This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP QHora-322 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.1. The...
Le 26 août 2025, Citrix a publié un bulletin de sécurité (cf. section Documentation) concernant, entre autres, la vulnérabilité CVE-2025-7775. Celle-ci permet une exécution de code arbitraire à distance et affecte toutes les versions de Citrix NetScaler ADC et NetScaler Gateway, dans certaines...
GeoVision ASManager Windows Application 6.1.2.0 - Remote Code Execution (RCE)
GeoVision ASManager Windows Application 6.1.2.0 - Credentials Disclosure
A critical vulnerability in older versions of the Claude Code for Visual Studio Code (VS Code) and other IDE extensions allowed malicious websites to connect to unauthenticated local WebSocket servers, potentially enabling remote command execution
StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
Ivanti Endpoint Manager Mobile 12.5.0.0 - Authentication Bypass
Lotte Card a signalé une cyberattaque après avoir détecté des signes de violation dans ses serveurs internes à la fin du mois dernier. L'entreprise a découvert du code malveillant sur l'un de ses serveurs et a ensuite effectué un examen approfondi de ses systèmes. Aucune fuite de données sensibles d...
Lingdang CRM 8.6.4.7 - SQL Injection
Birth Chart Compatibility WordPress Plugin 2.0 - Full Path Disclosure
Cool Wind Ventilation Corp. experienced a network security incident in which an unauthorized third-party accessed their network environment, potentially exposing personal information. A cyberattack against Cool Wind Ventilation was claimed by Play on September 9.
Blytheco, Inc. experienced a network security incident where an unauthorized third-party accessed their network environment, potentially exposing personal information. The incident occurred on or about August 26, 2025, and a data file of potentially impacted individuals was finalized on November 7,...
Le 26 août 2025, Citrix a publié un bulletin de sécurité (cf. section Documentation) concernant, entre autres, la vulnérabilité CVE-2025-7775. Celle-ci permet une exécution de code arbitraire à distance et affecte toutes les versions de Citrix NetScaler ADC et NetScaler Gateway, dans certaines...
Written by: Patrick Whitsell
In March 2025, Google Threat Intelligence Group (GTIG) identified a complex, multifaceted campaign attributed to the PRC-nexus threat actor UNC6384. The campaign targeted diplomats in Southeast Asia and other entities globally. GTIG assesses this was likely in support o...
A variant of the Atomic macOS Stealer (AMOS) targets macOS users via fake support sites in malvertising campaign
A Chinese developer has been sentenced to four years in prison after being found to deploy malicious code in his employer’s network, including a “kill switch”
For the latest discoveries in cyber research for the week of 25th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES US pharmaceutical company Inotiv has experienced a ransomware attack that resulted in the unauthorized access and encryption of certain systems and dat...
We optimized the route for visiting every NYC subway station using algorithms from combinatorial optimization, creating a 20-hour tour that beats the existing world record by 45 minutes.
Today we will cover a powerful, easy to use, autonomous agent called Manus. Manus is developed by the Chinese startup Butterfly Effect, headquartered in Singapore.
This post demonstrates an end-to-end indirect prompt injection attack leading to a compromise of Manus’ dev box.
This is achieved by tri...
The US Cybersecurity and Infrastructure Security Agency is planning to launch an update to a 2021 guideline for SBOM requirements