> TODAY'S SUMMARY (119 articles)
Today's cybersecurity landscape highlights several critical issues and ongoing threats. Siemens has issued 17 advisories for industrial control systems, while Rockwell has patched a vulnerability in their ArmorBlock devices. Microsoft has set a new record by addressing 1,413 vulnerabilities in its latest Patch Tuesday, including zero-days actively exploited. There is an urgent call from U.S. senators for improved federal AI safety and security measures, as AI systems increasingly become targets for exploitation. A recent cyberattack in France compromised IoT-connected fridges, raising alarms about the vulnerabilities of connected devices. Additionally, the U.S. has intensified efforts against North Korean hackers exploiting remote work setups, culminating in arrests tied to laptop farms. Overall, the surge in vulnerabilities and attacks underscores the need for proactive security measures across industries.
|
// AI-powered summary generated at 16:00
Maik Schaefer discovered that a TOCTOU race condition in PackageKit (a package management service over a DBus interface) could result in local privilege escalation. For the oldstable distribution (bookworm), this problem has been fixed in version 1.2.6-5+deb12u1.
Microsoft is preparing to roll out a new Efficiency Mode for Microsoft Teams for systems with limited CPU and memory resources to improve app responsiveness. [...]
A group of unauthorized users reportedly has gained access to Anthropic’s controversial Claude Mythos Preview AI frontier model despite the AI vendor’s efforts to keep it out of public hands by limiting the organizations that can use it. Bloomberg reported that the unnamed group had tried multiple...
Apple Intelligence flaw kept stolen tokens reusable on another device Researchers say Apple Intelligence’s token design let attackers steal and replay credentials across devices, turning what should have been device-bound access into reusable bearer tokens. The reported impact goes beyond token thef...
Dubbed Lotus Wiper, the malware targets recovery mechanisms, overwrites drives, and systematically deletes files.
The post New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention appeared first on SecurityWeek.
Along with a bunch of new services to make sure those same agents don't cause chaos Google Cloud chief operating officer Francis deSouza has summed up his company's security strategy du jour as follows: "You need to use AI to fight AI."…
SilentGlass, a plug-and-play device, actively blocks any unexpected or malicious HDMI and Display Port connections.
Every secure API draws a line between code and data. HTTP separates headers from bodies. SQL has prepared statements. Even email distinguishes the envelope from the message. The Model Context Protocol (MCP), the fast-growing standard for connecting AI agents to external services, inherits that gap f...
A security researcher claims Claude Desktop installed spyware on his Mac. We examine the findings.
The exploitation of the command injection vulnerability started one year after public disclosure and PoC exploit code publication.
The post Mirai Botnet Targets Flaw in Discontinued D-Link Routers appeared first on SecurityWeek.
As I have been preparing slides for my coming talk at foss-north on April 28, 2026 I figured I could take the opportunity and share a glimpse of the current reality here on my blog. The high quality chaos era, as I call it. No more AI slop I complained and I complained about the … Continue reading H...
Cyber crooks are abusing a trojanized Android payment application to steal near field communication (NFC) data and PINs, enabling cloning of payment cards and draining victim accounts.
According to ESET researchers, a new variant of the NGate malware has been infused into t...
Researcher says the missing piece is a governance-driven intelligence layer that turns SBOM and VEX data into explainable security decisions.
The post Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data appeared first on SecurityWeek.
Gov admits 'incident' as forum sellers boast of fresh haul covering up to a third of the population France's National Agency for "Secure" Documents is explaining a potential data spill just as crooks online claim they've nicked a third of the country's ID information.…
Progress Software has fixed a slew of high-severity vulnerabilities in MOVEit WAF and LoadMaster, including a flaw (CVE-2026-21876) that may allow attackers to bypass firewall detection. MOVEit WAF (web application firewall) is designed to protect Progress’s managed file transfer platform MOVEit Tra...
All the flaws could have also been found by an elite human researcher, according to Mozilla.
The post Claude Mythos Finds 271 Firefox Vulnerabilities appeared first on SecurityWeek.
Judges say cops face-slurping not a problem under current human rights laws London's Metropolitan Police Service (MPS) has survived a legal challenge that attempted to curb its rollout of live facial recognition (LFR) technology across the capital.…
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, spoofing, information disclosure or privilege escalation. For the oldstable distribution (bookworm), these problems have been fixed in version 140.10.0esr-1...
ICE has admitted that it uses spyware from the Israeli company Graphite.
A former ransomware negotiator has pleaded guilty to abusing his position by working with noted cybercrime group BlackCat