> TODAY'S SUMMARY (6 articles)
Today’s cybersecurity landscape highlights several key developments and threats. Michael LoSapio has been nominated to lead the Cybersecurity and Infrastructure Security Agency (CISA), a move that may encounter political challenges. SonicWall has issued urgent patches for seven vulnerabilities in its firewalls, with five allowing unauthenticated remote access—an indication of increasing risks to network security. Meanwhile, Microsoft’s email security filters are mistakenly blocking legitimate business communications, raising concerns about the reliability of automated security measures. Lastly, Anthropic's advanced bug-finding tool, Mythos, will be integrated into Cisco and IBM products, enhancing enterprise security capabilities without exposing the underlying model. Overall, these updates reflect ongoing vulnerabilities and the need for robust cybersecurity measures in both enterprise and governmental contexts.
|
// AI-powered summary generated at 04:00
GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2.2 million installs. A malicious version of the otherwise benign extension was used to steal secrets and developer c...
Recently, Rob wrote about a tool, Proxifier, that can intercept requests from specific processes. Proxifier is available for Windows, macOS, and Android. But I have not seen a generic Linux option yet. The advantage of a tool like Proxifier is the ability to target specific software. For debugging,...
Cisco fixed a critical Secure Workload flaw (CVE-2026-20223) that could let attackers gain Site Admin privileges through crafted API requests. Cisco released patches for a critical vulnerability, tracked as CVE-2026-20223 (CVSS score of 10.0), in Secure Workload. The flaw stems from insufficient val...
McDonald’s France touché par des fraudes McDo+ : les cartes fidélité deviennent une cible cyber rentable à la suite d'une fuite de données.
A virtual private network service called 'First VPN,' used in ransomware and data theft attacks, has been taken offline in a joint international law enforcement operation. [...]
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SMB network file system;
- Netfilter;
- io_uring subsystem;
(CVE-2024-35862, CVE-2024-50060, CVE-2026-23274, CVE...
AI risks threaten to permeate supply chains through unvetted code and unaudited suppliers
Detego Global has partnered with the National Foundation for Retired Service Animals to support the care and well-being of retired service animals who have spent their lives protecting our communities.
Leakage blamed on treacherous friends exposed unencrypted credentials, email addresses
Insufficient validation and authentication in the Secure Workload’s REST APIs provide remote attackers with Site Admin privileges.
The post Cisco Patches Critical Vulnerability in Secure Workload appeared first on SecurityWeek.
Qualys finds nine-year-old Linux ptrace flaw exposing SSH keys and password hashes locally
Le célèbre Flipper Zero a un successeur : le Flipper One. Il a des fonctions en plus, mais aussi des modules en moins. Voici l'essentiel à savoir.
Le post Flipper One : découvrez la fiche technique et les surprises du successeur du Flipper Zero a été publié sur IT-Connect.
It was discovered that evince, a simple multi-page document viewer, is prone to a command injection vulnerability if a specially crafted PDF file is opened. For the oldstable distribution (bookworm), this problem has been fixed in version 43.1-2+deb12u1.
This week starts small.
A token leaks. A bad package slips in. A login trick works. An old tool shows up again. At first, it feels like the usual mess. Then you see the pattern: attackers are not always breaking in. They are using the parts we already trust.
That is what makes it worrying. The dan...
Proton Pass access tokens let you share credentials with AI agents securely. Granular permissions, time limits, and full audit logs. You stay in control.
The company has developed a platform that uses specialized AI agents to inspect every incoming message.
The post Ocean Emerges From Stealth With $28M for Agentic Email Security Platform appeared first on SecurityWeek.
The loophole allows spammers and scammers to send emails from a legitimate Microsoft email address typically used for sending genuine account alerts.
First VPN démantelé : 33 serveurs saisis, plus de 5000 comptes liés à des enquêtes cyber.
Switchzilla says attackers could access sensitive data and make configuration changes across tenant boundaries through vulnerable internal APIs
It was discovered that Path-to-Regexp incorrectly handled route patterns
containing multiple named parameters separated by non-delimiter characters
such as hyphens. An attacker could possibly use this issue to cause a denial
of service via catastrophic backtracking in the generated regular expressio...