News

Fri 12 Dec 2025· 50 articles

1. 03:38

   React Patches Two New Flaws Risking Server-Crashing DoS and Source Code Disclosure

   The article reports that two new vulnerabilities in React Server Components have been patched, one potentially causing a server-crashing Denial of Service and the other exposing source code. The High Severity issue, rated CVSS 7.5, is tracked as…

   SecurityOnline
   
2. 03:28

   Core Banking System Flaw: Apache Fineract IDOR Risks Authorization Bypass & Customer Data Access

   A trio of vulnerabilities has been disclosed in Apache Fineract, the open-source core banking system, ranging from an IDOR authorization bypass to weak credential protections. The most concerning flaw is CVE-2025-58137, an Insecure Direct Object Reference in…

   SecurityOnline
   
3. 03:10

   New 01flip Ransomware Hits APAC Critical Infra: Cross-Platform Rust Weapon Uses Sliver C2

   New 01flip ransomware has entered the cybercrime arena, targeting critical infrastructure in the Asia-Pacific region with a cross-platform Rust weapon that can strike Windows and Linux systems. According to Unit 42 researchers at Palo Alto Networks, the…

   SecurityOnline
   
4. 03:00

   CISA KEV Alert: GeoServer XXE Flaw Under Active Attack Risks Data Theft & Internal Network Scanning

   According to the advisory, CISA has added a critical vulnerability affecting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) Catalog, tracked as CVE-2025-58360. The flaw is an XML External Entity (XXE) vulnerability in GeoServer’s handling of…

   SecurityOnline
   
5. 02:57

   Military-Grade ValleyRAT Goes Rogue: Kernel Rootkit Builder Leak Triggers Massive Global Surge

   ValleyRAT, a sophisticated modular backdoor also known as Winos, has gone rogue after its builder was leaked online, prompting a massive surge in the threat landscape. According to CPR, the public release of the builder ended the exclusivity of ValleyRAT and…

   SecurityOnline
   
6. 02:44

   Trump Signs Executive Order to Block State AI Regulations

   According to Associated Press, President Donald Trump signed an executive order on 11 December 2025 aimed at blocking states from crafting their own regulations for artificial intelligence, arguing that a patchwork of rules could stifle the industry while…

   SecurityWeek
7. 02:32

   Sophisticated Okta SSO Phishing Bypasses Defenses to Steal Session Tokens With Salary Review Lures

   According to Datadog Security Labs, a sophisticated phishing operation active since early December 2025 targets organisations relying on Microsoft 365 and Okta for Single Sign-On, using envelope-pushing techniques to bypass security controls and steal…

   SecurityOnline
   
8. 02:22

   CVE-2025-64188 (CVSS 9.8): Critical “Soledad” Theme Flaw Lets Subscribers Take Over WordPress Sites

   CVE-2025-64188 (CVSS 9.8) is a critical vulnerability in the Soledad WordPress theme that could let a low‑level user take full control of a site. The flaw, detailed in a Patchstack advisory, affects all versions of the theme 8.6.9 and below, with the root…

   SecurityOnline
   
9. 02:15

   DiCaprio Movie Torrent Lures Users: Agent Tesla Deployed via Malicious LNK and Subtitle File Code Hiding

   Cybersecurity researchers have uncovered a sophisticated malware campaign targeting movie pirates with a fake torrent for a Leonardo DiCaprio film, One Battle After Another. The infection vector is a torrent file; the downloaded folder contains a shortcut…

   SecurityOnline
   
10. 01:52

    GOLD BLADE APT Hits Canadian Firms with BYOVD EDR Killer and Ransomware Delivered Via Fake Resumes

    GOLD BLADE, a threat actor also known as RedCurl or RedWolf, has pivoted its focus to Canada, according to a Sophos report that describes a campaign blending corporate espionage with ransomware. Between February 2024 and August 2025, analysts tracked nearly…

    SecurityOnlineEarth Kapre