Author: HackWatchit
The Zero Day Initiative is offering a $1 million reward to security researchers who will demonstrate a zero-click WhatsApp exploit at its upcoming Pwn2Own Ireland 2025 hacking contest. The record bounty targets zero-click security flaws that allow code execution without user interaction on the messaging platform used by more than three billion people worldwide. Meta, alongside Synology and QNAP, is co-sponsoring the Pwn2Own Ireland 2025 competition, which will take place from October 21 to October 24 in Cork, Ireland. “As you might have guessed from the title, we’re excited to announce that Meta is co-sponsoring this year’s event, and they…
Is Bitcoin the new corporate treasury asset? And can energy infrastructure be digitized into tradeable tokens? These are the questions raised by the recent strategic alliance between PowerBank and Intellistake Technologies Corp. At the heart of this collaboration lies a larger inquiry: what happens when a clean energy firm and a decentralized AI infrastructure company decide to rewire how value is stored and deployed? The partnership between PowerBank (Nasdaq: SUUN), a clean energy infrastructure company formerly known as SolarBank, and Intellistake (CSE: ISTK), a company focused on digital asset infrastructure and decentralized AI, is attempting to create new pathways in…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. New Linux backdoor Plague bypasses auth via malicious PAM moduleChina Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech TensionsMalicious AI-generated npm package hits Solana usersMeta Offers $1M bounty at Pwn2Own Ireland 2025 for WhatsApp exploitsToolShell under siege: Check Point analyzes Chinese APT Storm-2603CISA released Thorium platform to support malware and forensic analysisRussia-linked APT Secret Blizzard targets foreign embassies in…
Last week, the United Kingdom began requiring residents to verify their ages before accessing online pornography and other adult content, all in the name of protecting children. Almost immediately, things did not go as planned—although, they did go as expected.As experts predicted, UK residents began downloading virtual private networks (VPNs) en masse, allowing them to circumvent age verification, which can require users to upload their government IDs, by making it look like they’re in a different country. The UK’s Online Safety Act is just one part of a wave of age-verification efforts around the world. And while these laws may…
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Review: LLM Engineer’s HandbookFor all the excitement around LLMs, practical, engineering-focused guidance remains surprisingly hard to find. LLM Engineer’s Handbook aims to fill that gap. Vulnhuntr: Open-source tool to identify remotely exploitable vulnerabilitiesVulnhuntr is an open-source tool that finds remotely exploitable vulnerabilities. It uses LLMs and static code analysis to trace how data moves through an application, from user input to server output. This helps it spot complex, multi-step vulnerabilities that traditional tools often miss. The legal minefield of hacking backIn this Help Net Security…
Cybersecurity is no longer a technical afterthought, thanks to today’s interconnected world. It’s a boardroom imperative. As online threats become more sophisticated and breaches grow costlier, businesses are realising that digital security must be embedded into corporate governance. But what does it mean for cybersecurity to be a board-level priority, and why are many companies still lagging? Cybersecurity expert Serhii Mikhalap believes the answer lies in mindset. With over nine years of frontline experience, including leading national cyber defence operations and co-founding a cybersecurity startup, Mikhalap has witnessed firsthand the consequences of treating cybersecurity as a checkbox exercise rather than…
Beneath the progress on gender inclusion in industrial cybersecurity lies a more complex and unresolved terrain. Intersectional inequities, rooted in the confluence of gender, age, cultural norms, and socioeconomic origin, continue to define who participates in, advances through, or quietly exits the OT (operational technology) workforce. The industrial sector’s longstanding allegiance to hierarchical systems and operational orthodoxy has created an ecosystem where diversity efforts often default to superficial compliance, failing to interrogate the deeper scaffolding of exclusion. Across ICS (industrial control system) and OT domains, these overlapping biases tend to be structurally encoded in access to sponsorship, informal knowledge networks,…
What is stalkerware? Stalkerware is a dangerous form of spyware used for covert phone monitoring. It allows someone to secretly track your texts, location, photos, and even use your camera or microphone. Stalkerware runs as a hidden app, often avoiding spyware detection. You’ll need to watch for signs like battery drain or unusual phone behavior. In this guide, we will explain how to check for hidden apps and increased data usage. We’ll show you how to check Android device administrator permissions for stalkerware, and how to use a trusted antivirus for stalkerware detection. We’ll discuss why removing stalkerware could alert…
A vulnerability that researchers call CurXecute is present in almost all versions of the AI-powered code editor Cursor, and can be exploited to execute remote code with developer privileges. The security issue is now identified as CVE-2025-54135 and can be leveraged by feeding the AI agent a malicious prompt to trigger attacker-control commands. The Cursor integrated development environment (IDE) relies on AI agents to help developers code faster and more efficiently, allowing them to connect with external resources and systems using the Model Context Protocol (MCP). According to the researchers, a hacker successfully exploiting the CurXecute vulnerability could open the…