Zimbra Collaboration’s RSS feed parser has a newly disclosed SSRF vulnerability (CVE-2025-25065). Attackers can abuse it to access internal endpoints and internal services that should remain isolated. This article explains how the flaw works, its potential impact, and how you can defend your environment.
Sixty-four South Koreans were repatriated from Cambodia and are now under investigation for alleged involvement in large-scale online scam networks. Their return follows a scandal involving a student’s death, prompting Seoul to launch a crackdown on illicit recruitment and fraud operations.
ConnectWise has patched two critical vulnerabilities (CVE-2025-11492 & CVE-2025-11493) in its Automate platform that allowed adversary-in-the-middle attacks on software updates. MSPs and on-prem deployments must upgrade immediately to prevent malicious update injection and integrity bypass.
Belgian chains such as Brico and Carrefour are increasingly playing AI-generated, royalty-free music in their stores to cut licensing costs. This shift could slash 25–28 % of public performance income for local artists, warn rights organizations. Here’s how the technology works, the risks it raises, and what defenses stakeholders must consider.
Envoy Air confirmed it was targeted in a Clop-linked campaign exploiting vulnerabilities in Oracle E-Business Suite. While the airline asserts no passenger data was affected, business records may have been stolen. This write-up breaks down the tactics, likely exploited CVEs, impacts, and what organizations must do next.
Shadowserver has identified over 266,000 F5 BIG-IP devices exposed to remote attack after a breach revealed undisclosed vulnerabilities. Organizations must act now to mitigate potential exploitation.
A new campaign runs a clever tech support scam by hijacking Microsoft’s trusted branding. Victims encounter fake emails, CAPTCHA checks, browser-locking overlays, and a bogus phone “helpdesk” all designed to steal credentials or remote access. This article breaks down how the scam works, real indicators, and how you can defend yourself.
North Korea–linked hackers now embed JavaScript malware in blockchain smart contracts via EtherHiding. This stealthy method turns public blockchains into resilient drop zones. The multi-stage campaign includes JADESNOW and InvisibleFerret backdoors, demanding new defense strategies.
Security researchers uncovered multiple vulnerabilities in Microsoft’s BitLocker encryption, exposing Windows systems to data theft, privilege escalation, and bypass attacks. This article analyzes the flaws, their potential impact, and how organizations can secure encrypted drives against exploitation.
Security researchers discovered that Huddle01, a decentralized video-call platform, exposed sensitive user data through an open Kafka server. The leak included email addresses, wallet IDs, and IP metadata raising privacy concerns for blockchain-linked users.