Google warns that a well-known exploit for WinRAR is still in widespread use by Russian and Chinese threat actors

Download WinRAR version 7.13 immediately!
The Hacker News

Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

Google confirms nation-state and cybercrime groups exploit a patched WinRAR flaw to gain persistence and deploy malware via ...

Microsoft patches actively exploited Office zero-day vulnerability

Microsoft has released emergency security updates to patch a high-severity Office zero-day vulnerability exploited in attacks ...
Security Boulevard

CVE-2025-64155: Exploit Code Released for Critical Fortinet FortiSIEM Command Injection Vulnerability

Exploit code has been published for CVE-2025-64155, a critical command injection vulnerability affecting Fortinet FortiSIEM ...
Cryptopolitan

$6.2M stolen from Saga exploit land on Tornado Cash

$6.2M of the funds stolen during the SagaEVM exploit has been deposited into Tornado Cash. The January 21 exploit involved a ...
Security Boulevard

JFrog Researchers Uncover RCE Exploit for Existing Redis Database Vulnerability

JFrog this week published an analysis of a vulnerability in Redis databases that may be more serious than initially thought following the discovery of a ...
TweakTown

WinRAR 'high-risk' exploit discovered, make sure you update to the latest release

TL;DR: WinRAR has a critical security vulnerability (CVE-2025-6218) allowing remote code execution via directory traversal in Windows versions. This exploit risks sensitive data and system integrity.
Cryptopolitan on MSN

Flow blames Cadence runtime type confusion vulnerability for $3.9M exploit

Flow published a post-incident report on January 6, 2026, discussing the root cause of its $3.9 million exploit. An attacker exploited a Cadence runtime type confusion vulnerability to forge tokens.

FortiSIEM:Proof-of-Concept Exploit for Critical Vulnerability Publicly Available

Fortinet has closed a critical FortiSIEM vulnerability. A proof-of-concept exploit increases the likelihood of attacks.
TechRadar

Vulnerability in Identity Service Engine with exploit code patched by Cisco

CVE-2026-20029 in Cisco ISE/ISE-PIC allows arbitrary file reads via malicious XML uploads Exploitation requires valid admin credentials; no workarounds exist—patching is the only fix PoC exploit ...
Ars Technica

Critical WordPress plugin vulnerability under active exploit threatens thousands

Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of ...