> TODAY'S SUMMARY (103 articles)
Today's cybersecurity landscape reveals several key threats and trends. Small and medium-sized businesses (SMBs) continue to face significant risks of client data leaks due to common oversights, such as password reuse. A jailbroken AI agent has executed a two-week attack on a European telecom, highlighting the evolving nature of AI-assisted cyber threats. Notably, a recent supply chain attack compromised tens of thousands of GitHub repositories, showcasing vulnerabilities in software development ecosystems. Additionally, hackers are exploiting vulnerabilities in refrigeration controllers and NAS devices, leading to potential service disruptions and data breaches. In a concerning trend, deepfake technology is being utilized in scams, with three individuals indicted for using AI to impersonate CEOs and defraud companies out of $129 million.
|
// AI-powered summary generated at 16:00
Several security issues were fixed in OpenStack Keystone.
The breakneck speed of model releases may be creating short, silent security gaps as developers must choose between performance and security, according to a new report.
The post AI’s constant patching treadmill can be a security problem appeared first on CyberScoop.
More than 200 of the world's elites registered for a retreat whose agenda runs from panels on cult-building and sex to prepping for World War III. An associated app offers matchmaking.
I'm sorry, Dave. I can't install that repo that will totally hose your system.
A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands. [...]
Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discov...
iRhythm disclosed a cyberattack via third-party apps where patient and proprietary data was stolen, followed by a ransom demand. iRhythm Technologies is a U.S.-based digital healthcare company specializing in remote cardiac monitoring and arrhythmia detection. Its best-known product is the Zio, a we...
It was discovered that missing input sanitising in the NTLM client of the GNU SASL library could result in memory disclosure For the stable distribution (trixie), this problem has been fixed in version 2.2.2-1.1+deb13u2. We recommend that you upgrade your gsasl packages.
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure.
Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty pr...
After 26 years, today is my last day at EFF. It's been a terrific and wild ride — the organization has grown from a tiny band of fighty people trying to plant a flag for freedom and justice in the coming digital world into a large, established band of fighty people doing, well, much the same. The wo...
All have patches, so make sure you upgrade to a fixed version
Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages. [...]
A security researcher said a flaw in FIFA’s online platforms allowed her to access several internal systems, including one that could have allowed her to take control of the TV stream of every World Cup match.
A supply chain attack can affect businesses of any size. Find out how to reduce exposure from vendors and SaaS tools.
During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake plugin, a remote command-and-control server, and two PHP web shells stored directly inside the WordPress database.
The campai...
In this blog post you’ll learn how to detect and prevent subdomain takeover – a tactic where threat actors exploit dangling DNS records to redirect traffic to attacker-controlled resources. We’ll explain the issue, how the situation arises, and how you can use various AWS features and services to he...
The US government crackdown on Anthropic’s Claude Fable 5 and Mythos 5 hides a glaring truth: AI models with advanced hacking capabilities will soon be the norm.
Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent reports from Morphisec, BlueVoyant, and Huntress, respectively.
Attacks involving BabaDeda Loader, observed in April 2026,...
The Wordfence Threat Intelligence Team was notified on June 11th, 2026 of a potential supply chain compromise affecting ShapedPlugin, a WordPress plugin vendor with over 400,000 active free plugin installations. Fortunately, Wordfence customers have already had malware signature detection for the pa...