> TODAY'S SUMMARY (46 articles)
Today's cybersecurity landscape highlights several significant threats and trends. U.S. agencies, including CISA and the FBI, have issued warnings about attacks targeting industrial refrigeration controllers, emphasizing the need for improved security measures. Meanwhile, a data breach at Amplifon Americas has compromised the personal information of 1.3 million individuals, underscoring ongoing vulnerabilities in health data security. In the automotive sector, researchers exploited default credentials in mobile apps to gain unauthorized access to vehicles, raising concerns about IoT device security. Additionally, phishing attacks are on the rise, with Microsoft reporting 7.3 billion threats in Q3 2026. Finally, an exploited vulnerability in SonicWall's SSL-VPN could allow attackers to bypass multi-factor authentication, highlighting the critical need for timely patching and security awareness.
|
// AI-powered summary generated at 12:00
Plus: Gay bars in San Francisco using face scanners, France quits Palantir, Apple plans to change its private email and more.
Information published.
Information published.
FortiBleed exposed a massive campaign that made billions of login attempts against Fortinet VPNs, compromising organizations worldwide. FortiBleed wasn’t a targeted hack. It was a factory. A multi-operator crew ran an industrial-scale attack against Fortinet FortiGate SSL VPN devices worldwide, and...
Information published.
FortiBleed exposed credentials for 74,000 Fortinet devices, with attackers actively exploiting the leak to target systems worldwide. On June 18, CISA issued an emergency alert after reports surfaced that credentials for approximately 74,000 Fortinet firewalls and VPN gateways had been leaked in what...
In June 2026, retailer JCPenney and associated brands were targeted in a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from JCPenney through the exploitation of a critical zero-day vulnerability in Oracle PeopleSoft was later published publicly. The exposed records indicated...
We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices.
The post Threat Brief: Mitigating Large-Scale Credential Attacks appeared first on Unit 42.
A massive cyberattack compromised Brazil's national emergency alert system, Defesa Civil Alerta, causing millions of citizens across multiple states to receive false, extreme emergency notifications. The alerts, which were broadcast via Cell Broadcast technology, contained alarming messages, includi...
Un cabinet comptable de Lufkin, Todd, Hamaker & Johnson, LLP, a été listé par le groupe de ransomware Akira. Ce groupe prétend avoir volé environ 40 gigaoctets de données sensibles de clients et d'employés, y compris des dossiers financiers, des contrats, des numéros de sécurité sociale, des permis...
For the last 30 years, stopping the flow of cybersecurity-related software has proven to be ineffective. It's unclear why it would work now with Anthropic’s cybersecurity model Mythos.
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]
Dolphins, sharks, turtles, and human workers are all victims of unregulated squid fishing fleets.
Another news article.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.
Threat actors are exploiting an unauthenticated information disclosure vulnerability in the WordPress plugin Gravity SMTP, active on 100,000 sites. [...]
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.
One of the world’s top ransomware groups has given its criminal affiliates access to advanced tools capable of successfully disabling many of today’s enterprise endpoint detection and response (EDR) products, new research by security company ESET has found.
The group in que...
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.