> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape reveals several significant threats and trends. The newly identified "sshole" vulnerability (CVE-2026-123158) is leading to an uptick in exploitation attempts, particularly observed through honeypot data. Additionally, a major data breach at Japanese manufacturer Iris Ohyama has compromised the personal information of approximately 7.7 million customers. On the malware front, an unknown advanced persistent threat (APT) is utilizing NetamLoader to target Windows 10 systems. In a notable incident, attackers exploited a third-party service provider to steal up to $133 million from French Bank Crédit Mutuel Arkéa. Meanwhile, law enforcement has arrested three suspects linked to the DataSuckers hacking group, which previously targeted Dodo Pizza. The evolving role of AI in cybersecurity continues to be highlighted as companies seek to bolster defenses against these increasing threats.
|
// AI-powered summary generated at 16:00
Multiple security vulnerabilities were discovered in Twig, a template engine for PHP, which could result in PHP code injection, sandbox bypass or cross-site scripting. For the oldstable distribution (bookworm), these problems have been fixed in version 3.5.1-1+deb12u3.
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
The post Microsoft Build 2026: Securing code, agents, and models across the development lifecycle appeared first on Microsoft Security Blog.
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could...
Top Pentagon cyber policy official Katherine Sutton said recent conflicts have emphasized the importance of cyber, and that the department can’t make old mistakes with AI security.
The post DOD wants to integrate cyber in all operations, and integrate security into AI appeared first on CyberScoop.
Microsoft is working to address a widespread service issue affecting the mail flow pipeline for Exchange Online customers across North America and Germany. [...]
The order – which Trump refrained from signing at the last minute, appears to make significant concessions to industry compared to earlier drafts.
The post Trump administration releases scaled-back AI executive order appeared first on CyberScoop.
age could be made to crash or run programs as your login if it opened a specially crafted file.
EditorConfig could be made to crash if it opened a specially crafted file.
EFF is on the front lines of the fight against tech-enabled tyranny, but we aren't alone. Our team depends on your help to fight back against the surveillance state.
JOIN EFF
People around the world are pushing back against the mass surveillance that undermines privacy and free expression for everyo...
On May 13th, 2026, we publicly disclosed a critical Authentication Bypass vulnerability in Burst Statistics, a WordPress plugin with 200,000 active installations. This vulnerability can be leveraged by unauthenticated attackers, with knowledge of an administrator username, to impersonate that admini...
As AI shortens the path from vulnerability disclosure to exploitation, researchers disagree on whether the problem is inadequate security tools or inadequate operational control.
The post Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis appeared first on SecurityWeek.
Attackers exploited Meta’s AI support chatbot to reset Instagram passwords and hijack accounts without accessing victims’ email inboxes. Attackers abused Meta’s AI-powered support chatbot to reset Instagram passwords and hijack accounts without accessing victims’ email inboxes. The issue affected se...
It was discovered that age did not properly validate plugin names. An
attacker could possibly use this issue to cause execution of an
arbitrary program by supplying a crafted recipient or identity string.
In a statement, Russia's Federal Security Service (FSB) said it had uncovered what it described as a "large-scale operation" involving malicious software installed on the mobile devices of senior Russian officials.
Les patchs de sécurité de juin 2026 pour Android corrigent 124 vulnérabilités, dont une faille de sécurité zero-day patchée par Google (CVE-2025-48595).
Le post Android : le patch de juin 2026 corrige une faille zero-day déjà exploitée a été publié sur IT-Connect.
Apache Tomcat Connectors could allow local users to expose sensitive information or cause a denial of service.
libeconf could be made to crash if it received specially crafted input.
Software as a service (SaaS) providers building AI-powered applications on Amazon Bedrock AgentCore often need to serve multiple tenants with distinct security requirements from a shared infrastructure. Some tenants require cross-account access from their own Amazon Web Services (AWS) accounts, whil...
Several security issues were fixed in tar-fs.
Several security issues were fixed in Luanti.