Threat actors are actively exploiting a critical security flaw in "Alone – Charity Multipurpose Non-profit WordPress Theme" to take over susceptible sites.
The vulnerability, tracked as CVE-2025-5394, carries a CVSS score of 9.8. Security researcher Thái An has been credited with discovering and reporting the bug.
According to Wordfence, the shortcoming relates to an arbitrary file upload

Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install

A swath of copycat Korean apps are hiding spyware, occasionally leading to highly personal, disturbing extortions.

Koreans Hacked, Blackmailed by 250+ Fake Mobile Apps

Attackers are becoming faster at exploiting vulnerabilities, but this startup seeks to stop threats before they lead to breaches.

Tonic Security Harnesses AI to Combat Remediation Challenges

The deal shakes up the identity and access management landscape and expands Palo Alto Networks' footprint in the cybersecurity market.

Palo Alto Networks Grabs IAM Provider CyberArk for $25B

July Linux Patch Wednesday. This time, there are 470 vulnerabilities, slightly fewer than in June. Of these, 291 are in the Linux Kernel. One vulnerability shows signs of being exploited in the wild (CISA KEV): 🔻 SFB – Chromium (CVE-2025-6554) There are also 36 (❗️) vulnerabilities for which public exploits are available or suspected to […]

**July** **Linux Patch Wednesday****.** This time, there are 470 vulnerabilities, slightly fewer than in June. Of these, 291 are in the Linux Kernel. One vulnerability shows signs of being exploited in the wild (CISA KEV):

🔻 **SFB** – Chromium (CVE-2025-6554)

There are also 36 (❗️) vulnerabilities for which public exploits are available or suspected to exist. Notable among them:

🔸 **RCE** – Redis (CVE-2025-32023), pgAdmin (CVE-2024-3116), Git (CVE-2025-48384)  
🔸 **EoP** – Sudo (CVE-2025-32462, CVE-2025-32463)  
🔸 **PathTrav** – Tar (CVE-2025-45582)  
🔸 **XSS** – jQuery (CVE-2012-6708)  
🔸 **SFB** – PHP (CVE-2025-1220)  
🔸 **DoS** – LuaJIT (CVE-2024-25177), Linux Kernel (CVE-2025-38089)  
🔸 **MemCor** – DjVuLibre (CVE-2025-53367)

🗒 Full Vulristics report

На русском

Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.

А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.

July Linux Patch Wednesday

The US government is throwing the book at even midlevel cybercriminals. Is it just — and is it working?

Inside the FBI's Strategy for Prosecuting Ransomware

VPN use is skyrocketing across the UK as the region's Online Safety Act places age verification controls on adult websites.

As the UK’s Online Safety Act came into effect on Friday—along with its age verification controls—the use of virtual private network (VPN) services has skyrocketed by up to 20-fold across the region.

Top10VPN, which monitors VPN traffic around the world, spotted UK VPN traffic spiking 1,327% on July 25, compared to the daily average over the prior four weeks. The traffic didn’t slow down on the days following, either, increasing 1,.712% above the pre-July 25 baseline on July 26, and by almost 2,000% on July 27.

The Online Safety Act forces a variety of websites to verify a user’s age, ensuring they are 18 years old or over. This doesn’t just apply to the obvious porn sites, but to a broad array of other categories: social media, gaming, and even search. The content considered harmful under the bill isn’t just sexual either, but covers areas including suicide, self-harm, and content related to eating disorders. Sites that don’t comply risk fines or even bans in the UK.

The more stringent law means that simply checking a box saying you’re over 18 won’t cut it. Instead, the UK’s communications regulator OFCOM suggests several ways for sites to verify a person’s age:

*   Using open banking information (where a person submits information from their bank that proves their age)
*   Photo ID matching using facial recognition
*   Proving your age to your mobile operator who then approves you on the site’s behalf
*   Checking your credit card (only adult UK residents can get one)
*   Analyzing your email to see if it’s likely to have been used in an adult situation (a mortgage application, say)
*   Using digital identity services such as a digital ID wallet (the EU is working on one of these)
*   Estimating a person’s age from a selfie.

OFCOM argues that all methods must be implemented in line with UK privacy law, but it’s understandable that adult users might consider this a privacy risk. It’s also likely that some minors will want to flout the rules and access content that the government doesn’t want them to, especially given the wide scope of the law. Both these reasons are likely why VPN activity has soared since the law kicked in.

When you browse the internet directly, your computer uses an IP address that your internet service provider gives you. The site you’re browsing can use that to determine what country you’re in. A VPN is a program that connects your internet browsing device to the VPN company’s computer. That computer then serves as your jumping-off point to the internet.

Because VPN providers have networks of these computers around the world, you can pretend to be in another country of your choosing when using a VPN, meaning people often use them to bypass censorship laws. As more countries have been restricting access to adult content, they have also become a tool for internet users to dodge age protection laws.

UK Science Secretary Peter Kyle downplayed the use of VPNs in a Guardian interview yesterday, arguing that “very few children” were seeking harmful content online. Yet according to OFCOM, 8% of children between eight and 14 in the UK access online porn every month. That figure increases to almost one in five boys in that age bracket.

Kyle insisted that the government had solved up to 90% of the problem. “That 10% that’s remaining, or whatever that percentage is? We’ll go figuring it out as we move forward,” he said.

Per Wired, the Proton VPN service tweeted that its UK signups surged over 1,400%. “Unlike previous surges, this one is sustained, and is significantly higher than when France lost access to adult content,” it added.

VPN service Windscribe also tweeted a graph showing what appeared to be a massive spike in daily sign-ups on July 25.

And AdGuard also reported a spike in traffic, “Website traffic from UK users has surged by more than 60%, with visits from Android devices more than doubling and iOS traffic up by nearly 100%,” it said. “VPN installs in the UK have also grown by 2.5 times, and we’re seeing a clear increase in traffic from keyword searches—a significant share of which is related to adult content.”

Kyle told the Guardian that he was not going to ban VPNs, but that he would be looking “very closely” at how they are being used.

 VPN use rises following Online Safety Act’s age verification controls 

An unsealed indictment associated with the Chinese threat group shows its members worked for companies closely aligned with the PRC as part of a larger contractor ecosystem.

Silk Typhoon Linked to Powerful Offensive Tools, PRC-Backed Companies

Cybersecurity trends in 2025 reveal rising AI threats, quantum risks, and supply chain attacks, pushing firms to adapt or face major data and financial losses.

The cybersecurity world isn’t just changing, it’s getting a complete makeover. With approximately 600 million cyberattacks per day in 2025, translating to 54 victims every second, the stakes have never been higher. If you’re running a business in 2025, cybersecurity isn’t some back-burner IT concern anymore. It’s your digital lifeline.

Whether you’re launching a startup that needs to search for a Domain or protecting an enterprise that’s weathered every tech storm since Y2K, understanding this year’s cybersecurity shifts isn’t optional; it’s survival.

****AI: The Ultimate Double Agent****

Artificial intelligence has officially entered its villain era, and it’s bringing some serious heat. Criminals are using AI for sophisticated attacks, crafting adaptive malware, launching real-time phishing campaigns, and creating convincing deepfakes that could fool your mother.

Here’s the kicker: The number of deepfakes is projected to reach 8 million in 2025, up from 500,000 in 2023. That’s a 1,500% increase in fake content that’s getting harder to spot every day.

****The AI Arms Race Gets Personal****

But AI isn’t just playing for the dark side. Defenders are integrating AI for advanced anomaly detection, rapid threat hunting, and automated response. It’s like having a digital security guard that never sleeps, never gets distracted, and processes threats faster than any human team ever could.

The real game-changer? Security operations centers are using AI for big data analysis of logs, rapid anomaly detection, and automated containment procedures, reducing breach window times and cutting manual analyst workloads.

****Zero Trust: The “Trust No One” Revolution****

Remember when your office network was like a medieval castle, hard shell, soft center? Those days are dead than Internet Explorer. Organisations are adopting zero trust models, which continuously verify users and devices.

****Why the Rush to Zero Trust?****

Because micro-segmentation, user context checks, and continuous session monitoring are becoming industry standards, it reduces the risks of lateral movement by attackers. Think of it as giving every user their own personal security bubble instead of one big group hug.

The momentum is real: Continuous validation of access rights and micro-segmentation are standard across cloud apps, IoT systems, and remote endpoints, offering layered protection that works.

****Quantum Computing: The Storm That’s Coming****

Let’s talk about the elephant in the server room. Quantum computing isn’t science fiction anymore; it’s a ticking time bomb for current encryption methods. Security experts predict that quantum computing poses a significant potential threat, especially for breaking contemporary encryption.

****The Post-Quantum Panic****

Here’s what keeps security experts awake: quantum computers could theoretically crack today’s encryption in hours instead of the billions of years it would take conventional computers. Organisations are beginning to explore post-quantum cryptography to protect sensitive data.

The urgency is real because adversaries aren’t waiting. They’re already collecting encrypted data now, planning to decrypt it once quantum computers become viable. It’s called “harvest now, decrypt later,” and it’s happening right now.

****Ransomware Gets a Business Model Makeover****

Ransomware isn’t just malware anymore; it’s a full-blown industry. The ransomware economy has grown, with attack toolkits available for purchase and use by less-skilled criminals. It’s like Uber for cybercrime, except everyone loses.

****The Numbers Don’t Lie****

Nearly 60% of businesses have faced ransomware attacks in the past year, and North America has seen an 8% increase in such attacks. The financial hit? The typical ransomware recovery averages $2.73 million.

But here’s the twist: Supply chain breaches, especially via third-party vendors and software dependencies, continue to surge, prompting more real-time monitoring and contractual cybersecurity demands.

****Supply Chain Attacks: The Domino Effect Nobody Saw Coming****

Your business is only as secure as your weakest vendor, and that’s becoming a serious problem. By 2025, 45% of global organisations are expected to have faced a software supply chain attack.

****The Ripple Effect****

When one vendor gets compromised, it doesn’t just affect them; it creates a domino effect across their entire customer base. Think SolarWinds, but happening more frequently and with less fanfare.

****Cloud Security: The New Wild West****

As businesses migrate to the cloud faster than you can say “digital transformation,” new attack surfaces are exposed through misconfigurations or unpatched images. Embedding security “shift-left” into DevOps is now critical.

****The Multi-Cloud Challenge****

Here’s where it gets tricky: most companies aren’t just using one cloud provider. They’re juggling AWS, Azure, Google Cloud, and private data centers like a digital circus act. Each platform has unique configurations, logs, and policy frameworks, making consistent threat visibility nearly impossible.

****The Human Factor: Still the Biggest Wild Card****

Despite all the tech advances, humans remain the weakest link in the security chain. The “hybrid workforce”, remote, contracted, or third-party, magnifies insider threats, necessitating behavioural analytics and strong identity management.

****Authentication Gets an Upgrade****

Advanced authentication through biometrics and continuous monitoring minimises credential-based threats across distributed environments. It’s not just about what you know anymore; it’s about who you are, where you are, and how you normally behave.

****The Money Trail: Following the Cybersecurity Budget****

Here’s the reality check: Global cybercrime costs are projected to hit $10.5 trillion in annual damages by 2025. That’s not a typo, trillion with a T.

****Investment Response****

The good news? 85% of organisations plan to increase cybersecurity budgets, with spend projected to grow at a 12.2% annual rate, topping $377 billion globally by 2028.

The bad news? The global shortage of skilled cybersecurity professionals continues, slowing the adoption of advanced tools across smaller enterprises.

****Data Breaches: The Expensive Reality****

Let’s talk numbers that hurt: IBM reports the global average cost of a data breach rose to $4.88 million in 2024 and continues climbing. For IoT devices specifically, the average cost of a successful attack is over $330,000.

****Identity Fraud Explosion****

Identity fraud losses reached $27.2 billion in 2024, up 19% from the previous year. Your data isn’t just valuable, it’s becoming the digital equivalent of gold.

****The Regulatory Response: Compliance Gets Serious****

Governments worldwide are responding to the escalating threat with stricter regulations. New laws mandate stronger incident reporting, data protection, and resilience, influencing risk management strategies globally.

****What This Means for Your Business****

The cybersecurity world of 2025 isn’t about perfect protection; it’s about smart adaptation. Cybersecurity requirements are embedded early in the software development lifecycle, from DevOps pipelines to ongoing vulnerability management.

****The New Security Mindset****

Organisations implement CSMA frameworks for modular, integrated controls across varied systems, improving visibility and control in decentralised environments. It’s not about building higher walls, it’s about building smarter defences.

The winners in 2025 won’t be the companies with the most expensive security tools. They’ll be the ones who understand that cybersecurity is a business strategy, not just a technical challenge. They’ll invest in their people, stay flexible with their defences, and never stop learning.

Because in cybersecurity, the moment you think you’ve figured it out is the moment someone’s already figured out how to beat you.

****Frequently Asked Questions****

**Q: How much should my company budget for cybersecurity in 2025?** A: With 85% of organisations planning to increase cybersecurity budgets, most experts recommend allocating 10-15% of your IT budget to cybersecurity. The actual amount depends on your industry risk level and current security maturity.

**Q: Is AI more helpful or harmful for cybersecurity?** A: It’s genuinely both. While criminals are using AI for sophisticated attacks, defenders are integrating AI for advanced anomaly detection and rapid threat hunting. The key is staying ahead of the curve.

**Q: Should small businesses worry about quantum computing threats?** A: Not immediately, but start planning now. Organisations are beginning to explore post-quantum cryptography, and early preparation will be cheaper than emergency migration later.

**Q: What’s the biggest cybersecurity mistake companies make?** A: Treating cybersecurity as purely a technology problem instead of a business risk. The “hybrid workforce” magnifies insider threats, requiring behavioural analytics and strong identity management. It’s about people, not just tools.

**Q: How quickly are supply chain attacks increasing?** A: Rapidly. By 2025, 45% of global organisations are expected to have faced a software supply chain attack. It’s not a matter of if, but when your supply chain will be targeted.

Latest News