CrowdCyber.com 3 months ago

React2Shell critical flaw actively exploited in China-linked attacks

BleepingComputer

Critical React2Shell flaw actively exploited in China-linked attacks

Multiple China-linked threat actors began exploiting the React2Shell vulnerability (CVE-2025-55182) affecting React and Next.js just hours after th...

CrowdCyber.com 3 months ago

New Raptor Framework Uses Agentic Workflows to Create Patches

Dark Reading

New Raptor Framework Uses Agentic AI to Create Patches

Researchers used prompts and large language models to develop an open source AI framework capable of generating both vulnerability exploits and pat...

CrowdCyber.com 3 months ago

CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

Dark Reading

CISA Warns of

State-sponsored actors tied to China continue to target VMware vSphere environments at government and technology organizations.

CrowdCyber.com 3 months ago

Predator spyware uses new infection vector for zero-click attacks

BleepingComputer

Predator spyware uses new infection vector for zero-click attacks

The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed "Aladdin" that compromised specific...

CrowdCyber.com 3 months ago

AI Bolsters Python Variant of Brazilian WhatsApp Attacks

Dark Reading

AI Bolsters Python Variant of Brazilian WhatsApp Attack

Water Saci has upgraded its self-propagating malware to compromise banks and crypto exchanges by targeting enterprise users of the popular chat app.

CrowdCyber.com 3 months ago

Critical React Flaw Triggers Calls for Immediate Action

Dark Reading

Critical React Flaw Triggers Calls for Immediate Action

The vulnerability, which was assigned two CVEs with maximum CVSS scores of 10, may affect more than a third of cloud service providers.

CrowdCyber.com 3 months ago

CISA warns of Chinese "BrickStorm" malware attacks on VMware servers

BleepingComputer

CISA warns of Chinese "BrickStorm" malware attacks on VMware servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned network defenders of Chinese hackers backdooring VMware vSphere servers wit...

CrowdCyber.com 3 months ago

Update Chrome now: Google fixes 13 security issues affecting billions

Malwarebytes

Update Chrome now: Google fixes 13 security issues affecting billions

Google has pushed out a Chrome update with 13 security fixes, including a high-severity flaw in Digital Credentials.

CrowdCyber.com 3 months ago

Microsoft "mitigates" Windows LNK flaw exploited as zero-day

BleepingComputer

Microsoft "mitigates" Windows LNK flaw exploited as zero-day

Microsoft has silently "mitigated" a high-severity Windows LNK vulnerability exploited by multiple state-backed and cybercrime hacking groups in ze...

CrowdCyber.com 3 months ago

Critical React, Next.js flaw lets hackers execute code on servers

BleepingComputer

Critical React, Next.js flaw lets hackers execute code on servers

A maximum severity vulnerability, dubbed 'React2Shell', in the React Server Components (RSC) 'Flight' protocol allows remote co...

CrowdCyber.com 3 months ago

Catastrophic React Flaw (CVE-2025-55182, CVSS 10.0) Allows Unauthenticated RCE on Next.js and Server Components

Daily CyberSecurity

Catastrophic React Flaw (CVE-2025-55182, CVSS 10.0) Allows Unauthenticated RCE on Next.js and Server Components

The React Team patched a Catastrophic RCE flaw (CVE-2025-55182, CVSS 10.0) in Server Components. Unauthenticated attackers can execute arbitrary co...

CrowdCyber.com 3 months ago

Marquis data breach impacts over 74 US banks, credit unions

BleepingComputer

Marquis data breach impacts over 74 US banks, credit unions

Financial software provider Marquis Software Solutions is warning that it suffered a data breach that impacted dozens of banks and credit unions ac...

CrowdCyber.com 3 months ago

Shai-Hulud 2.0: the supply chain attack that learned https://www.reddit.com/r/netsec/comments/1p8voxq/shaihulud_20_the_supply_chain_attack_that_learned/

CrowdCyber.com 3 months ago

DPRK's 'Contagious Interview' Spawns Malicious Npm Package Factory

Dark Reading

DPRK Attackers Spawn Malicious Npm Package Factory

North Korean attackers have delivered more than 197 malicious packages as part of ongoing state-sponsored activity to compromise software developers.

CrowdCyber.com 3 months ago

Intellexa’s Global Corporate Web

Intellexa’s Global Corporate Web

Uncover Intellexa’s global corporate web powering Predator spyware, front companies, and expanding targeting from civil society to executives wor...

CrowdCyber.com 3 months ago

Maximum Severity Alert: Critical RCE Flaw Hits Next.js (CVE-2025-66478, CVSS 10.0)

Daily CyberSecurity

Maximum Severity Alert: Critical RCE Flaw Hits Next.js (CVE-2025-66478, CVSS 10.0)

CrowdCyber.com 3 months ago

Synology BeeStation Flaw Chain Leads to Root RCE Via Novel “Dirty File Write” SQL Injection, PoC Available

Daily CyberSecurity

Synology BeeStation Flaw Chain Leads to Root RCE Via Novel "Dirty File Write" SQL Injection, PoC Available

A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a m...

CrowdCyber.com 3 months ago

'ShadyPanda' Hackers Weaponize Millions of Browsers

Dark Reading

'ShadyPanda' Hackers Weaponize Millions of Browsers

The China-based cyber-threat group has been using malicious extensions on the Google Chrome and Microsoft Edge marketplaces to spy on millions of u...

CrowdCyber.com 3 months ago

Critical flaw in WordPress add-on for Elementor exploited in attacks

BleepingComputer

Critical flaw in WordPress add-on for Elementor exploited in attacks

Attackers are exploiting a critical-severity privilege escalation vulnerability (CVE-2025-8489) in the King Addons for Elementor plugin for WordPre...

CrowdCyber.com 3 months ago

CISA Warns: Critical Longwatch RCE Flaw (CVE-2025-13658, CVSS 9.8) Allows Unauthenticated SYSTEM Takeover of OT Surveillance

Daily CyberSecurity

CISA Warns: Critical Longwatch RCE Flaw (CVE-2025-13658, CVSS 9.8) Allows Unauthenticated SYSTEM Takeover of OT Surveillance

CISA warned of a Critical RCE flaw (CVE-2025-13658, CVSS 9.8) in Longwatch video surveillance. Unauthenticated attackers can execute arbitrary code...