A sophisticated cyberattack orchestrated by Chinese state-sponsored hackers has exposed vulnerabilities in the global cybersecurity infrastructure, targeting critical COVID-19 research from American universities and exploiting Microsoft Exchange servers worldwide. The Justice Department announced the arrest of a key figure in…
Tag: Cyber Security News
Microsoft 365 PDF Export LFI Vulnerability Allows Access to Sensitive Server Data
A critical Local File Inclusion (LFI) vulnerability was recently discovered in Microsoft 365’s Export to PDF functionality, potentially allowing attackers to access sensitive server-side data, including configuration files, database credentials, and application source code. The vulnerability, reported by security researcher…
Splunk Address Third-Party Packages Vulnerabilities in SOAR Versions – Update Now
Splunk has released critical security updates addressing multiple vulnerabilities in third-party packages in SOAR versions 6.4.0 and 6.4. Published on July 7, 2025, this comprehensive security update remediates various Common Vulnerabilities and Exposures (CVEs) ranging from medium to critical severity…
VS Code Extension Weaponized With Two Lines of Code Leads to Supply Chain Attack
A sophisticated supply chain attack has compromised ETHcode, a popular Visual Studio Code extension for Ethereum development, through a malicious GitHub pull request that required just two lines of code to weaponize the trusted software. The attack, discovered by ReversingLabs…
Microsoft Patches Wormable RCE Vulnerability in Windows and Windows Server
Microsoft has released critical security updates to address CVE-2025-47981, a severe heap-based buffer overflow vulnerability in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism that affects multiple Windows and Windows Server versions. This vulnerability carries a CVSS score of 9.8 out…
Splunk Address Third Party Packages Vulnerabilities in Enterprise Versions – Update Now
Splunk has released critical security updates addressing multiple Common Vulnerabilities and Exposures (CVEs) in third-party packages across Enterprise versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, and higher. Published on July 7, 2025, these updates remediate high-severity vulnerabilities in essential components, including setuptools,…
FortiWeb SQL Injection Vulnerability Allows Attacker to Execute Malicious SQL Code
A critical security vulnerability has been discovered in FortiWeb web application firewalls that enables unauthenticated attackers to execute unauthorized SQL commands through specially crafted HTTP and HTTPS requests. This vulnerability, classified as CWE-89 (Improper Neutralization of Special Elements used in…
Citrix Windows Virtual Delivery Agent Vulnerability Let Attackers Gain SYSTEM Privileges
A critical security vulnerability has been discovered in Citrix Windows Virtual Delivery Agent that allows local attackers to escalate privileges and gain SYSTEM-level access to affected systems. The vulnerability, tracked as CVE-2025-6759, affects multiple versions of Citrix Virtual Apps and…
SparkKitty Malware Attacking iOS and Android Device Users to Steal Photos From Gallery
A sophisticated Trojan malware known as SparkKitty has been actively targeting iOS and Android devices since early 2024, infiltrating both official app stores and untrusted websites to steal images from users’ device galleries. This malware campaign, which appears to be…
New Android TapTrap Attack Let Malicious Apps Bypass Permission and Carry out Destructive Actions
Security researchers discover novel animation-based vulnerability affecting 76% of Android apps. Security researchers at TU Wien have uncovered a sophisticated new attack vector dubbed “TapTrap” that enables malicious Android applications to bypass the operating system’s permission system and execute destructive…