December 2025 — Adobe has released emergency security updates for its Acrobat and Reader products. According to Security Bulletin APSB25-119, several vulnerabilities have been identified—some of which may allow attackers to execute arbitrary code remotely or without user interaction, while…

On December 9, 2025, Microsoft officially announced a significant vulnerability — CVE-2025-62468 — identified in the Windows Defender Firewall Service. This flaw allows a user with elevated privileges to read certain portions of system memory (heap memory) without authorization. The…

On December 9, 2025, Fortinet issued an emergency warning regarding a serious security vulnerability discovered in several of its products, including FortiOS, FortiWeb, FortiProxy, FortiSwitchManager, and others. According to official information, the flaw allows attackers to bypass FortiCloud Single Sign-On…

On December 9, 2025, Microsoft released emergency security updates addressing a critical 0-day vulnerability — CVE-2025-62221 — discovered in Windows systems. The flaw was found in the Cloud Files Mini Filter Driver (cldflt.sys), a kernel-level driver, and allows attackers to…

PortSwigger has updated the ActiveScan++ extension for Burp Suite, and it can now automatically detect two critical vulnerabilities found in React applications, known as React2Shell — CVE-2025-55182 and CVE-2025-66478. These vulnerabilities allow attackers to send unauthorized requests to the server…

A new and extremely dangerous vulnerability has been identified in the Apache Tika platform. Registered as CVE-2025-66516, this flaw has received the maximum CVSS score of 10.0. The vulnerability allows an attacker to infiltrate the system through a specially crafted…

Even the official Google Play Store can sometimes fall victim to cybercriminals’ tactics. Experts from Zscaler ThreatLabz recently discovered that an app called “Document Reader – File Manager”, which had been downloaded more than 50,000 times, was actually distributing the…

Millions of websites and web applications around the world rely on React and Next.js. Therefore, the discovery of a new vulnerability — CVE-2025-55182 — has caused serious concern among developers. The flaw enables remote code execution (RCE) on the server…

A new cyber threat that has drawn significant attention from the international cybersecurity community — a sophisticated malware known as BRICKSTORM — has been highlighted in a joint advisory issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the…

The WordPress ecosystem is facing another serious security threat. In recent days, cybercriminals have begun actively exploiting a critical Remote Code Execution (RCE) vulnerability in the Sneeit Framework plugin. The flaw, identified as CVE-2025-6389 with a CVSS score of 9.8,…