targeting publicly accessible Redis servers.The malicious activity…
Branch Privilege Injection Vulnerability Threatens Intel Processors
In modern computing, the line dividing speed from security is razor-thin. Performance innovations have helped processors handle billions of instructions per se…
Mageia 9: 2025-0156 critical: Fixes for Java TLS and compiler issues
Better TLS connection support. (CVE-2025-21587) Improve compiler transformations. (CVE-2025-30691) Enhance Buffered Image handling. (CVE-2025-30698) The update…
Debian 11: DLA-4162-1 critical: redis unlimited buffer overflow
Unlimited output buffer for unauthenticated clients has been fixed in the key¢''value database Redis. For Debian 11 bullseye, this problem has been fixed in ve…
Beyond Vulnerability Management – Can You CVE What I CVE?
The Vulnerability TreadmillThe reactive nature of vulnerability management, combined with delays from policy and process, strains security teams. Capacity is l…