Tracked as CVE-2025-57819 (CVSS score of 10/10), the bug is described as an insufficient sanitization of user-supplied data.
The post Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers appeared first on SecurityWeek.
WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users
The vulnerability (CVE-2025-55177) was exploited along an iOS/macOS zero-day in suspected spyware attacks.
The post WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users appeared first on SecurityWeek.
Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack
With more than 4 million weekly downloads, the Nx build platform became the first known supply chain breach where hackers weaponized AI assistants for data theft.
The post Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack appeared first on SecurityWeek.
Citrix Patches Exploited NetScaler Zero-Day
Zero-day exploited in the wild forces Citrix and CISA to push emergency patch deadlines for federal agencies.
The post Citrix Patches Exploited NetScaler Zero-Day appeared first on SecurityWeek.
Organizations Warned of Exploited Git Vulnerability
CISA urges federal agencies to immediately patch an exploited arbitrary file write vulnerability in Git that leads to remote code execution.
The post Organizations Warned of Exploited Git Vulnerability appeared first on SecurityWeek.
MITRE Updates List of Most Common Hardware Weaknesses
MITRE has updated the list of Most Important Hardware Weaknesses to align it with evolving hardware security challenges.
The post MITRE Updates List of Most Common Hardware Weaknesses appeared first on SecurityWeek.
Password Managers Vulnerable to Data Theft via Clickjacking
A researcher has tested nearly a dozen password managers and found that they were all vulnerable to clickjacking attacks.
The post Password Managers Vulnerable to Data Theft via Clickjacking appeared first on SecurityWeek.
Apple Patches Zero-Day Exploited in Targeted Attacks
Apple has rolled out iOS and macOS updates that resolve a zero-day vulnerability exploited in highly targeted attacks.
The post Apple Patches Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek.
Elastic Refutes Claims of Zero-Day in EDR Product
Elastic has found no evidence of a vulnerability leading to RCE after details and PoC of a Defend EDR bypass were published online.
The post Elastic Refutes Claims of Zero-Day in EDR Product appeared first on SecurityWeek.
Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data
CERT/CC has disclosed the details of information exposure vulnerabilities in a Workhorse Software application after patches were released.
The post Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data appeared first on SecurityWeek.
