> TODAY'S SUMMARY (130 articles)
Today's cyber news highlights several significant threats and trends. The largest cryptocurrency heist in history occurred as North Korean hackers stole approximately $6.3 billion from Binance by exploiting a compromised DevOps laptop. In retail, fashion retailer Resolve reported the theft of customer payment card information due to a security breach. Additionally, a malicious update to the Claude Code extension for VS Code was found to have installed persistent SSH backdoors on developers' machines. Exploits targeting critical vulnerabilities in Drupal and GitLab are actively being leveraged by attackers, raising concerns about web security. Lastly, hackers published sensitive data of over 41,000 DHS employees, emphasizing the ongoing risks to government cybersecurity.
|
// AI-powered summary generated at 20:00
Fake Firefox extensions posing as Phantom, Jupiter, and Bitget targeted users to steal crypto wallet recovery phrases and private keys.
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity fr...
CREST has published a framework for strengthening cyber resilience across financial services
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
The Federal Trade Commission ordered nine food delivery, airline and ride-sharing companies to turn over detailed information on how they harness personal data to set individual consumer prices and employee compensation.
The social networking site is facing criticism for blocking access to the site, which identifies thousands of ICE agents and other employees working for Homeland Security.
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities.
"It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead...
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent...
The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.
The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.
The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the country's main online platform for managing tax and financial affairs.
The University of New Mexico was able to restore systems used by its healthcare facilities after a cyberattack forced it to divert ambulances and cancel classes at its medical school.
Le ransomware C3RB3R s'attaque aux NAS Synology pour chiffrer les données après les avoir compromis en exploitant des failles DSM. Voici comment vous protéger.
Le post NAS Synology : une vague d’attaques du ransomware C3RB3R, voici comment vous protéger a été publié sur IT-Connect.
BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks.
The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared first on SecurityWeek.
Discover how the Cellebrite Autumn 2026 Release is transforming digital investigations with faster access to evidence, AI-powered insights and seamless collaboration.
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote...
How organizations can use the basic principles of secure system design to reduce the risks of deploying AI agents: a guide for AI system architects and security teams.
Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact.
New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private in...
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns.
The personal and work information was allegedly stolen from an Okta single sign-on system earlier this year.
The post Over 41,000 DHS Employee Records Leaked Online appeared first on SecurityWeek.