Talos Takes: 2025's ransomware trends and zombie vulnerabilities

Join Amy and Pierre Cadieux as they unpack the ransomware and vulnerability trends that defined 2025. From the persistent ransomware threats targeting the manufacturing sector to the rise of stealthy living-off-the-land tactics, we break down what these shifts mean for your defense strategy. Why...

Year in Review: Vulnerabilities old and new and something React2

Speed and age shouldn't be allowed to pair up, but that is the theme of the Talos 2025 Year in Review vulnerability findings. Figure 1. React/React2Shell 2025 at the top, with PHPUnit 2017 and Log4j 2021 following up. The year was characterized by an unending beat-down on infrastructure that reli...

PT-2026-33474

The zantetsu-trainer crate is no longer maintained. The ML training infrastructure it contained was removed as part of the zantetsu 0.2 release, which replaced the neural parser with a pure heuristic engine. A tombstone version 0.2.0 has been published and 0.1.4 has been yanked. There is no...

Comprehensive List of User Deception Techniques in Emails

Email remains a central communication medium, yet its long-standing design and interface conventions continue to enable deceptive attacks. This research note presents a structured list of 42 email-based deception techniques, documented with 64 concrete example implementations, organized around th...

Evaluating Future Air Traffic Management Security

The L-Band Digital Aviation Communication System LDACS aims to modernize communications between the aircraft and the tower. Besides digitizing this type of communication, the contributors also focus on protecting them against cyberattacks. There are several proposals regarding LDACS security, and...

The vulnerability of the msm_dsi_host_init() function in the drivers/gpu/drm/msm/dsi/dsi_host.c file of the Direct Rendering Infrastructure (DRI) driver for the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the msmdsihostinit function in the drivers/gpu/drm/msm/dsi/dsihost.c file of the Direct Rendering Infrastructure DRI driver in the Linux kernel is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a system failure...

[SECURITY] Fedora 43 Update: rust-rustls-webpki-0.103.10-1.fc43

Web PKI X.509 Certificate Verification...

Defending Encryption in the Post Quantum Era

Post-quantum cryptography explained, risks of quantum attacks, and steps to secure data, systems, and infrastructure for a quantum-resilient…...

PT-2026-29830

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.95 Description PraisonAI's FileTools.download file function does not validate the url parameter before passing it to httpx.stream with follow redirects=True. This allows an attacker controlling the URL to access...

The vulnerability of the zynqmp_audio_init() function in the drivers/gpu/drm/xlnx/zynqmp_dp_audio.c driver module allows a hacker to cause a service failure in the Linux operating system’s Direct Rendering Infrastructure (DRI).

The vulnerability of the zynqmpaudioinit function in the drivers/gpu/drm/xlnx/zynqmpdpaudio.c driver lies in the lack of checking for the return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the amdgpu_vram_mgr_new() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c driver module allows a hacker to cause a service failure in AMD GPU-based Linux operating system DRI (Direct Rendering Infrastructure) kernels.

The vulnerability of the amdgpuvrammgrnew function in the drivers/gpu/drm/amd/amdgpu/amdgpuvrammgr.c driver module related to AMD GPU cores in Linux operating systems is associated with synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to caus...

TrendAI Insight: New U.S. National Cyber Strategy

TrendAI reviews the White House National Cyber Strategy, outlining six pillars to strengthen U.S. cybersecurity—from deterrence and regulation to federal modernization, critical infrastructure protection, AI leadership, and workforce development...

The vulnerability of the msm_dp_modeset_init() function in the driver/gpu/drm/msm/dp/dp_display.c file of the Direct Rendering Infrastructure (DRI) driver in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the msmdpmodesetinit function in the driver/gpu/drm/msm/dp/dpdisplay.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to memory writing beyond the allowed buffer data size limits. Exploiting this vulnerability could allow an...

The threat to critical infrastructure has changed. Has your readiness?

Critical infrastructure CI organizations underpin national security, public safety, and the economy. In 2026, the cyber threat landscape facing these sectors is structurally different than it was even two years ago. What Microsoft Threat Intelligence is observing across critical infrastructure...

The threat to critical infrastructure has changed. Has your readiness?

Critical infrastructure CI organizations underpin national security, public safety, and the economy. In 2026, the cyber threat landscape facing these sectors is structurally different than it was even two years ago. What Microsoft Threat Intelligence is observing across critical infrastructure...

certstrike

CertStrike ADCS exploitation and PKI attack framework with in...

TrendAI™ Research at RSAC 2026: Advancing Defense Across AI‑Driven and Cyber‑Physical Threats

TrendAI™ Research explored agentic AI cybercrime and EV infrastructure security through two research sessions at RSAC 2026...

Virtuozzo Infrastructure 7.3 (7.3.0-171) (formerly Virtuozzo Hybrid Infrastructure)

This release focuses on technical improvements, user experience enhancements, storage performance, and S3 protocol capabilities. It also introduces the product rename from Virtuozzo Hybrid Infrastructure to Virtuozzo Infrastructure. Additionally, this release delivers stability fixes and addresse...

CVE-2026-34227: Missing Authentication for Critical Function

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data e.g. SS...

The vulnerability of the msm_drm_init() function in the driver/gpu/drm/msm/msm_drv.c file, a part of the Direct Rendering Infrastructure (DRI) driver infrastructure for the Linux operating system, allows a malicious actor to cause a service failure.

The vulnerability of the msmdrminit function in the driver/gpu/drm/msm/msmdrv.c file, a part of the Direct Rendering Infrastructure DRI driver for the Linux operating system’s kernel, relates to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause service...