InfoSecBulletin Cybersecurity for mankind

A critical security flaw in the Next.js framework, marked as CVE-2025-29927, lets attackers bypass authorization, threatening web applications. This vulnerability stems from the mishandling of the x-middleware-subrequest header in Next.js middleware, which could allow unauthorized access to sensitive admin areas and protected resources. The vulnerability affects various versions of the …

Sharing personal secrets with an AI chatbot can be risky. In early August, many were stunned to find that thousands of ChatGPT conversations were publicly accessible through search engines like Google. While OpenAI reacted promptly and removed the dangerous sharing functionality, the incident reveals the unsettling truth that people trust …

A new Android malware called SikkahBot is targeting students in Bangladesh by pretending to be official apps from the Bangladesh Education Board. Cyble Research and Intelligence Labs (CRIL) found that this malware has been active since July 2024. According to CRIL, the SikkahBot malware is distributed through shortened URLs, including …