News

Thu 4 Dec 2025· 54 articles

1. 02:42

   Maximum Severity Alert: Critical RCE Flaw Hits Next.js (CVE-2025-66478, CVSS 10.0)

   Developers using Next[.]js and React are facing a maximum-severity RCE flaw in the React Server Components protocol, tracked as CVE-2025-66478 with a CVSS of 10.0, reported today in a vulnerability notice. According to the official advisory, a critical…

   SecurityOnline
   
2. 02:23

   Critical WordPress Flaw (CVE-2025-6389) Under Active Exploitation Allows Unauthenticated RCE

   A critical Remote Code Execution vulnerability in the Sneeit Framework, a core plugin bundled with multiple premium WordPress themes, is being actively exploited and allows unauthenticated code execution via the sneeit_articles_pagination_callback()…

   SecurityOnline
   
3. 02:14

   Catastrophic React Flaw (CVE-2025-55182, CVSS 10.0) Allows Unauthenticated RCE on Next.js and Server Components

   According to Daily CyberSecurity, CVE-2025-55182 is a catastrophic vulnerability rated CVSS 10.0 that allows unauthenticated remote code execution on servers running React Server Components. The flaw lies in how deserialization occurs as React translates…

   SecurityOnline
   
4. 00:33

   ShadyPanda Spyware Hacked 4.3 Million Users by Weaponizing Trusted Browser Extensions via Auto-Updates

   SecurityOnline
   
5. 00:28

   Matanbuchus 3.0 Downloader Pivots to Ransomware, Using Protobufs and QuickAssist for Stealth Access

   A malware campaign has resurfaced with a major overhaul, as Matanbuchus 3.0, a sophisticated C++ downloader, is described as moving beyond a simple downloader to serve as a gateway for ransomware operators. According to Zscaler ThreatLabz, version 3.0 was…

   SecurityOnlineBelialDemon
   
6. 00:22

   Synology BeeStation Flaw Chain Leads to Root RCE Via Novel “Dirty File Write” SQL Injection, PoC Available

   Synology BeeStation devices are shown in a vulnerability chain that can lead from unauthenticated access to root RCE, demonstrated by security researcher Kiddo with a PoC published after a Pwn2Own 2024 presentation. The exploit chain relies on three CVEs:…

   SecurityOnline
   
7. 00:19

   Water Saci Campaign Uses LLMs to Convert Malware to Python, Spreads Banking Trojan Via WhatsApp Worm

   A campaign known as “Water Saci” has pivoted its tactics, leveraging artificial intelligence and WhatsApp to target Brazilian users with a banking Trojan. A new report from Trend Micro reveals that the threat actors have likely used Large Language Models…

   SecurityOnlineWater Saci
   
8. 00:15

   High-Severity Vim for Windows Flaw (CVE-2025-66476) Risks Arbitrary Code Execution from Compromised Folders

   Vim for Windows has a high-severity flaw, CVE-2025-66476, that could allow arbitrary code execution simply by opening a file in a compromised directory. The vulnerability has a CVSS score of 7.8 and stems from the way Vim prioritises the local folder over…

   SecurityOnline
   
9. 00:12

   AWS Nova Forge: Open-Training Platform Enables Deep Customization of Nova 2 Models

   AWS Nova Forge is presented as an open-training platform that enables deep customization of Nova 2 models, expanding AWS’s Nova family with Nova 2 Lite, Nova 2 Pro, Nova 2 Sonic, Nova 2 Omni and Nova Act, as well as the Nova Forge framework for bespoke…

   SecurityOnline
   
10. 00:10

    Android 16 Update: AI Notification Summaries & Gemini-Powered Accessibility Suite

    Google has issued the second major update to Android 16 since its stable build in June, adding a suite of AI-driven features for Pixel devices and boosting accessibility on the eve of the International Day of Persons with Disabilities. The update introduces…

    SecurityOnline
    
11. 00:08

    Raspberry Pi Price Hike: AI Boom Forces Price Increases on Pi 4 and Pi 5 Models

    Raspberry Pi has announced immediate price increases for select Raspberry Pi 4 and Raspberry Pi 5 models, driven by a global surge in AI infrastructure and a squeeze on memory supply, with adjustments ranging from $5 to $25. In an official blog post, Eben…

    SecurityOnline
    
12. 00:06

    AWS S3 Unleashed: Native Vector Storage & 50 TB Max Object Size for AI/Big Data

    According to re:Invent 2025, AWS announced a broad set of enhancements to Amazon S3, including the general availability of Amazon S3 Vectors with native vector storage and querying and a 50 TB maximum object size. The production S3 Vectors release enables a…

    SecurityOnline
    
13. 00:03

    AWS Frontier Agents: Autonomous AI ‘Team Members’ Take Over Dev, Security, and Ops

    At re:Invent 2025, AWS unveiled Frontier Agents, a new class of autonomous AI team members designed to operate independently across development, security and operations. Built atop Kiro, the agents are described as scalable and capable of carrying out…

    SecurityOnline
    
14. 00:00

    AWS Unveils Nova 2 AI Model Family with Multimodal Omni & Agentic Nova Act

    AWS announced the debut of its Nova 2 AI model family at re:Invent 2025, unveiling four variants—Lite, Pro, Sonic and Omni—alongside Nova Forge, an open-training service, and Nova Act, a platform for creating autonomous web‑browsing AI agents. This update…

    SecurityOnline