Search Live is now available for Google app users in the US, offering real-time, multimodal search, powered by AI. This feature will enable users to have real-time conversations with Google Search in AI Mode while sharing their phone's camera feed with the app. Search will be able to see and interpret what the user's camera is focused on and offer relevant links for deeper context, as well as live guidance.

The new feature can be accessed from a new "Live" icon beneath the search bar in the Google app. It can also be used from Google Lens by selecting the Live option at the bottom of the screen. Camera sharing will be enabled by default here to allow for an instant back-and-forth conversation about whatever is in front of you.

Search Live is available through the Google app on iOS and Android now. This wider rollout only supports English for now.This article originally appeared on Engadget at https://www.engadget.com/ai/googles-ai-search-live-is-now-available-to-all-us-app-users-151849371.html?src=rss

Libraesva patched CVE-2025-59689, a medium-severity remote command execution vulnerabilityAttack exploited compressed email attachments; threat actor likely a hostile foreign stateVersions below 5.0 are unsupported and require manual upgrades to stay secureLibraesva Email Security Gateway (ESG) has patched a medium-severity vulnerability apparently abused by state-sponsored threat actors to achieve remote command execution (RCE) capabilities on targeted endpoints.In a security advisory, Libraesva announced addressing a command injection flaw which can be triggered by a malicious email with a specially crafted compressed attachment.The flaw enabled the execution of arbitrary commands as a non-privileged user, due to improper sanitation during the removal of active code from files contained in some compressed archive formats."Hostile" attackThe vulnerability is tracked as CVE-2025-59689 and was given a severity score of 6.1/10 (medium).All versions, from 4.5 onward, were said to be vulnerable. Libraesva released patches for ESG 5.0, 5.1, 5.2, 5.3, 5.4, and 5.5, while versions below 5.0 are no longer supported and need to be manually upgraded.One attack has been documented so far, the advisory further reads, and the attackers are apparently “a foreign hostile state entity”.“The single‑appliance focus underscores the precision of the threat actor (believed to be a foreign hostile state) and highlights the importance of rapid, comprehensive patch deployment,” the company stressed.Libraesva advertises ESG as an advanced email security solution designed to protect organizations from threats like phishing, spam, malware, and business email compromise.It filters inbound, outbound, and internal email traffic using both gateway-level and API-layer defenses, offering protection for platforms like Microsoft 365 and Google Workspace.According to BleepingComputer, the company has “thousands” of clients among small and medium-sized organizations, as well as enterprises. In total, more than 200,000 users were said to be using Libraesva ESG, with the platform being particularly popular among entities in education, finance, and government.You might also likeWhat is a Secure Web Gateway?Take a look at our guide to the best authenticator appWe've rounded up the best password managers

React2Shell (CVE‑2025‑55182) exploited to compromise hundreds of systems worldwideChina‑linked groups and North Korea abuse flaw for persistence, espionage, and cryptominingPatch immediately to React versions 19.0.1, 19.1.2, or 19.2.1.React2Shell, a critical severity vulnerability in React Server Components (RCS), was already used to compromise “several hundred machines across a diverse set of organizations”.This is according to Microsoft, whose latest blog post discusses the vulnerability and how to defend against incoming attacks.In early December, the React team published a security advisory detailing a pre-authentication bug in multiple versions of multiple packs, affecting RCS. The bug, now dubbed “React2Shell”, is tracked as CVE-2025-55182, and is given a severity score of 10/10 (critical).Arbitrary commands, droppers, and cryptominersGiven that React is one of the most popular JavaScript libraries out there, powering much of today’s internet, researchers warned that exploitation was imminent, urging everyone to apply the fix without delay and update their systems to versions 19.0.1, 19.1.2, and 19.2.1.Now, Microsoft says these warnings have come true, as numerous threat actors have abused the flaw to run arbitrary commands, drop malware, and move laterally throughout the target infrastructure, successfully blending with other legitimate traffic.Redmond also stressed that the number of attacks increased after React publicly disclosed the findings, as more threat actors moved in to deploy memory-based downloaders and cryptominers.Two weeks ago, Amazon Web Services (AWS) reported that two China-linked groups, Earth Lamia and Jackpot Panda, have been seen using the bug to target organizations in different verticals.Targets are located all over the world, from Latin America to the Middle East and Southeast Asia. Financial services firms, logistics, retail, IT companies, universities, and government organizations are all being attacked - with the goal of the attacks being establishing persistence and cyber-espionage.Soon afterwards, researchers also observed North Korean state-sponsored threat actors doing the same. The only difference is that the North Koreans are using the flaw to deploy a novel persistence mechanism malware dubbed EtherRAT. Compared to what Earth Lamia and Jackpot Panda were doing, EtherRAT is “far more sophisticated”, representing a persistent access implant that combines the techniques from at least three documented campaigns.Via The RegisterFollow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.