> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape reveals several significant threats and trends. The newly identified "sshole" vulnerability (CVE-2026-123158) is leading to an uptick in exploitation attempts, particularly observed through honeypot data. Additionally, a major data breach at Japanese manufacturer Iris Ohyama has compromised the personal information of approximately 7.7 million customers. On the malware front, an unknown advanced persistent threat (APT) is utilizing NetamLoader to target Windows 10 systems. In a notable incident, attackers exploited a third-party service provider to steal up to $133 million from French Bank Crédit Mutuel Arkéa. Meanwhile, law enforcement has arrested three suspects linked to the DataSuckers hacking group, which previously targeted Dodo Pizza. The evolving role of AI in cybersecurity continues to be highlighted as companies seek to bolster defenses against these increasing threats.
|
// AI-powered summary generated at 16:00
The FBI is warning of fake websites impersonating FIFA ahead of the 2026 World Cup, to steal personal and financial information, sell fake tickets and hospitality packages, and push other fraud related to the event. [...]
A new hacking campaign is trying to trick Signal users to give up their secret recovery key, which can be used to access online backups containing past messages.
Network administrators face a persistent challenge: maintaining domain blocklists and allowlists that keep pace with the internet. New websites and services emerge daily, and keeping these lists current requires constant manual updates that leave gaps in coverage. This challenge intensifies when man...
It’s part of a series of examinations at the House Homeland Security Committee that now will include a public event.
The post House panel poised to hold hearing centered on AI impact on cyber appeared first on CyberScoop.
Researchers warn GreyVibe’s extensive use of ChatGPT, Gemini, and other AI tools offers a glimpse into how future cybercriminal and state-aligned groups will operate.
The post Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks appeared first on SecurityWeek.
USN-8229-1 fixed a vulnerability in sed. This update provides the
corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Original advisory details:
Michał Majchrowicz and Marcin Wyczechowski discovered that sed
incorrectly handled symbolic links when performing in-place edits.
A local...
It was discovered that Vim did not properly handle backticks in tag
filenames. An attacker could possibly use this issue to execute
arbitrary commands.
Michele Spagnuolo allegedly placed multiple trades on the prediction marketplace, abusing internal access to Google’s nonpublic data on the most searched people in 2025.
The post Google security engineer accused of turning confidential search trends into $1.2M win on Polymarket appeared first on Cyb...
In this newsletter, Thor breaks down why you should stop relying solely on CVSS and start using EPSS and GCVE to focus your patching efforts on the threats that actually matter.
Pay Tel secured the publicly exposed data after security researchers discovered the leak containing callers' sensitive ID documents and inmate communications.
It was discovered that multipart had an ambiguous regular expression
alternation when handling certain HTTP header values. A remote attacker
could possibly use this issue to cause multipart to use excessive
resources, leading to a denial of service.
Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ. [...]
A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions.
The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifie...
The funding round was led by Balderton Capital, with additional support from Crosspoint Capital and previous investors General Catalyst and Ten Eleven Ventures.
The post Geordie Raises $30 Million for AI Security and Governance Platform appeared first on SecurityWeek.
L'Agence espagnole de protection des données (AEPD) a saisi le Comité européen de la protection des données (CEPD) au sujet d'une étude sur l'accès potentiel de tiers aux conversations des utilisateurs de systèmes d'intelligence artificielle.L'AEPD a transmis une note d'information au CEPD, basée su...
L'autorité française de protection des données (CNIL) a publié une décision de sanction à l'encontre de la société IQVIA OPERATIONS FRANCE, comprenant le prononcé d'une amende de 5 000 000 €, pour des manquements en lien avec la gestion d'entrepôts de données de santé. Cette affaire débute par plusi...
The US military has long known that cheap fixes could stop location data from exposing its troops. It adopted almost none—and now says adversaries are using the data to target soldiers during a war.
L'autorité italienne de protection des données (GPDP) a adressé un avertissement à une jeune pousse italienne au sujet d'un composant logiciel additionnel analysant les émotions des employés par intelligence artificielle.Suite à des articles de presse, l'autorité a examiné un outil développé pour le...
La Commission Nationale de l'Informatique et des Libertés (CNIL) a publié des orientations pour aider les acteurs de l'informatique en nuage à déterminer leurs qualifications respectives de responsable du traitement, sous-traitant ou responsable conjoint au sens du RGPD.Ces orientations, basées sur...
In the rush to block young people from certain parts of the internet, lawmakers are creating a privacy and security nightmare for everyone. This scenario is already playing out globally. Help us stop it and keep the web open and accessible for all.
JOIN EFF
Protect the web for everyone
Even with the...