> TODAY'S SUMMARY (157 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A supply-chain attack involving AWS integrations has been uncovered, where attackers backdoored trusted connections to steal sensitive data from multiple customers. France has attributed significant cyberattacks on industrial refrigeration systems to Iranian state-sponsored hackers, resulting in operational disruptions and potential fire hazards. Additionally, a vulnerability in SonicWall's SSL VPN has been exploited, enabling attackers to bypass multi-factor authentication, raising concerns over corporate security. Meanwhile, hackers are actively exploiting the "SSHole" vulnerability in OpenSSH to breach Linux systems. Organizations are urged to strengthen their defenses amid these escalating threats, particularly as attacks targeting industrial controls and supply chains increase.
|
// AI-powered summary generated at 20:00
Cisco has warned that a high-severity security flaw impacting Catalyst SD-WAN Manager has come under active exploitation.
The vulnerability, tracked as CVE-2026-20245, carries a CVSS score of 7.8 out of a maximum of 10.0. It affects the following deployment types -
On-Prem Deployment
Cisco SD...
MagaluPay, une institution de paiement réglementée, a été victime d'une cyberattaque qui a empêché ses clients d'effectuer des transactions financières. Bien que l'entreprise ait confirmé l'incident et assuré que les données personnelles n'ont pas été compromises, les services de paiement via Pix on...
Tech giant Toshiba and mega-retailer Muji warned visitors that suspicious sign-in screens popping up on their websites could collect credentials. [...]
When 'Chatty Spider' morphs into tech services cosplay spider
IBM and two of its subsidiary companies were allegedly breached during the mid-2010s, which a lawsuit filed by a former cybersecurity executive accuses IBM of not disclosing and actively covering up.
The internet is an essential resource for young people and adults to access information, explore community, and find themselves—both inside countries and across continents. Yet governments around the world continue to introduce and implement legislation requiring all online users to verify their age...
CISA warned today that hackers are now actively exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers. [...]
A Chinese espionage group tracked as UNC5221 has been accessing Microsoft 365 environments using the Brickstorm backdoor and previously undocumented malware named Plenet and AgentPSD. [...]
Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively.
According to JFrog, the information stealer "scrape...
Researchers exposed the Silent Ransom Group ‘s Fast Flux infrastructure as the FBI warns of ongoing attacks targeting U.S. law firms and businesses. Resecurity uncovered the Silent Ransom Group (SRG)’s Fast Flux network infrastructure and shares available intelligence with the cybersecurity communit...
A California man was sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine through Nemesis Market, one of the world's largest dark web marketplaces. [...]
Good luck, sys admins
Microsoft has identified seven new failure modes in agentic AI systems, in addition to those it identified last year in its first Taxonomy of Failure Modes in Agentic AI Systems.
Four things contributed to the growing list of ways agentic AI can go wrong: the speed at which...
If you've ever received an out-of-the-blue message via LinkedIn from a recruiter offering some well-paid consultancy work, intelligence agencies have a message for you: be very careful.
Read more in my article on the Hot for Security blog.
The team behind RubyGems, a package hosting site for Ruby developers, has added a new feature to bundler, a tool for managing Ruby packages (or ‘gems’) to protect developers against the recent wave of software supply chain attacks: A cooling-off period before recently updated...
Modern web applications require robust security controls to protect user data and application resources. Authentication and authorization are two fundamental pillars of application security that answer critical questions: Who are you? and What are you allowed to do? Implementing these controls corre...
Last year during LGBTQ+ Pride month, we launched an LGBT Q&A where we answered your most pressing digital rights questions on EFF’s Instagram and TikTok accounts.Â
Ahead of LGBT Q&A Season 2 launching next week, we’re posting a recap with some of the questions we answered. Check them out be...
Microsoft Threat Intelligence identified a prompt injection pathway in Claude Code GitHub Action that allowed access to workflow secrets under specific conditions. This research examines the attack chain, responsible disclosure process, Anthropic's mitigation, and guidance for securing AI-powered CI...
CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability.
The post OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds appeared first on SecurityWeek.
Pour la première fois de l'histoire d'Internet, le trafic généré par les bots a officiellement dépassé celui des humains, d'après les stats Cloudflare.
Le post Trafic Internet : les robots ont officiellement dépassé les humains selon Cloudflare a été publié sur IT-Connect.