> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights significant threats, including a major breach at French Bank Crédit Mutuel Arkéa, where attackers exploited vulnerabilities in a third-party service provider to steal up to $133 million. This incident underscores the ongoing risk associated with third-party integrations. Additionally, refrigeration cyberattacks continue to target European retailers, raising concerns about supply chain security. As organizations face these evolving threats, proactive measures and timely patching, especially in light of upcoming Patch Tuesday, are crucial for mitigating risks. Overall, the focus remains on enhancing security protocols to safeguard against sophisticated cyber threats.
|
// AI-powered summary generated at 12:00
Meta has revealed that attackers hijacked 20,225 Instagram accounts by exploiting a flaw in the company’s AI-assisted account recovery system. According to the company, a vulnerability in High Touch Support (HTS) allowed unauthorized parties to perform password resets on Instagram accounts. HTS is a...
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare — Security researchers at Calif have disclosed a novel denial-of-service technique, dubbed the HTTP/2 Bomb, that weaponizes two well-known mechanisms — HPACK header compression and Slowloris-style connectio...
It was discovered that Netty's HTTP proxy handler did not properly
validate headers when constructing CONNECT requests. An
attacker could possibly use this issue to inject arbitrary HTTP
headers into CONNECT requests. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubu...
The bill is expected to blanket ban companies and startups from selling people's precise location data across the state.
New Relic has announced AI Coding Observability, an open-source tool for monitoring AI-assisted software development workflows. As organizations adopt AI coding assistants, these tools often operate outside existing observability systems, limiting visibility into their use. AI Coding Observability e...
The Meta-owned communications app is filing a federal court contempt order against NSO.
The post WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order appeared first on SecurityWeek.
Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked.
A chatbot got fooled. A bot token got leaked inside the malware. The same old mistakes showed up again. And wh...
It was discovered that systemd-nspawn incorrectly handled certain optional
configuration files. A local attacker could possibly use this issue to
escape to the host system and execute arbitrary code. (CVE-2026-40226)
It was discovered that systemd-resolved incorrectly validated DNSSEC
records for s...
Israeli cybersecurity company Check Point has released security updates to patch a critical flaw affecting Remote Access VPN and Mobile Access deployments, which was exploited in zero-day attacks. [...]
Phishing has always been a numbers game. AI has turned it into a volume machine.
Attackers can now create convincing emails, fake login pages, and tailored lures in minutes. Every polished message adds another case for Tier 1 to review, another link to inspect, and another alert that cannot be dism...
Cloudflare customers can now use Cloudforce One threat intelligence directly within the WAF to block high-risk traffic. By using new cf.intel fields, security teams can automate protection against specific threat actors and targeted industries in real time.
It was discovered that poppler incorrectly handled certain malformed PDF
tiling patterns in the Splash backend. An attacker could possibly use this
issue to execute arbitrary code, obtain sensitive information, or cause a
denial of service.
It was discovered that Pillow incorrectly handled large glyph advance
values in fonts. An attacker could possibly use this issue to cause Pillow
to crash, resulting in a denial of service. (CVE-2026-42308)
It was discovered that Pillow incorrectly handled nested coordinate lists
in certain APIs. An...
Significant cybersecurity M&A deals announced by Akamai, Check Point, Cisco, Cyera, Dragos, WatchGuard and Zscaler.
The post Cybersecurity M&A Roundup: 26 Deals Announced in May 2026 appeared first on SecurityWeek.
It was discovered that nginx incorrectly handled certain cookie headers in
the HTTP/2 implementation. A remote attacker could possibly use this issue
to cause nginx to consume excessive resources, resulting in a denial of
service.
Business data security shapes trust, compliance, and how fast you can scale. Here's how to get it right early.
Business data security can affect how you find customers, win deals, and scale without stopping to untangle early mistakes. Learn how.
A Qilin ransomware affiliate is believed to be exploiting CVE-2026-50751, an authentication bypass vulnerability in Check Point VPN Remote Access and Mobile Access, the company announced on Monday. About CVE-2026-50751 Check Point Remote Access VPN enables and secures connections between corporate n...
A widely used JavaScript implementation of Google’s Protocol Buffers format is placing too much trust in untrusted data, exposing affected applications to remote code execution and other attacks.
Researchers at Cyera have disclosed six vulnerabilities affecting “protobuf.js...
It was discovered that libjxl did not properly handle certain crafted PBM
images. An attacker could possibly use this issue to cause libjxl to crash,
resulting in a denial of service, or execute arbitrary code.