Introduction: A Familiar Tool Becomes a Silent Weapon WinRAR, one of the most widely used file archiving tools in the world, has unexpectedly become the center of a high-impact cyber espionage and cybercrime campaign. Google has confirmed that multiple advanced threat actors — ranging from state-sponsored groups to profit-driven cybercriminals — are actively exploiting a critical vulnerability in WinRAR to gain initial access to targeted systems.

Introduction: In the relentless hunt for web application vulnerabilities, a recent bug bounty disclosure highlights a critical yet often overlooked flaw: misplaced trust in client-side access controls. A security researcher successfully identified a system where a parameter, aptly named needValidSession, was used to gatekeep sensitive functionality, but this check was performed only in the client-side JavaScript. This article deconstructs this vulnerability, demonstrating how attackers can bypass such controls and emphasizing the non-negotiable principle of server-side enforcement.

Hackers are on the hunt for open telnet ports in servers after discovering that a version of the legacy client-server application protocol is vulnerable to an

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing arbitrary code on the underlying host system.

Benefits calculators can leave some people confused and in a dire financial state, say campaigners.

Multiple threat actors, both state-sponsored and financially motivated, are exploiting the CVE-2025-8088 high-severity vulnerability in WinRAR for initial access and to deliver various malicious paylo...

Whether at home or abroad, the pattern of ducking difficult arguments and calling it pragmatism is the same, says Guardian columnist Rafael Behr

YouTube video by Forbes