Over 1,200 firewall instances are vulnerable to a critical remote code execution issue, known as CVE-2024-52875. The vulnerability is found in several unauthenticated web interface paths, including /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, and /nonauth/expiration.cs. These pages do not adequately sanitize user input from the dest GET parameter, allowing attackers to inject line feed …

Apple has issued emergency security updates to fix a zero-day vulnerability, CVE-2025-24200, which is being exploited in targeted attacks on iPhone and iPad users. The vulnerability lets attackers turn off USB Restricted Mode on a locked device, risking unauthorized access to sensitive data. Apple is aware that this issue may …

Zimbra has released updates for its Collaboration software to fix critical security flaws that could lead to information disclosure if exploited. CVE-2025-25064 is a critical vulnerability with a CVSS score of 9.8. It is an SQL injection issue in the ZimbraSync Service SOAP endpoint, affecting versions before 10.0.12 and 10.1.4. …

A serious security vulnerability, CVE-2025-23369, has been found in GitHub Enterprise Server (GHES) that lets attackers bypass SAML authentication and impersonate user accounts. This vulnerability takes advantage of specific anomalies in the libxml2 library employed in SAML response validation, allowing unauthorized access to accounts, even those with administrative rights. The …

India’s central bank to launch a special “.bank.in” domain for banks in April 2025 to fight digital payment fraud and enhance trust in online banking. The Reserve Bank of India announced that the Institute for Development and Research in Banking Technology (IDRBT) will exclusively manage the new “fin.in” domain for …

The Shadowserver Foundation reports that a brute force attack has been active since last month, using nearly 2.8 million IP addresses each day attempting to guess the credentials for a wide range of networking devices. A brute force attack occurs when attackers repeatedly try different usernames and passwords to access …

Romance scams involve scammers creating fake profiles on online platforms to deceive people seeking love. They use attractive photos and pretend to have trustworthy jobs, like aid workers or military personnel, to attract victims. Scammers create elaborate lies to gain victims’ trust after meeting on social media, dating sites, or …

Britain’s security officials have ordered that Apple create a so-called ‘back door’ allowing them to retrieve all the content any Apple user worldwide has uploaded to the cloud, The Washington Post reported on Friday citing people familiar with the matter. Rather than break the security promises it made to its …

A critical vulnerability (CVE-2025-0411) in the file archiving tool 7-Zip is being actively exploited, mainly targeting Ukrainian organizations. It has been included in CISA’s database of known exploited vulnerabilities. This flaw lets attackers bypass Windows’ Mark-of-the-Web (MoTW) security, allowing them to run malicious code. CISA has added CVE-2025-0411, a critical …

A threat actor has reportedly acquired login details, including passwords and email addresses, for 20 million OpenAI accounts. GBHackers report states that an underground forum user claimed to sell a sample of data and the full batch for a low price. The authenticity of these claims is unverified, but the situation …