Seven zero-day vulnerabilities affecting QTS/QuTS hero and popular QNAP apps were exploited at a live event. Update OS and apps, remove internet exposure, and enforce MFA. Verify snapshots and offline backups, stream logs off-box, and alert on admin anomalies and backup job edits to prevent data loss.
A cluster of malicious NuGet packages plants delayed logic bombs that crash apps, corrupt databases, and disrupt Siemens S7 PLCs. Remove the dependencies, rebuild from clean mirrors, and test with date-manipulation harnesses. Lock down registries, verify publishers, and stream build/runtime logs off-box to detect abuse early.
Microsoft has rolled out hardware-accelerated BitLocker support for Windows 11, delivering faster encryption, lower CPU overhead, and stronger device protection. This update significantly improves enterprise deployment and endpoint security strategies.
A third-party customer support vendor connected to Discord suffered a data breach that exposed personal information. Attackers accessed the vendor’s ticketing system and obtained names, email addresses, usernames, and in some cases scanned government-issued IDs. Crucially, Discord confirmed that its internal infrastructure remained unaffected. Nevertheless, the event underscores the risks created when organizations depend on…
KONNI operators hijack Google accounts, pivot into Find Hub, track target locations, and trigger remote resets on Android blending valid features with malicious intent while evading conventional controls.
A newly discovered Android banking trojan combines overlay attacks with a stealthy hidden VNC server to gain full remote control over compromised devices.
LandFall is a commercial-grade Android spyware that weaponized WhatsApp images to exploit a Samsung zero-day in the image pipeline. The payload rode malformed DNG files, then modified SELinux and deployed modules for full-device surveillance. Patch promptly and restrict media auto-download.
macOS now attracts serious attention from nation-state and criminal actors, especially credential stealers. A new public dataset, Malet, and a static analysis tool, Katalina, give defenders large-scale visibility into Mach-O malware traits. Teams can use them to tune EDR, test vendor claims, and finally treat Mac fleets as first-class citizens.
A critical flaw (CVE-2025-9242) in WatchGuard Fireware OS allows unauthenticated attackers to execute code remotely via the IKEv2 VPN process. This vulnerability impacts Firebox devices running outdated firmware and exposes enterprise networks to full compromise if left unpatched.
NGAV (next-gen antivirus) focuses on stopping malware and exploits with AI and behavior analysis. EDR adds continuous visibility, investigation, and one-click response when prevention misses. For most SMEs, start with a strong NGAV baseline and move to EDR as soon as you can support alerts and response especially if ransomware or hands-on-keyboard attacks worry you. …