InfoSecBulletin Cybersecurity for mankind

OWASP has released an updated Top 10 list of key web application risks, adding two new categories and rearranging the order. This 2025 release candidate, which is a near-final draft of the flagship OWASP Top 10 list, is open for comment until November 20. Broken Access Control remains the top …

QNAP has urgently advised users and released patches for seven zero-day vulnerabilities exploited during the Pwn2Own Ireland 2025 competition, affecting their NAS devices. These patches address critical flaws in the core operating systems and key applications, such as backup and malware removal tools. Top security research teams, including Summoning Team, …

A new Android banking Trojan called Herodotus has emerged recently. It is offered as Malware-as-a-Service (MaaS) and pretends to be a legitimate app to trick users into installing an APK. After installation, it requests sensitive permissions and can control the device for banking transactions. A modern mobile attack, yet once …