1 High Severity 3 Medium Severity 4 Total CVEs CVE-2025-40300 High Severity x86/vmscape Hypervisor VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit
YiBackdoor
TRENDING TOPICS SEPT 24, 2025 YiBackdoor Malware Linked to IcedID and Latrodectus as ZLoader Evolves with Advanced Evasion Researchers at Zscaler have discovered a new malware family, known as YiBackdoor, that exhibits significant code overlaps with the loaders IcedID and Latrodectus. YiBackdoor can execute arbitrary commands, collect system information, capture
EDR Freeze
TRENDING TOPICS SEPT 23, 2025 EDR-Freeze: User-Mode Technique That Freezes EDR Processes Researchers have discovered a method called EDR-Freeze that enables attackers to silently disable antivirus and endpoint detection tools without requiring the installation of a malicious driver or exploiting a major system flaw. Instead, it leverages a standard Windows
BlackLock
TRENDING TOPICS SEPT 22, 2025 BlackLock Ransomware Expands Global Operations with Cross-Platform Attacks Researchers at AhnLab Security Intelligence Center (ASEC) have profiled BlackLock, a rebranded ransomware group that emerged from the earlier El Dorado operation and has quickly become a significant global threat. Active since at least early 2024, the
ChatGPT
CVE-2025-48539 High Android Operating System USE-AFTER-FREE A use-after-free flaw in acl_arbiter.cc (SendPacketToPeer) can trigger an out-of-bounds read, enabling remote or adjacent attackers to achieve code execution without requiring user interaction or elevated privileges on Android devices. Mitigation: Update to the latest Android patch level immediately and enable runtime
PyPI
TRENDING TOPICS SEPT 18, 2025 PyPI Tokens Revoked After GhostAction Supply Chain Attack The Python Software Foundation has confirmed that all PyPI publishing tokens stolen in early September's GhostAction supply chain attack have been invalidated, with no evidence that they were used to publish malicious packages. The incident
EventFilter Defines the trigger condition using WQL queries. Monitors for system events like startup, logon, or specific process launches to ensure predictable activation. → EventConsumer Executes malicious payload when triggered. Includes CommandLineEventConsumer for process execution and ActiveScriptEventConsumer for fileless VBScript/JScript. → FilterToConsumerBinding Links filters to consumers, activating the subscription. Without this
FileFix
TRENDING TOPICS SEPT 17, 2025 FileFix Campaign Expands Fix Attack Family With StealC Delivery Acronis’ Threat Research Unit has documented the first real-world deployment of FileFix, a successor to the ClickFix social engineering technique. Unlike ClickFix, which tricks users into pasting malicious commands into the Windows Run dialog, FileFix abuses
AWSDoor
TRENDING TOPICS SEPT 16, 2025 AWSDoor: Post-Compromise Persistence Tool in AWS AWSDoor is a post-compromise tool first identified in recent years, designed to help attackers maintain access inside AWS environments after an initial breach. It does not directly break into accounts but instead abuses AWS-native services and permissions to remain
UNC6395
TRENDING TOPICS SEPT 15, 2025 Update: FBI Warns of Salesforce Data Theft by UNC6040 and UNC6395 The FBI has issued a FLASH advisory warning that two active threat clusters, UNC6040 and UNC6395, are breaching Salesforce environments to steal sensitive data and extort victims. UNC6040, first reported by Mandiant in June
C2 Channels ZynorRAT uses Telegram bots to relay commands and results; CHILLYHELL communicates with hardcoded IPs over HTTP or DNS. Both approaches exploit widely used services to bypass perimeter monitoring. File Access and Exfiltration ZynorRAT supports targeted file retrieval and streaming back to Telegram; CHILLYHELL can download payloads and upload
Apple
CVE-2025-48539 High Android Operating System USE-AFTER-FREE A use-after-free flaw in acl_arbiter.cc (SendPacketToPeer) can trigger an out-of-bounds read, enabling remote or adjacent attackers to achieve code execution without requiring user interaction or elevated privileges on Android devices. Mitigation: Update to the latest Android patch level immediately and enable runtime