Moxa has released critical security patches for a severe authentication bypass vulnerability (CVE-2024-12297, CVSS 9.2) affecting multiple PT switch series. The flaw in the authorization mechanism could allow attackers to forge authentication hashes through brute-force or MD5 collision att...
North Korean Lazarus hackers have deployed six malicious npm packages, downloaded approximately 330 times, designed to steal credentials and cryptocurrency data. Using typosquatting techniques to mimic legitimate libraries, these packages systematically collect system information, extract ...
CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including two in Advantive VeraCore (unrestricted file upload and SQL injection) and three path traversal flaws in Ivanti Endpoint Manager. The VeraCore exploits are linked to Vietnam's X...
A Windows zero-day vulnerability (CVE-2025-24983) has been exploited since March 2023 before being patched in Microsoft's March 2025 update. The use-after-free flaw in the Win32 Kernel Subsystem allows privilege escalation to SYSTEM level. Attackers used the PipeMagic backdoor to target pr...
SideWinder APT group has expanded its cyberattack campaign to target maritime and logistics companies across Asia, the Middle East, and Africa, while also focusing on nuclear power plants and energy infrastructure. The group has compromised diplomatic entities in multiple countries, includ...
