Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

EUVD-2025-84323

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox 145 and Firefox ESR 140.5...

kernel: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()

A race condition was found in the SMC Shared Memory Communications networking subsystem. The smcllcsrvaddlink function lacks proper locking, allowing concurrent link additions that can corrupt link group state and crash the kernel...

PT-2025-46307

Name of the Vulnerable Software and Affected Versions Axis Communications ACAP applications affected versions not specified Description ACAP applications may be able to gain elevated privileges due to improper input validation, which could lead to privilege escalation. This is only possible if th...

Frequency Diverse (FD)-RIS-Enhanced Covert Communications: Defense against Wiretapping Via Joint Distance-Angle Beamforming

In response to the security blind zone challenges faced by traditional reconfigurable intelligent surface RIS-aided covert communication CC systems, the joint distance-angle beamforming capability of frequency diverse RIS FD-RIS shows significant potential for addressing these limitations...

Secure Low-Altitude Maritime Communications Via Intelligent Jamming

Low-altitude wireless networks LAWNs have emerged as a viable solution for maritime communications. In these maritime LAWNs, unmanned aerial vehicles UAVs serve as practical low-altitude platforms for wireless communications due to their flexibility and ease of deployment. However, the open and...

SesameOp: Novel backdoor uses OpenAI Assistants API for command and control

Microsoft Incident Response – Detection and Response Team DART researchers uncovered a new backdoor that is notable for its novel use of the OpenAI Assistants Application Programming Interface API as a mechanism for command-and-control C2 communications. Instead of relying on more traditional...

Year-Long Nation-State Hack Hits US Telecom Ribbon Communications

Ribbon Communications discloses a year-long breach by nation-state actors. The attack highlights critical supply chain risk, reflecting the Salt Typhoon and F5 espionage trends...

How to keep your data safe when transferring large files

As more of our communication and work move online, keeping large file transfers secure has become a serious…...

[SECURITY] Fedora 43 Update: openssl-3.5.4-1.fc43

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols...

Supply Chain Attack

@metamask/sdk, @metamask/sdk-communication-layer, and @metamask/sdk-react are vulnerable to Supply Chain Attack. The vulnerability is due to a compromised debug package that injected malicious code, allowing attackers to intercept or tamper with dApp-to-wallet communications...

Cisco Desk/IP/Video Phone Denial of Service (cisco-sa-phone-dos-FPyjLV7A) (CVE-2025-20350)

According to its self-reported version, the remote Cisco Desk, IP, or Video Phone running SIP Software is affected by a denial of service vulnerability: - A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco S...

Vulnerabilities fixed in Oracle Analytics

Oracle has fixed several vulnerabilities in Oracle Analytics products. The vulnerabilities can compromise confidentiality, integrity and availability, with a maximum impact score of "HIGH. Attackers can exploit these vulnerabilities to gain unauthorized access or conduct denial-of-service DoS...

Vulnerabilities fixed in Oracle Communications products

Oracle has fixed several vulnerabilities in its Communications products, including Unified Assurance and Cloud Native Core. The vulnerabilities in Oracle Communications products allow malicious actors to gain unauthorized access, which can lead to partial or full Denial-of-Service DoS attacks...

Oracle Critical Patch Update, October 2025 Security Update Review

Oracle released its third quarterly edition of this year’s Critical Patch Update. The update received patches for 374 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families,...

ABB Terra AC

SUMMARY ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a write operation to the flash...

CVE-2025-11492

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some...

A Surprising Amount of Satellite Traffic Is Unencrypted

Here's the summary: We pointed a commercial-off-the-shelf satellite dish at the sky and carried out the most comprehensive public study to date of geostationary satellite communication. A shockingly large amount of sensitive traffic is being broadcast unencrypted, including critical infrastructur...

Rockwell Automation 1715-AENTR EtherNet/IP Adapter Denial of Service Vulnerability

The Rockwell Automation 1715-AENTR EtherNet/IP Adapter is a redundant Ethernet adapter module from Rockwell Automation. A denial of service vulnerability exists in the Rockwell Automation 1715-AENTR EtherNet/IP Adapter, which stems from improper handling of specially crafted payloads by CIP...

EUVD-2025-34827

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used to obfuscate some...