> TODAY'S SUMMARY (6 articles)
Today’s cybersecurity landscape highlights several key developments and threats. Michael LoSapio has been nominated to lead the Cybersecurity and Infrastructure Security Agency (CISA), a move that may encounter political challenges. SonicWall has issued urgent patches for seven vulnerabilities in its firewalls, with five allowing unauthenticated remote access—an indication of increasing risks to network security. Meanwhile, Microsoft’s email security filters are mistakenly blocking legitimate business communications, raising concerns about the reliability of automated security measures. Lastly, Anthropic's advanced bug-finding tool, Mythos, will be integrated into Cisco and IBM products, enhancing enterprise security capabilities without exposing the underlying model. Overall, these updates reflect ongoing vulnerabilities and the need for robust cybersecurity measures in both enterprise and governmental contexts.
|
// AI-powered summary generated at 04:00
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, bypass of the same-origin policy, privilege escalation, information disclosure, spoofing or sandbox escape. For the oldstable distribution (bookworm), these...
It was discovered that Bubblewrap incorrectly handled the sandbox
setup phase when installed in setuid mode. A local attacker could
possibly use this issue to bypass sandbox restrictions.
It was discovered that XDG Desktop Portal incorrectly handled
trashing files. A local attacker could possibly use this issue to
delete arbitrary files on the host file system via a symlink attack.
Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across GitHub, AWS, Kubernetes, Vault, npm, and 1Password platforms.
The post Mini Shai Hulud: Compromise...
Our largest security services customers started the same way every customer does – with a click. They enabled Amazon GuardDuty, Amazon Inspector, AWS WAF, and AWS Security Hub, experienced the benefits in real time, and evaluated with transparent pay-as-you-go pricing. No RFP. No six-month evaluatio...
The law mandates that platforms make it easy for people to ask that nonconsensual intimate images be removed and to delete them within 48 hours of a request.
L'autorité de protection des données estonienne (AKI) a publié une décision de sanction à l'encontre de deux personnes, comprenant le prononcé d'une amende de 2 000 € pour chacune, pour des manquements en lien avec la diffusion de photographies intimes sans le consentement des personnes concernées s...
L'autorité croate de protection des données (AZOP) a publié une foire aux questions détaillant les modalités de création, d'approbation et de suivi des codes de conduite prévus par le RGPD.L'autorité invite les associations et organismes représentant des catégories de responsables de traitement ou d...
Microsoft has unveiled two new open-source tools called RAMPART and Clarity to assist developers in better testing the security of artificial intelligence (AI) agents.
RAMPART, short for Risk Assessment and Measurement Platform for Agentic Red Teaming, functions as a Pytest-native safety and securi...
L'autorité croate de protection des données (AZOP) a publié une décision détaillant les exigences pour l'accréditation des organismes chargés de surveiller les codes de conduite.Fondée sur l'article 41 du RGPD et les lignes directrices du Comité européen de la protection des données (CEPD), cette dé...
L'autorité britannique de protection des données (ICO) a infligé une amende de 160 000 £ (soit 185 067 € environ) à une société du secteur de l'énergie pour avoir effectué plus de 700 000 appels de démarchage commercial non sollicités.La société Energy Prices Direct Limited (EPDL) a réalisé ces appe...
AI conversations are becoming critical evidence in digital investigations — GMDSOFT’s latest Tech Letter explores how MD-NEXT and MD-RED recover and interpret ChatGPT artifacts on Android devices.
L'autoritĂ© tchèque de protection des donnĂ©es (Úřad pro ochranu osobnĂch ĂşdajĹŻ - UOOU) a communiquĂ© sa position sur le traitement de donnĂ©es biomĂ©triques par des systèmes de vidĂ©osurveillance visant Ă interdire l'accès aux stades de football Ă des personnes indĂ©sirables.L'autoritĂ© distingue la vidĂ©os...
The investigation began after U.S. authorities informed their Ukrainian counterparts that hackers operating from Ukraine could be involved in attacks targeting users of American e-commerce platforms, Ukraine's Prosecutor General said.
The move comes as other major social media platforms are killing end-to-end encryption for messaging. In recent months, Instagram and TikTok both announced they will no longer offer the feature.
Attorney John Scola is representing a police officer who is suing over injuries allegedly sustained while working security at an MSG property in 2025.
The breach notification letters say 7-Eleven discovered the breach on April 8 and, after an investigation, determined that the cybercriminals gained access to “certain 7-Eleven systems used to store franchisee documents.”
Read about the unique challenges and rewards of securing gaming platforms and how to better protect gaming communities.
The post Securing the gaming culture of cultures appeared first on Microsoft Security Blog.
Microsoft’s GitHub has suffered what appears to be its biggest ever security breach after confirming that attackers exfiltrated code from around 3,800 of the company’s internal repositories.
News of the incident first emerged on May 19, when GitHub said it was investigating...
The Grafana data breach was caused by a single GitHub workflow token that slipped through the rotation process following the TanStack npm supply-chain attack last week. [...]