> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Key methods for cutting off AI access to an organization’s core IT assets.
The attacks are part of a wider campaign known as Mini Shai-Hulud, which has already compromised several open source projects and, in turn, developers and companies that use them.
Another malware wave is washing through open-source software repos, stealing publishing tokens, installing OS‑level backdoors and persisting in developer tools and CI pipelines.
The post Mini Shai-Hulud returns, compromising hundreds of npm packages appeared first on CyberScoop.
Faced with the growing volume of submission to its bug bounty program, GitHub is replacing cash bounties with swag rewards for reports with low security impact — and asking researchers to stop submitting reports that are low quality or about things that aren’t its fault.
Th...
Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code, including ransomware.
The post Exposing Fox Tempest: A malware-signing service...
The federal cybersecurity agency left plaintext passwords in a spreadsheet uploaded to a public GitHub repository, per a report by independent journalist Brian Krebs.
“We will launch during a dynamic political environment where many civil society groups that we would expect to attack us would have their resources focused on other concerns.”-Meta Internal Document on face recognition software for smart glasses, 2025
It’s unsurprising that a company would plan to r...
Microsoft’s Digital Crimes Unit has taken down the infrastructure of Fox Tempest, a prolific cybercrime-enabling threat group
Fox Tempest, a financially-motivated threat group, allowed ransomware operators and other cybercriminals to slip malware-laced software past security controls.
The post Microsoft disrupts cybercrime service that abused software verification systems en masse appeared first on CyberScoop.
Proof-of-concept (PoC) exploit code has now been released for a recently patched security flaw in the Linux kernel that could allow for local privilege escalation (LPE).
Dubbed DirtyDecrypt (aka DirtyCBC), the vulnerability was discovered and reported by the Zellic and V12 security team on May 9, 20...
État d’avancement au 1er mai 2026 Préambule : deux textes distincts, une logique commune Il faut d’emblée distinguer les deux propositions publiées simultanément le 19 novembre 2025 par la Commission européenne, souvent confondues sous le terme générique « Omnibus numérique » : Le premier texte est...
Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a new Shai-Hulud supply-chain campaign. [...]
Convenience store chain giant 7-Eleven confirmed that its systems were breached in a cyberattack claimed by the ShinyHunters extortion group last month. [...]
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices.
We are issuing this CVE to provide mitigation guidance that can be impl...
Microsoft's total vulnerability count stayed steady in 2025, but critical flaws surged year over year. BeyondTrust breaks down why attackers are increasingly focused on privilege escalation and identity abuse. [...]
Stuart Hutchinson, VP of Sales at ADF Solutions, discusses on-scene digital forensics and empowering first responders during the golden hour of an investigation.
Prompt for Agentic AI Security empowers organizations with proactive governance, meaning security teams can deploy agents with confidence.
A phishing campaign is smuggling the powerful PureLogs information stealer onto targets’ Windows machines by hiding encrypted malicious payloads inside cat photos, Fortinet researchers discovered. The attack The attack starts with a phishing email containing a TXZ archive and using an invoice-themed...
Nx Console VS Code Extension Compromised A compromised version of the Nx Console VS Code extension, version 18.95.0, was briefly published with malicious code targeting developer credentials, cloud tokens, CI/CD secrets, Kubernetes credentials, 1Password data, and AI coding assistant configuration f...
Selector has announced the expansion of its platform with AI-powered multi-cloud observability capabilities. The extension of Selector’s AI-driven observability approach into multi-cloud environments enables organizations to correlate signals across the full hybrid path. By unifying rich telemetry d...