#Proficio is a World-Class #Cybersecurity Service Provider. We are changing the way organizations meet security & compliance requirements. #MDR
Google fixed 124 Android flaws, including CVE-2025-48595, an actively exploited privilege escalation bug linked to targeted attacks.
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.
A critical Meta AI vulnerability on Instagram allowed hackers to bypass 2FA and hijack high-value OG accounts. Discover how the exploit worked
Operation FlutterBridge is a malvertising campaign targeting macOS users. It distributed the new backdoor FlutterShell, built using the Flutter framework.
What is HazyBeacon? Learn how attackers use AWS Lambda Function URLs for command and control, why cloud-native C2 is difficult to detect, and how to defend against serverless infrastructure abuse.
Silent Push observed several drive-by attack clusters using ClickFix and FakeUpdates campaigns. We named the primary driver DriveSurge.
Rapid7 details a critical unauthenticated overflow in HP Poly VoIP phones that can lead to root RCE, with patches available for affected models.
New Wave Of Phishing Emails with SVG Files, Author: Xavier Mertens
A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals credent...
The Centre for Cybersecurity Belgium (CCB), the country's national authority for cybersecurity, warned on Friday that threat actors are now exploiting a recently patched critical Windows Netlogon...
TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, Author: Kenneth Hartman
A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows.
BadHost" was found in Starlette, a package with 325 million weekly downloads.
U.S. CISA adds Trend Micro Apex One and Langflow vulnerabilities to its Known Exploited Vulnerabilities catalog.
Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks.
PinTheft is a Linux LPE flaw in the RDS subsystem with public exploit code. Arch Linux users should patch it immediately
A novel evasion technique called GhostTree, which exploits NTFS junctions to create recursive directory loops.
An attacker can exploit the command injection flaw to gain remote access to robotic systems, causing significant disruption to the environment.