A new artificial intelligence platform called Venice.ai is raising serious cybersecurity concerns after researchers discovered it can generate functional malware, phishing emails, and sophisticated cyberattack tools with minimal user expertise. Unlike mainstream AI services such as ChatGPT, Venice.ai deliberately removes…
Tag: Cyber Security News
Critical NETGEAR Router Vulnerability Let Attackers Gain Full Admin Access
A newly disclosed authentication bypass vulnerability has exposed thousands of NETGEAR DGND3700v2 routers to remote attacks, allowing cybercriminals to gain complete administrative control without requiring valid credentials. The flaw, tracked as CVE-2025-4978 and assigned a critical CVSS score of 9.3,…
ModSecurity Vulnerability Exposes Millions of Web Servers to Severe DoS Condition
A critical vulnerability in ModSecurity’s Apache module has been disclosed, potentially exposing millions of web servers worldwide to denial-of-service attacks. The flaw, tracked as CVE-2025-47947 and assigned a CVSS score of 7.5, affects the popular open-source web application firewall’s handling…
LockBit Data Leak Unveils Most Active Affiliates & Their Innerworkings
A significant data breach has exposed the inner workings of one of the world’s most prolific ransomware operations, providing unprecedented insight into LockBit’s affiliate structure and victim targeting strategies. The treasure trove of leaked information, published on LockBit’s hijacked leak…
Exploitable Vulnerabilities in Canon Printers Allow Attackers to Gain Admin Privileges
Canon Inc. has issued a critical security advisory warning customers about severe vulnerabilities affecting a wide range of their production printers, office multifunction printers, and laser printers. The vulnerabilities, identified as CVE-2025-3078 and CVE-2025-3079, enable malicious actors to extract sensitive…
CISA Alerts on Threat Actors Targeting Commvault’s Azure App to Steal Secrets
CISA issued an urgent advisory, warning organizations about ongoing cyber threat activity targeting Commvault’s software-as-a-service (SaaS) cloud applications hosted in Microsoft Azure environments. Threat actors have successfully accessed client secrets for Commvault’s Metallic Microsoft 365 backup solution, providing unauthorized access…
ViciousTrap Hacker Compromised 5,500+ Edge Devices From 50+ Brands & Turned Them Into Honeypots
A sophisticated threat actor designated as ViciousTrap has successfully compromised over 5,500 edge devices across more than 50 brands, transforming them into a massive distributed honeypot network capable of intercepting and monitoring exploitation attempts worldwide. This unprecedented campaign represents a…
ModSecurity Vulnerability Exposes Millions of Web Servers to Severe Denial-of-Service
A critical vulnerability in ModSecurity’s Apache module has been disclosed, potentially exposing millions of web servers worldwide to denial-of-service attacks. The flaw, tracked as CVE-2025-47947 and assigned a CVSS score of 7.5, affects the popular open-source web application firewall’s handling…
PoC Published For Fortinet 0-Day Vulnerability That Being Exploited in the Wild
Security researchers have published detailed proof-of-concept (PoC) analysis for a critical zero-day vulnerability affecting multiple Fortinet products, as threat actors continue to exploit the flaw in real-world attacks actively. The vulnerability, tracked as CVE-2025-32756, represents a significant security risk with…
Gujarat Teen Behind 50+ Cyberattacks During ‘Operation Sindoor’ Arrested
The Gujarat Anti-Terrorism Squad (ATS) has arrested an 18-year-old and a minor for orchestrating over 50 coordinated cyberattacks on Indian government websites during the recent military ‘Operation Sindoor’. The main accused, Jasim Shahnawaz Ansari from Nadiad in Gujarat’s Kheda district,…
CefSharp Enumeration Tool Reveals Security Vulnerabilities in .NET Desktop Apps
Security researchers have unveiled significant vulnerabilities in .NET desktop applications that utilize CefSharp, a popular framework for embedding Chromium browsers within desktop applications, exposing millions of enterprise applications to potential remote code execution attacks. CefSharp, a lightweight .NET wrapper around…
Russian Hackers Leverage Oracle Cloud Infrastructure to Scaleway Object Storage
In a sophisticated cybersecurity attack uncovered this week, Russian threat actors have been observed exploiting multiple cloud service providers to deliver the notorious Lumma Stealer malware. The campaign utilizes legitimate cloud infrastructure—including Oracle Cloud Infrastructure (OCI), Scaleway Object Storage, and…
Versa Concerto 0-Day Authentication Bypass Vulnerability Allows Remote Code Execution
Significant vulnerabilities were uncovered in Versa Concerto, a widely deployed SD-WAN orchestration platform used by major enterprises and government entities. The flaws include authentication bypass vulnerabilities that can be chained to achieve remote code execution and complete system compromise. Despite…
Multiple GitLab Vulnerabilities Let Attackers Trigger DoS Attacks
GitLab has released critical security patches addressing 11 vulnerabilities across its Community Edition (CE) and Enterprise Edition (EE) platforms, with several high-risk flaws enabling denial-of-service (DoS) attacks. The coordinated release of versions 18.0.1, 17.11.3, and 17.10.7 comes as the DevOps…
UAT-638 Hackers Exploit Cityworks Zero-Day to Attack IIS Servers With VSHell Malware
A sophisticated cyber threat group designated as UAT-6382 has been actively exploiting a critical zero-day vulnerability in Cityworks, a popular asset management system used by local governments across the United States. The vulnerability, tracked as CVE-2025-0994, allows remote code execution…
Cisco Webex Meetings Vulnerability Let Attackers Manipulate HTTP Responses
Cisco disclosed a security vulnerability (CVE-2025-20255) affecting its Webex Meetings service that could allow remote attackers to manipulate cached HTTP responses. The vulnerability, assigned a CVSS score of 4.3 (Medium severity), stems from improper handling of malicious HTTP requests in…
Netwrix Password Manager Vulnerability Allows Authenticated Remote Code Execution
A critical security vulnerability has been discovered in Netwrix Password Secure, an enterprise password management solution, allowing authenticated attackers to execute arbitrary code on victim machines. The vulnerability, identified as CVE-2025-26817, affects all versions of Netwrix Password Secure up to…
Hackers Using Weaponized npm Packages to Attack React, Node.js JavaScript Frameworks
In a troubling development for the JavaScript ecosystem, security researchers have discovered a sophisticated campaign targeting popular frameworks through weaponized npm packages. These malicious packages, which have accumulated over 6,200 downloads, masquerade as legitimate plugins and utilities while secretly containing…
Threat Actors Hosted ZeroCrumb Malware on GitHub That Steals Browser Cookies
Cybersecurity researchers have identified a new infostealer malware called “ZeroCrumb” that was recently distributed through GitHub repositories. This sophisticated malware specifically targets browser cookies from popular browsers including Chrome, Brave, and Edge, enabling attackers to steal sensitive user authentication data…
Linux kernel SMB 0-Day Vulnerability Uncovered Using ChatGPT
A zero-day vulnerability in the Linux kernel was discovered, utilizing OpenAI’s o3 model. This finding, assigned CVE-2025-37899, marks a significant advancement in AI-assisted vulnerability research. The vulnerability, officially confirmed on May 20, 2025, affects the ksmbd component of the Linux…