Alert

BGD e-GOV CIRT alert for a potential risk of cyber attack on Thursday (24.07.2025). In its situational alert, CIRT said, based on current threat intelligence, there is a potential risk of a large-scale cyberattack targeting Bangladesh’s ICT infrastructure in the coming days. CIRT mentioned that the cyber attack focuses on …

AWS has issued a security patch for a severe local privilege escalation vulnerability (CVE-2025-8069) in its Windows Client VPN software. Rated at CVSS 7.8, this flaw allows non-admin users to run code with higher privileges during installation, posing risks for shared or enterprise devices. The issue lies in the way …

Dahua Technology released a security advisory about two serious vulnerabilities in its IP cameras, after a report from the Bitdefender IoT Research Team. The vulnerabilities, CVE-2025-31700 and CVE-2025-31701, each have a CVSS score of 8.1 and are due to buffer overflow issues that can let remote attackers crash devices or …

Sophos has released a security advisory addressing five vulnerabilities in Sophos Firewall, two of which are critical and could enable remote attackers to take control of affected devices in specific situations. The company confirms that fixes have been automatically deployed through hotfixes, assuming the auto-installation setting is default.   Remediation …

Microsoft issued urgent updates for two serious SharePoint security holes, identified as CVE-2025-53770 and CVE-2025-53771, used in attacks known as “ToolShell.” Both vulnerabilities exclusively affect on-premises SharePoint Servers, allowing threat actors to exploit them for unauthenticated, remote code execution. Microsoft has announced that the SharePoint vulnerability CVE-2025-53770, with a CVSS …

Hewlett-Packard Enterprise (HPE) warns that Aruba Instant On Access Points have hardcoded credentials, enabling attackers to skip normal authentication and reach the web interface. Aruba Instant On Access Points are small, easy-to-use Wi-Fi devices for small to medium businesses. They provide advanced features like guest networks and traffic segmentation, and …

Defence Minister Chan Chun Sing said these select units will work with the Cyber Security Agency (CSA) in a united government response to the threat, local media reported. Chan described the cyberattack as “one example of the emerging threats” that the military has to handle, the reports said. There have been …

Oracle’s July 2025 Critical Patch Update includes 309 new security patches, with 127 addressing remotely exploitable vulnerabilities. SecurityWeek found about 200 unique CVEs in Oracle’s July 2025 CPU, with nine patches for critical flaws. In October, Oracle Communications issued 84 security patches, the highest this month, similar to April. Out …

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a crucial vulnerability in Fortinet FortiWeb in its Known Exploited Vulnerabilities (KEV) catalog, verifying that the SQL injection flaw is being actively exploited in cyberattacks across the globe. The vulnerability, tracked as CVE-2025-25257, affects Fortinet’s FortiWeb web application firewall and carries …

The OpenJS Foundation has updated Node.js 24.x, 22.x, and 20.x to fix two serious vulnerabilities—CVE-2025-27210 and CVE-2025-27209—that could endanger Windows applications and web services using JavaScript’s V8 engine. These issues, involving path traversal bypass and hash collision denial-of-service (HashDoS), impact millions of backend and full-stack applications globally. CVE-2025-27210: Path Traversal …