Researchers are warning about the risks posed by a low-cost device that can give insiders and hackers unusually broad powers in compromising networks. The devices, which typically sell for $30 to $100, are known as IP KVMs. Administrators often use them to remotely access machines on networks. The devices, not much bigger than a deck… Read More: Researchers disclose vulnerabilities in IP KVMs from four manufacturers »
Coruna is also notable for its use by three distinct hacking groups. Google first detected its use in February of last year in an operation conducted by a “customer of a surveillance vendor.” The vulnerability exploited, tracked as CVE-2025-23222, had been patched 13 months earlier. In July 2025, a “suspected Russian espionage group” exploited CVE-2023-43000… Read More: Feds take notice of iOS vulnerabilities exploited under mysterious circumstances »
“I usually don’t say this, but patch right freakin’ now,” one researcher wrote. “The React CVE listing (CVE-2025-55182) is a perfect 10.” React versions 19.0.1, 19.1.2, or 19.2.1 contain the vulnerable code. Third-party components known to be affected include: Vite RSC plugin Parcel RSC plugin React Router RSC preview RedwoodSDK Waku Next.js According to Wiz… Read More: Admins and defenders gird themselves against maximum-severity server vuln »
The goals are sound, but ultimately they depend on users reading the dialog windows that warn of the risks and require careful approval before proceeding. That, in turn, diminishes the value of the protection for many users. “The usual caveat applies to such mechanisms that rely on users clicking through a permission prompt,” Earlence Fernandes,… Read More: Critics scoff after Microsoft warns AI feature can infect machines… »
SecurityBridge warned that CVE-2025-42957 allowed hackers with minimal system rights to mount “a complete system compromise with minimal effort required, where successful exploitation can easily lead to fraud, data theft, espionage, or the installation of ransomware.” The security firm went on to write: The attacker needs only low-level credentials on the SAP system (any valid… Read More: SAP warns of high-severity vulnerabilities in multiple products »
The maker of Passwordstate, an enterprise-grade password manager for storing companies’ most privileged credentials, is urging them to promptly install an update fixing a high-severity vulnerability that hackers can exploit to gain administrative access to their vaults. The authentication bypass allows hackers to create a URL that accesses an emergency access page for Passwordstate. From… Read More: High-severity vulnerability in Passwordstate credential manager. Patch now. »
Microsoft fixed the vulnerability pair—CVE-2025-49706 and CVE-2025-49704—two weeks ago as part of the company’s monthly update release. As the world learned over the weekend, the patches were incomplete, a lapse that opened organizations around the world to the new attacks. Q: What sorts of malicious things are attackers doing with these newer ToolShell exploits? A:… Read More: What to know about ToolShell, the SharePoint threat under mass… »
Researchers from the Google Threat Intelligence Group said that hackers are compromising SonicWall Secure Mobile Access (SMA) appliances, which sit at the edge of enterprise networks and manage and secure access by mobile devices. The targeted devices are end of life, meaning they no longer receive regular updates for stability and security. Despite the status,… Read More: Google finds custom backdoor being installed on SonicWall network devices »
A critical vulnerability allowing hackers to bypass multifactor authentication in network management devices made by Citrix has been actively exploited for more than a month, researchers said. The finding is at odds with advisories from the vendor saying there is no evidence of in-the-wild exploitation. Tracked as CVE-2025-5777, the vulnerability shares similarities with CVE-2023-4966, a… Read More: Critical CitrixBleed 2 vulnerability has been under active exploit for… »
Researchers have unearthed two publicly available exploits that completely evade protections offered by Secure Boot, the industry-wide mechanism for ensuring devices load only secure operating system images during the boot-up process. Microsoft is taking action to block one exploit and allowing the other one to remain a viable threat. As part of Tuesday’s monthly security… Read More: Found in the wild: 2 Secure Boot exploits. Microsoft is… »