CVE-2025-59483 Critical Severity File path handling flaw that allows arbitrary file upload and remote code execution through the BIG-IP Configuration Utility. Enables full system compromise if the interface is Internet-accessible. Attack Vector Details Arbitrary file upload capability through misconfigured path handling Remote code execution via BIG-IP Configuration Utility Internet-accessible management
AWS
TRENDING TOPICS OCT 20, 2025 Significant AWS Outage Causes Widespread Internet Disruption Across Global Services In the early hours of October 20, 2025, Amazon Web Services (AWS) experienced a severe outage affecting multiple regions, with the US-EAST-1 Region at the epicenter. The disruption triggered widespread downtime across major online platforms,
Unmanaged Accounts and Shadow AI Use Critical Employees frequently use personal or unsanctioned accounts to access AI tools. These accounts operate outside corporate identity systems and lack logging, retention, or policy enforcement. The result is unmonitored data transfers into systems the organization neither owns nor audits. 77% of employees have
Microsoft
CVE-2025-46817 Critical Redis Database ≤8.2.1 INTEGER OVERFLOW AUTH REQUIRED Redis versions ≤8.2.1 allow authenticated users to trigger an integer overflow via crafted Lua scripts, potentially leading to remote code execution. The flaw affects all Redis versions with Lua scripting enabled. Mitigation: Update to Redis 8.2.
Qilin
TRENDING TOPICS OCT 16, 2025 Qilin Ransomware: Bulletproof Hosting Fuels High-Impact RaaS Campaigns Qilin has matured from a mid-2022 affiliate operation into a sophisticated ransomware-as-a-service platform that outfits affiliates with a polished web panel, phishing toolkits, RMM exploits, and double-extortion workflows. Its developers maintain the ransomware codebase in Golang and
TigerJack
CVE-2025-59218 Critical Azure Entra ID AUTH BYPASS Azure Entra ID vulnerability (CVSS 9.6) allowing authentication bypass or privilege escalation within identity services. CVE-2025-59236 Critical Microsoft Excel USE-AFTER-FREE Use-after-free in Microsoft Excel enabling arbitrary code execution when a user opens a malicious document. CVE-2025-59246 Critical Azure Entra ID PRIVILEGE ESCALATION
Pixnapping
TRENDING TOPICS OCT 14, 2025 Pixnapping: Pixel-Stealing Attack That Grabs 2FA Codes from Android Researchers have identified a new pixel-stealing attack called Pixnapping that can extract sensitive on-screen content from Android devices by abusing standard Android APIs and a hardware compression side-channel. A malicious app can push another app’s
Credential Discovery and Account Takeover Initial Access Attackers search for exposed AWS access keys and passwords in public code repositories, build environments, or data leaks. Once valid credentials are found, they log in directly to the victim's AWS account, bypassing perimeter defenses. Detection Opportunities Monitor for new API
CVE-2025-43300 High Apple iOS / iPadOS MEMORY CORRUPTION EXPLOITED IN WILD An out-of-bounds write issue in iOS and iPadOS image processing was addressed with improved bounds checking. Processing a malicious image file may result in memory corruption. Apple is aware of reports that this issue may have been exploited in an
CrowdStrike
TRENDING TOPICS OCT 09, 2025 CrowdStrike Patches Falcon Sensor Vulnerabilities on Windows CrowdStrike has released fixes for medium-level vulnerabilities in its Falcon sensor for Windows, identified as CVE-2025-42701 and CVE-2025-42706, that could allow attackers with prior code execution to delete arbitrary files and disrupt system stability. The first flaw, a
Akira March 2023 Model Ransomware-as-a-Service (RaaS) Malware Akira encryptor (Windows/Linux/Hypervisor) Primary Targets Mid-market businesses across manufacturing, construction, technology, and services sectors. Common Tactics Stolen credentials, VPN/SSL appliance exploitation (especially SonicWall), double extortion operations. Background Emerged from Conti-style frameworks, adopting double extortion and affiliate scaling. Uses retro "
Google Gemini
TRENDING TOPICS OCT 08, 2025 Gemini Exposed to ASCII Smuggling Exploit Enabling Hidden Prompt Injection FireTail researchers have discovered that Google’s Gemini AI remains vulnerable to ASCII Smuggling, an exploit that utilizes invisible Unicode control characters to conceal malicious commands within ordinary text. FireTail demonstrated that Gemini fails to