> TODAY'S SUMMARY (46 articles)
Today's cybersecurity landscape highlights several significant threats and trends. U.S. agencies, including CISA and the FBI, have issued warnings about attacks targeting industrial refrigeration controllers, emphasizing the need for improved security measures. Meanwhile, a data breach at Amplifon Americas has compromised the personal information of 1.3 million individuals, underscoring ongoing vulnerabilities in health data security. In the automotive sector, researchers exploited default credentials in mobile apps to gain unauthorized access to vehicles, raising concerns about IoT device security. Additionally, phishing attacks are on the rise, with Microsoft reporting 7.3 billion threats in Q3 2026. Finally, an exploited vulnerability in SonicWall's SSL-VPN could allow attackers to bypass multi-factor authentication, highlighting the critical need for timely patching and security awareness.
|
// AI-powered summary generated at 12:00
Scattered Spider Hackers Plead Guilty on Day 1 of Trial Two young British members of the notorious Scattered Spider cybercrime group — Thalha Jubair, 20, and Owen Flowers, 18 — pleaded guilty on the opening day of what was expected to be a six-week UK trial, admitting to conspiring to hack Transport...
CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells and achieve remote code execution capability on the underlying server. “Our honeypots are seeing automated sweeps dropping webshells,...
A critical Cisco Unified CM vulnerability is now under active exploitation, weeks after the company issued patches warning it could allow attackers to gain root access.
Threat intelligence firm Defused reported the exploitation on June 23. The company said it observed the a...
We are standing at the end of an era we never thought to mourn: the era of human-speed threats.
For years, cybersecurity moved to a rhythm organizations could follow. A researcher found a bug, a CVE was cataloged, a vendor navigated a patch cycle, and weeks or even months later, a fix was deployed....
At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis.
Details:
The _index.js payload begins with a large JavaScript block comment containing fake system instructions and policy-triggering content. Because it i...
The security defects allow unauthenticated users to take control of the open source software supply chain.
The post Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking appeared first on SecurityWeek.
They say they have videos, malware, and total control of your devices. Here's how to read a sextortion email like a security researcher instead of a victim.
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. [...]
Un pirate affirme vendre 120 millions de profils attribués à bet365. La nature des données évoquée par le hacker pourrait sembler bien plus grave qu’une "simple" liste d’adresses électroniques.
A fake AI agent skill that passed security checks reached over 26,000 users through Instagram, highlighting new risks as enterprises rely on AI-driven tools.
Some of the agents involved were tied to corporate accounts, AIR said. The company said a similar attack could have...
Over a dozen Klue customers have confirmed that hackers stole data from their Salesforce instances.
The post BeyondTrust, LastPass Impacted by Klue-Salesforce Incident appeared first on SecurityWeek.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ubiquiti UniFi OS and Lantronix EDS5000 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)Â added Ubiquiti UniFi OS and Lantronix EDS5000 flaws to its Known Exploited...
LastPass disclosed that attackers used OAuth tokens compromised in a supply chain attack on Klue, a market intelligence platform that integrates with CRM and sales tools across organizations, to access customer data stored in its Salesforce environment. “On June 12th LastPass was made aware of an in...
Several security issues were fixed in MySQL.
FortiBleed exposed valid credentials for 73,000+ Fortinet firewalls, revealing a large-scale access-brokering operation targeting organizations worldwide. In mid-June 2026, researcher Volodymyr “Bob” Diachenko found a live, exposed server containing working login credentials for tens of thousands of...
New ReliaQuest study reveals the six ways AI is practically being used in attacks today
It was discovered that the Perl DBI module incorrectly handled certain
error messages. An attacker could use this issue to cause applications
using the Perl DBI module to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-9698)
It was discovered that the Perl DBI...
Fuites revendiquées chez Tripadvisor, Bet365 et Zalando Australia : attribution faible, prudence cyber maximale.
Google’s Alert Center, a dashboard in the Google Admin console that displays security and administrative alerts and helps administrators identify, investigate, and respond to issues affecting their organization, is expanding the “Super Admin password reset” alert into the “Admin password reset” aler...
Unlabelled RAID drives, no documentation, and a ticking evidence integrity clock: here’s how investigators can avoid the most common RAID forensics mistakes before they compromise a case.