> TODAY'S SUMMARY (103 articles)
Today's cybersecurity landscape reveals several key threats and trends. Small and medium-sized businesses (SMBs) continue to face significant risks of client data leaks due to common oversights, such as password reuse. A jailbroken AI agent has executed a two-week attack on a European telecom, highlighting the evolving nature of AI-assisted cyber threats. Notably, a recent supply chain attack compromised tens of thousands of GitHub repositories, showcasing vulnerabilities in software development ecosystems. Additionally, hackers are exploiting vulnerabilities in refrigeration controllers and NAS devices, leading to potential service disruptions and data breaches. In a concerning trend, deepfake technology is being utilized in scams, with three individuals indicted for using AI to impersonate CEOs and defraud companies out of $129 million.
|
// AI-powered summary generated at 16:00
It was discovered that lwIP contained a buffer overflow in the EAP
authentication handling code. An attacker could possibly use this issue
to trigger a buffer overflow, resulting in arbitrary code execution or a
denial of service. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-8597)
It was di...
Multiple security vulnerabilities were discovered in Ironic, the OpenStack component to manage and provision baremetal servers, which could result in information disclosure or denial of service. For the oldstable distribution (bookworm), these problems have been fixed in version 1:21.4.4-0+deb12u1....
Tim Shepard discovered a vulnerability in Neutron, the OpenStack virtual network service, which allowed the bypass of port RBAC rules. The oldstable distribution (bookworm) is not affected. For the stable distribution (trixie), this problem has been fixed in version 2:26.0.3-0+deb13u2.
In this weekâs newsletter, Amy reminisces on the tech toys of their childhood, inspired by a hilarious lesson about why your digital privacy shouldn't be left on an open channel.
Attackers are exploiting the critical CVE-2026-10520 flaw in Ivanti Sentry, compromising many internet-exposed gateways shortly after patches were released. Threat actors have started exploiting a maximum-severity OS command injection flaw in Ivanti Sentry, tracked as CVE-2026-10520, that allows rem...
Another day, another Windows exploit code
Two security teams have shown, in separate research published this week, that OpenClaw, the popular self-hosted AI agent, can be driven to run attacker-controlled code or hand over sensitive data through ordinary-looking inputs.
Imperva buried instructions inside shared contacts, vCards, and locati...
Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender.
"This was an accidental discovery, it took a total of 4 hours to find this," the researcher said in...
What do EFF staffers Sarah Chen, Javier Morales, Caitlin Chin, Emma Rodriguez, and Mikko Kopponen have in common?Â
For one thing, they donât exist.Â
For another, all have been quoted as EFF experts in articles published in the past two months on a site called News-USA Today, which describes itself a...
Denis Obrezko accused of orchestrating cyberattacks that compromised at least 11 U.S. companies as part of the Kremlin-linked group's sprawling espionage operation.\
The post Russian national charged in connection with Void Blizzard espionage campaign appeared first on CyberScoop.
L'autoritĂ© espagnole sanctionne un Ă©diteur de presse pour avoir diffusĂ© une vidĂ©o identifiant un mineur et une victime, jugeant que l'intĂ©gration de contenu tiers constitue un traitement de donnĂ©es soumis au principe de minimisation, mĂȘme au nom de la libertĂ© d'information.Faits et contexteL'autorit...
Traitement illicite de données sensibles (préférences sexuelles), manquement à l'obligation de transparence et absence de mesures de vérification de l'ùge sur un site internet destiné aux adultes.Faits et contexteL'Agence Espagnole de Protection des Données (AEPD) a aujourd'hui publié une décision d...
A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis...
L'autorité britannique de protection des données (ICO) a publié ses lignes directrices finalisées concernant les produits et services de l'internet des objets (IoT) destinés aux consommateurs, clarifiant ses attentes en matiÚre de conformité.Ces lignes directrices, issues d'une consultation de douze...
An amendment by Sen. Kirsten Gillibrand (D-NY) to the chamberâs fiscal 2027 national defense authorization bill that would have created the digital-focused service was defeated 14-13 when the Senate Armed Services Committee took up the nearly $1.2 trillion legislation behind closed doors this week.
Ubuntu Kylin Software Center could be made to run programs as an administrator if it received specially crafted input via its D-Bus service.
"AI can make mistakes" isn't a good enough legal defense for defamatory or incorrect AI Overviews, a German court has ruled.
A joint congressional report describes a spam operation that turned tens of thousands of fake podcasts into search-engine bait for illegal pharmacy and scam sites.
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a Binding Operational Directive that will change how the US federal government approaches vulnerability management. The directive arrives as the patching problem has become nearly unmanageable, driven by a surge in newly publi...
No disclosure via official channels, no offer of identity theft monitoring, no problem