Google has released a new stable Chrome update that addresses a serious flaw in its V8 JavaScript engine. The update, now available as version 142.0.7444.162/.163 for Windows, 142.0.7444.162 for Mac, and 142.0.7444.162 for Linux, will roll out to users over the coming days and weeks. CVE ID Severity Affected Component Description CVE-2025-13042 High V8 JavaScript […]
Google on Tuesday unveiled a new privacy-enhancing technology called Private AI Compute to process artificial intelligence (AI) queries in a secure platform in the cloud.
The company said it has built Private AI Compute to “unlock the full speed and power of Gemini cloud models for AI experiences, while ensuring your personal data stays private to you and is not accessible to anyone else, not
A newly identified Android remote access trojan (RAT) dubbed KomeX has surfaced on underground hacker forums, generating widespread concern within the cybersecurity community.
Marketed by a threat actor under the alias “Gendirector,” KomeX is built atop the infamous BTMOB RAT codebase and presents a formidable arsenal of spying and device control features.
Recognized for its sophistication, KomeX is designed to compromise Android devices en masse, making it an enticing tool for cybercriminals seeking to monetize mobile infections.
The malware’s distribution tactics rely heavily on malicious Android apps pushed via unofficial marketplace sources and phishing campaigns.
Victims are typically enticed to install tampered applications or unwittingly click on convincing social engineering lures.
What sets KomeX apart is its aggressive approach to obtaining device permissions almost immediately after installation, drastically expanding its reach and resilience once embedded in a target system.
KrakenLabs security analysts were instrumental in identifying and dissecting KomeX after its forum debut.
Their analysis revealed the trojan’s ability to bypass Google Play Protect, stripping Android devices of a fundamental protective barrier against malware.
Among its notable capabilities are high-fidelity live screen streaming, stealth audio and video capture via camera and microphone, instant access to SMS interception and manipulation, live geolocation tracking, remote control of all major apps, and full filesystem access layered with a covert keylogger.
Upon installation, KomeX abuses accessibility features to silently grant these permissions, enabling deep integration and persistent access.
To resist removal, KomeX employs a fake uninstall module — simulating app deletion but secretly continuing operations in the background.
Its infection lifecycle includes initial delivery, privilege escalation, secret data exfiltration, and durable anti-removal tactics, showcasing a complete, professional malware engineering approach.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A large-scale phishing campaign has emerged, exploiting Meta’s Business Suite to compromise credentials across thousands of small and medium-sized businesses worldwide.
Check Point security researchers identified approximately 40,000 phishing emails distributed to more than 5,000 customers, primarily targeting industries including automotive, education, real estate, hospitality, and finance across the U.S., Europe, Canada, and Australia.
The sophisticated attack leverages legitimate Meta infrastructure, making detection substantially more difficult than traditional phishing attempts.
The campaign demonstrates a troubling evolution in threat tactics. Rather than relying on spoofed domains and fake infrastructure, attackers have weaponized Meta’s native Business invitation feature to establish credibility.
This approach exploits user trust in established platforms and circumvents conventional email security filters that typically flag suspicious sender addresses.
Example of a real phishing email we caught (Source – Check Point)
By originating from the legitimate facebookmail.com domain, these messages appear authentic and indistinguishable from genuine Meta notifications.
Check Point security analysts identified the campaign after observing repetitive patterns in email subjects and structure consistent with template-driven mass distribution.
New Phishing Attack
The attackers created fraudulent Facebook Business pages adorned with official Meta branding and logos, then deployed these fake pages to send Business Portfolio invitations containing embedded malicious links.
Recipients were redirected to credential harvesting pages hosted on domains such as vercel.app, where sensitive information was extracted and intercepted.
The infection mechanism relies on social engineering and domain trust exploitation. Emails utilized urgent language such as “Action Required,” “You’re Invited to Join the Free Advertising Credit Program,” and “Account Verification Required,” compelling users to click embedded links.
The messages perfectly mimicked legitimate Meta notifications, including proper formatting and branding elements.
Once victims clicked the links, they were redirected to phishing websites designed specifically to capture login credentials and other sensitive account information.
Organizations should implement multi-factor authentication to prevent unauthorized access even when credentials are compromised.
Additionally, employees must receive training emphasizing credential verification and cautious link evaluation, regardless of sender legitimacy.
Advanced email security solutions incorporating behavioral analysis and artificial intelligence-driven detection provide enhanced protection against this evolving threat landscape.
Direct navigation to official Meta accounts rather than clicking email links represents another crucial defensive measure against these sophisticated credential theft attempts.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Microsoft has disclosed a significant vulnerability in Windows Remote Desktop Services (RDS) that could allow authorized attackers to escalate their privileges on affected systems.
Tracked as CVE-2025-60703, the flaw stems from an untrusted pointer dereference, a classic memory safety issue that has plagued software for years, and carries an “Important” severity rating from the company.
The vulnerability affects the core of Windows RDS, a widely used protocol for remote access to Windows machines. According to Microsoft’s advisory, an authorized local attacker could exploit this weakness to gain elevated privileges, potentially reaching SYSTEM-level access.
This means a user with standard credentials on a compromised machine could bypass security controls and execute arbitrary code with administrative rights.
While the issue requires local authentication, it poses a serious risk in multi-user environments, such as enterprise networks or shared servers, where insider threats or initial footholds (like through phishing) are common.
Technically, CVE-2025-60703 falls under CWE-822: Untrusted Pointer Dereference, where the software fails to validate a pointer before dereferencing it, leading to potential memory corruption.
Microsoft classifies the exploitability as “Unlikely” at this stage, with no public disclosure or evidence of active exploitation. The CVSS score, sourced directly from Microsoft, underscores its importance without escalating to Critical status, likely due to the local attack vector.
Affected versions span multiple Windows releases, including Windows 10, 11, and Server editions with RDS enabled components integral to remote work setups post-pandemic.
Product
Affected Versions
Patched By (KB/Update)
Windows Server 2012 R2
All versions before November 2025 ESU
KB5068905 (November 2025 security update)
Windows Server 2008
All versions before November 2025 ESU
November 2025 ESU security update
Windows Server 2008 R2
All ESU-eligible versions before update
November 2025 ESU cumulative update
Windows 7 ESU
All ESU-eligible versions before update
November 2025 ESU cumulative update
Windows 8.1 ESU
All ESU-eligible versions before update
November 2025 ESU cumulative update
Microsoft urges immediate patching, with updates rolled out via Windows Update. Organizations relying on RDS for virtual desktop infrastructure (VDI) or remote administration should prioritize deployment.
As an added precaution, experts recommend enforcing least-privilege principles, monitoring for unusual privilege escalations, and segmenting networks to limit lateral movement.
This disclosure comes amid a surge in Windows-targeted threats, including recent zero-day vulnerabilities in other Microsoft products. While not yet weaponized, CVE-2025-60703 serves as a reminder of the enduring challenges in securing remote access protocols.
Security teams are advised to review Microsoft’s full advisory and test patches in staging environments to avoid disruptions.
In the fast-paced world of “vibecoding,” where developers use AI to build applications rapidly, a new open-source tool is stepping up to tackle security risks.
SecureVibes, created by developer Anshuman Bhartiya, leverages Anthropic’s Claude AI through a multi-agent system to detect vulnerabilities in codebases automatically.
Released in October 2025, this Python-based scanner aims to make professional-grade security analysis accessible without needing deep expertise.
At its core, SecureVibes employs five specialized AI agents that collaborate like a human security team. The Assessment Agent maps out the codebase architecture, creating a SECURITY.md file with key details like data flows and dependencies.
Next, the Threat Modeling Agent applies STRIDE methodology to identify potential threats, outputting a THREAT_MODEL.json file. The Code Review Agent then scrutinizes the code against these threats, validating issues and generating VULNERABILITIES.json with specifics like file paths and line numbers.
An optional DAST Agent performs dynamic testing on a running app via a target URL, adding exploitability checks through Claude Agent Skills. Finally, the Report Generator compiles everything into actionable reports in formats like Markdown or JSON.
Supporting 11 languages, including Python, JavaScript, TypeScript, Go, and more, SecureVibes smartly detects project types and excludes irrelevant directories, such as venv/ for Python or node_modules/ for JS.
It handles mixed-language projects seamlessly, ensuring thorough scans. Installation is straightforward: pip install securevibes for the stable release, or clone the GitHub repo for the latest features.
Users authenticate via Claude’s CLI session or API key, then run “securevibes scan .” for a full analysis, with options for verbosity, severity filters, or sub-agent runs to cut costs.
What sets SecureVibes apart from traditional SAST tools like Semgrep or Bandit? In self-tests, it uncovered 16-17 vulnerabilities in its own codebase, four times more than single-agent AI like Claude Code, while rules-based scanners found zero.
This progressive, context-aware approach reduces false positives by requiring concrete evidence for each issue. Costs are reasonable, around $2-3 per scan using the Sonnet model, though Opus offers deeper analysis at a premium.
Privacy is prioritized: Only code and relative paths are sent to Anthropic, with no secrets or absolute paths shared. Bhartiya encourages reviewing Anthropic’s policy before scanning sensitive code. A Python API enables integration into CI/CD pipelines for automated checks.
Available on GitHub under AGPL license, SecureVibes is evolving with recent additions like DAST validation and skills for advanced testing. As vibecoding grows, tools like this could bridge the security gap in AI-driven development, helping devs ship safer apps faster.
The Tor Project has released a fresh update for its privacy-focused web browser. Tor Browser 15.0.1 is now available and addresses several high-risk security issues that could have compromised users’ privacy. This update is recommended for all users who want to stay secure on the internet and keep their information private. You can download Tor […]
Losing an iPhone is stressful enough without becoming the target of sophisticated scammers. A new phishing campaign is exploiting device owners’ distress by impersonating Apple and claiming that their lost iPhones have been recovered. These attacks combine social engineering with technical knowledge to steal Apple ID credentials and turn off critical security features. When someone […]
Google has released Chrome version 142.0.7444.162/.163 to address a high-severity security vulnerability in the V8 JavaScript engine.
The stable channel update is now rolling out across Windows, Mac, and Linux platforms over the coming days and weeks.
The security fix addresses CVE-2025-13042, classified as a “High” severity vulnerability involving an inappropriate implementation in V8, Chrome’s core JavaScript engine. The vulnerability was reported on November 3, 2025, by a security researcher with the alias 303f06e3.
This issue could allow attackers to exploit the V8 engine through specially crafted JavaScript code.
Chrome Security Update
The version 142.0.7444.162/.163 release includes one confirmed security fix addressing the V8 engine flaw.
Google maintains a comprehensive list of all changes in this build on their Chromium source repository for users who want detailed technical information about the update, and deploys it gradually across all supported platforms.
CVE ID
Severity
Component
Issue Type
Affected Versions
CVE-2025-13042
High
V8 Engine
Inappropriate Implementation
Chrome < 142.0.7444.162
Users may not see the update immediately, as Google typically releases it over days or weeks to monitor stability and ensure no new issues emerge during the rollout process.
Google continues to highlight the contributions of external security researchers who responsibly identify and report vulnerabilities.
The company uses multiple detection tools, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, to catch security bugs before they reach users.
While the rollout is automatic for most Chrome users, it’s recommended that you ensure your browser is up to date.
Users can verify their current version in Chrome settings under “About Chrome,” which automatically checks for and installs available updates.
Google restricts detailed information about security vulnerabilities until the majority of users receive patches. This responsible disclosure approach prevents attackers from exploiting known issues while fixes are being deployed.
Lite XL, a lightweight text editor written in Lua and C that runs on Windows, Linux, and macOS, has been found to contain a high vulnerability that could enable arbitrary code execution. Security researchers have identified flaws in how the editor handles project configuration files, potentially exposing users to malicious code execution when opening untrusted […]
New Android RAT for sale: 
Claimed features include:.webp)