> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape reveals several significant threats and trends. The newly identified "sshole" vulnerability (CVE-2026-123158) is leading to an uptick in exploitation attempts, particularly observed through honeypot data. Additionally, a major data breach at Japanese manufacturer Iris Ohyama has compromised the personal information of approximately 7.7 million customers. On the malware front, an unknown advanced persistent threat (APT) is utilizing NetamLoader to target Windows 10 systems. In a notable incident, attackers exploited a third-party service provider to steal up to $133 million from French Bank Crédit Mutuel Arkéa. Meanwhile, law enforcement has arrested three suspects linked to the DataSuckers hacking group, which previously targeted Dodo Pizza. The evolving role of AI in cybersecurity continues to be highlighted as companies seek to bolster defenses against these increasing threats.
|
// AI-powered summary generated at 16:00
Microsoft and a prominent cybersecurity researcher have gotten into a very public and rather personal exchange of unpleasantries about what responsible cybersecurity disclosures should mean in 2026.Â
A cybersecurity researcher going by the name Nightmare Eclipse, who has di...
And then Microsoft busted them all
Someone named “Squid” seems to be a “West Country legend.”
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
The website, which compares human beings to extraterrestrials, touts arrest numbers from the Trump administration’s sweeping immigration crackdown. But some of its details are really out there.
After public outrage, California lawmakers are moving closer to exempting open source operating systems from the sweeping age-bracketing regime mandated by last year’s Digital Age Assurance Act (AB 1043). Nonetheless, the current bill still jeopardizes internet users’ speech, privacy, and security....
USN-8344-1 fixed vulnerabilities in pip. On Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,
and Ubuntu 26.04 LTS the patches for CVE-2025-66471 caused a regression when
using pip. The patches for CVE-2025-66471 have been temporarily reverted
pending investigation.
We apologize for the inconvenience.
Original...
And you thought a face recognition app was intrusive?
Multiple security vulnerabilities were discovered in Twig, a template engine for PHP, which could result in PHP code injection, sandbox bypass or cross-site scripting. For the stable distribution (trixie), these problems have been fixed in version 3.27.0-0+deb13u1.
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. For the oldstable distribution...
Researcher reported the vuln in March. Maintainers haven't responded to his messages since
GREYVIBE, a Russia-linked group active since 2025, targets Ukraine with AI-assisted malware and five attack chains. Researchers say it’s part spy op, part crime gang. Security firm WithSecure has been tracking a previously unknown Russian-linked APT group called GREYVIBE since at least August 2025....
Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. [...]
Zachary Sweeney allegedly traveled to New York, Indiana, Missouri and Georgia to meet and harm numerous victims in person. The FBI began investigating him in 2023.
The post Tennessee man linked to 764 accused of series of crimes against children dating back to 2022 appeared first on CyberScoop.
California Attorney General Rob Bonta filed a lawsuit against 23andMe, now Chrome Holding Co., over the company's failure to protect sensitive customer genetic and personal information. [...]
Cybersecurity researchers have disclosed details of a vulnerability in OpenAI ChatGPT that leverages the artificial intelligence (AI) assistant's implicit trust in Markdown links and images to trigger prompt injections and open the door to phishing attacks.
The technique has been codenamed ChatGPhi...
La Commission nationale de l'informatique et des libertés (CNIL) a rendu public l'ordre du jour de sa séance plénière du 12 mai 2026.
Partie I (avec débats): :
* Présentation de la stratégie nationale de cybersécurité : audition du directeur général de l’ANSSI ;
* Communication relative Ă l...
L'autorité autrichienne de protection des données a reçu plusieurs centaines de notifications de violation de données de la part de photographes et studios photo autrichiens, suite à une cyberattaque visant la société allemande Portraitbox GmbH.Ces photographes et studios photo utilisent les logicie...
A public spat between Microsoft and an independent security researcher reopens a long-running debate over who is responsible for securing software.
La Commission européenne a publié un projet de lignes directrices visant à clarifier la classification des systèmes d'intelligence artificielle (IA) à haut risque en vertu de la loi sur l'IA.Ces orientations sont destinées à aider les fournisseurs, les déployeurs et les autorités de surveillance du...
L'Agence espagnole de protection des données (AEPD) a publié une décision de sanction à l'encontre de CAIXABANK, S.A., comprenant le prononcé d'une amende de 500 000 €, pour des manquements en lien avec la protection des données dès la conception et par défaut. Cette affaire débute par deux plaintes...