Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
iframe Security Exposed: The Blind Spot Fueling Payment Skimmer Attacks
Think payment iframes are secure by design? Think again. Sophisticated attackers have quietly evolved malicious overlay techniques to exploit checkout pages an…
Fedora 43: Critical Update for perl-Catalyst-Authentication-Credential-HTTP
This update upgrade the package to version 1.019. This version fixes CVE-2025-40920 by using Crypt::SysRandom to generate nonces instead of Data::UUID.
⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit-Flips, npm Worm & More
The security landscape now moves at a pace no patch cycle can match. Attackers aren’t waiting for quarterly updates or monthly fixes—they adapt within hours, b…
Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds
A team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 (DDR5) memory chips from South K…
Fedora 42: perl-Catalyst-Authentication-Credential-HTTP 2025-d72429a1f8
This update upgrade the package to version 1.019. This version fixes CVE-2025-40920 by using Crypt::SysRandom to generate nonces instead of Data::UUID.
A Closer Look at CVE-2025-8067: When Udisks Opens the Wrong Doors
It's always unnerving when a system service you rely on day-to-day turns out to be a potential gateway for unauthorized access. That's the story with CVE-2025-…
Debian 11: Critical DoS Vulnerabilities Resolved in libsndfile DLA-4287-1
Two vulnerabilities have been fixed in the audio data read/write library libsndfile.
Debian: firebird4.0 Critical Denial of Service Issues Fixed DSA-5992-1
Two vulnerabilities were discovered in the Firebird database, which may result in denial of service or authentication bypass. For the stable distribution (trix…
What Is a Privilege Escalation Vulnerability?
Imagine this scenario: you're managing Linux servers that host critical applications, where uptime is everything and security is non-negotiable. You're diligen…
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Cybersecurity researchers are calling attention to malicious activity orchestrated by a China-nexus cyber espionage group known as Murky Panda that involves ab…
Debian 11: postgresql-13 Critical Security Update DLA-4273-1
It was discovered that there were a number of vulnerabilities in postgresql-13, the widely-popular database management system: * CVE-2025-8713: The fix for CVE…
New Android Malware Wave Hits Banking via NFC Relay Fraud, Call Hijacking, and Root Exploits
Cybersecurity researchers have disclosed a new Android trojan called PhantomCard that abuses near-field communication (NFC) to conduct relay attacks for facili…
⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
This week, cyber attackers are moving quickly, and businesses need to stay alert. They’re finding new weaknesses in popular software and coming up with clever …
What is a CSRF Vulnerability?
CSRF, or Cross-Site Request Forgery , is one of those vulnerabilities that's deceptively simple but can wreak havoc if left unaddressed. Think about it: your u…
Gentoo: Mozilla NSS Standard TLS RSA Decryption Timing Flaw GLSA-202509-05
A vulnerability has been discovered in NSS, which can lead to the recovery of private data.
How the Browser Became the Main Cyber Battleground
Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:Compromise an endpoint via softw…
Google AI "Big Sleep" Stops Exploitation of Critical SQLite Vulnerability Before Hackers Act
Google on Tuesday revealed that its large language model (LLM)-assisted vulnerability discovery framework identified a security flaw in the SQLite open-source …
Debian 11: DLA-4240-1 important: redis DoS and remote code execution
Two issues were discovered in Redis, the key-value database: * CVE-2025-32023: An authenticated user may have used a specially-crafted string to trigger a stac…
Linux Initramfs Vulnerability Undermines Encryption Protections
Linux admins, take a moment to breathe. We all know the mantra''full-disk encryption is the gold standard for safeguarding data at rest. But what if I told you…
BERT Ransomware Weaponizes Cross-Platform Flaws to Target Linux, Windows, ESXi
Ransomware is nothing new to us as Linux admins and infosec folks''it's pretty much part of the modern threat landscape now. But when I say "BERT ransomware," …
Fedora 42 chromium critical: CVE-2025-6555, 6556, 6557 issues
Update to 138.0.7204.49 CVE-2025-6555: Use after free in Animation CVE-2025-6556: Insufficient policy enforcement in Loader CVE-2025-6557: Insufficient data va…
Fedora 41 FEDORA-2025-e4b1668bdd critical: chromium use after free
Update to 138.0.7204.49 CVE-2025-6555: Use after free in Animation CVE-2025-6556: Insufficient policy enforcement in Loader CVE-2025-6557: Insufficient data va…
China-linked Salt Typhoon Exploits Critical Cisco Vulnerability to Target Canadian Telecom
The Canadian Centre for Cyber Security and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber attacks mounted by the China…
Critical Flaws Discovered in X.Org X Server and Xwayland
Let's cut to the chase''if you're running any system with X.Org X server or Xwayland versions prior to the latest patches , your setup may be dangerously expos…