FreePBX has released security patches addressing four critical vulnerabilities that could allow attackers to execute arbitrary code on affected systems. These flaws include SQL injection attacks, arbitrary file upload capabilities, and authentication type bypass mechanisms. The vulnerabilities span multiple components and require immediate attention from organizations running FreePBX deployments.

Router USB ports, while convenient for file sharing and printer connectivity, represent a significant security vulnerability in home and business networks. Threat actors have exploited these ports to deploy malware including WannaCry ransomware and establish persistent network access.

Security researchers have identified a critical no-click vulnerability in Gemini Enterprise that enables unauthorized access to sensitive data without requiring user interaction. The flaw has been associated with Kimsuky APT, a sophisticated threat actor known for targeting enterprise environments.

Indirect prompt injection attacks represent an evolving threat to web security, particularly affecting organizations in banking and healthcare sectors. Google has responded by implementing layered defensive mechanisms within Chrome to detect and block these sophisticated attacks before they can compromise user data or system integrity.

Threat actors are actively exploiting hard-coded cryptographic keys in Gladinet to bypass authentication controls and achieve unauthorized access and code execution capabilities. Two critical vulnerabilities, CVE-2025-11371 and CVE-2025-30406, have been identified as primary attack vectors affecting healthcare and technology sectors.

Security researchers have uncovered ConsentFix, a sophisticated phishing attack targeting Azure CLI users. This supply chain attack leverages compromised development tools to gain access to enterprise networks. Understanding the attack vectors and implementing proper vetting procedures is critical for organizations relying on third-party tools like the Azure CLI.