> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Verizon’s annual Data Breach Investigations Report uncovered a surge of exploited vulnerabilities, and a growing lack of critical defect remediation industrywide.
The post Attackers hit vulnerabilities hard last year, making exploits the top entry point for breaches appeared first on CyberScoop.
Good news! Discord's hundreds of millions of users now have their communications scrambled, so not even Discord can see them.
Ocean, an agentic email security platform, raised funding from Lightspeed Venture Partners.
For years, civil society organizations, workers, journalists, and human rights experts have warned that major technology companies risk enabling grave human rights abuses when they provide cloud computing, AI, and surveillance infrastructure to governments implicated in violations of international a...
Until a few days ago, a publicly-accessible GitHub repository exposed credentials for both US government AWS accounts and internal Cybersecurity and Infrastructure Security Agency (CISA) systems.
That’s according to cybersecurity reporter Brian Krebs, who first broke the ne...
Multiple security vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols, which may result in execution of arbitrary code, denial of service, information leak, certificate misuse, name constraint bypass, authentication bypass, revocation bypass or timing sid...
Discord announced that all voice and video calls through the communication platform are now protected by default with end-to-end encryption (E2EE). [...]
Several security issues were fixed in the Linux kernel.
Several security issues were fixed in the Linux kernel.
The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs. [...]
Several security issues were fixed in the Linux kernel.
Several security issues were fixed in the Linux kernel.
A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. [...]
Several security issues were fixed in the Linux kernel.
Drupal Is Pushing an Emergency Security Update Tomorrow. If You Run a Drupal Site, This Is Not One to Miss. Something significant is coming out of the Drupal project tomorrow, and the way the announcement is worded should be enough to get any site administrator’s attention. The Drupal Security Team...
Highlight.js could be made to crash if it received specially crafted input.
The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, this time targeting the widely-used AntV enterprise data visualization tool.
Unlike last week’s high-profile npm attack on TanStack, which exploited a c...
There is no evidence that the incident has recurred, but the flaw remains unexplained and has not been publicly acknowledged by the company.
It was discovered that Highlight.js used plain JavaScript objects for
internal language name lookups, making them susceptible to prototype
pollution attacks. An attacker could use this to cause a denial of
service or unexpected application behaviour.
Smarty could be made to run malicious JavaScript in the user's browser if it received specially crafted input.