FortiSIEM’s critical wobble: patch first, tea later Fortinet has disclosed a critical pre-auth command-injection flaw in FortiSIEM—CVE-2025-25256 (CVSS 9.8)—and says exploit code exists in the wild. The bug sits in the phMonitor process (port 7900), where inadequate input sanitisation can let an unauthenticated attacker run OS commands. Fortinet lists affected branches and fixed versions, notes […]
WinRAR Zero-Day: Why Opening That “CV” Could Autostart Malware The Hacker News reports that WinRAR for Windows has patched an actively exploited zero-day (CVE-2025-8088, CVSS 8.8). The bug is a path-traversal flaw: booby-trapped RAR archives can force files to extract outside the chosen folder—into sensitive spots like Startup—to run code on next log-in. ESET linked […]
Citrix NetScaler under fire: Dutch NCSC confirms live exploits of CVE-2025-6543 The Dutch National Cyber Security Centre (NCSC-NL) says a critical Citrix NetScaler flaw, CVE-2025-6543 (CVSS 9.2), is being actively exploited against organisations in the Netherlands, including critical sectors. The bug affects NetScaler ADC/Gateway when configured as a Gateway or AAA virtual server. Evidence shows […]
Microsoft’s August Patch Tuesday: Kerberos Drama and 110 Close Friends Microsoft’s August 2025 Patch Tuesday fixes 111 vulnerabilities across Windows and wider Microsoft products. One flaw, CVE-2025-53779 in Windows Kerberos, was publicly disclosed and could help an attacker with certain delegated-account permissions pivot to full Active Directory compromise. In total there are 16 Critical, 92 […]
ReVault: When Your “Security Chip” Needs a Security Chip of Its Own Security researchers (Cisco Talos) disclosed “ReVault”—a set of five flaws in Dell ControlVault3 (a Broadcom-based security chip and its Windows APIs) used in 100+ laptop models. Chained together, the bugs could let attackers bypass Windows login, extract keys and persist in firmware even […]
The Wild West of Shadow IT: Why Your Staff Are Installing Trouble at the Click of a Button The CyberWhite article The Wild West of Shadow IT warns that employees now adopt SaaS and AI tools faster than security teams can vet them, creating a sprawl of unapproved apps, OAuth tokens and embedded AI that […]
How to Stop a Sneaky Man-in-the-Middle The CyberWhite guide explains how man-in-the-middle (MITM) attacks let crooks slip between users and online services to pinch log-ins, card details and other goodies. It recaps headline-grabbing examples (Equifax, Lenovo Superfish, DigiNotar) and outlines favourite tactics: rogue public-Wi-Fi, mDNS/DNS spoofing, ARP games and look-alike access points. Defence boils down […]
Dahua Cameras Get the Starring Role in Their Own Horror Film Security researchers at Bitdefender uncovered two critical buffer-overflow bugs (CVE-2025-31700, CVE-2025-31701, CVSS 8.1) in Dahua smart-camera firmware built before 16 April 2025. One flaw sits in the ONVIF request handler, the other in the RPC file-upload routine. An unauthenticated attacker can sling a specially […]
SonicWall’s VPNs May Have a Nasty Zero-Day – Akira Ransomware Gate-crashes the Party SonicWall is probing a potential zero-day flaw in its Gen 7 SSL VPN firewalls after security firms Arctic Wolf and Huntress logged more than 20 Akira-ransomware break-ins since late July 2025. Victims were fully patched and even with MFA attackers still slipped […]
