> TODAY'S SUMMARY (22 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Fireworks AI has reported a breach stemming from a third-party cloud hack, emphasizing the risks associated with relying on external providers. France has attributed a cyberattack that affected supermarket refrigeration systems to Iranian operatives, signaling geopolitical tensions in cyberspace. Meanwhile, CISA has warned of active exploitation of multiple security flaws in key software, including OpenSSH and IBM products. Additionally, N-able has taken its N-central Cloud offline after the disclosure of 33 zero-day vulnerabilities. On the consumer side, a data breach at Iris Ohyama may expose personal information of 7.7 million individuals. Lastly, Google has issued a security update for Chrome, addressing the eighth actively exploited zero-day this year.
|
// AI-powered summary generated at 08:00
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
CRPx0 is a complex, stealthy malware campaign that targets macOS and Windows systems, and appears to have Linux capabilities in development.
The post Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware appeared first on SecurityWeek.
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
General Motors has agreed to a $12.75 million settlement with California over allegations that it unlawfully sold drivers’ location and behavioral data to brokers, marking the largest penalty in the history of the state’s Consumer Privacy Act. Prosecutors say GM made approximately $20 million nation...
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
The maker of the Canvas school software said it "reached an agreement" with the hackers, but provided no guarantees that the hackers would not release the data or keep their word.
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.
Even with strong passwords and MFA, breaches still happen. See the hidden gaps, common risks, and how to close them effectively.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
Double free in Windows Rich Text Edit Control allows an authorized attacker to elevate privileges locally.
The company that operates online learning system Canvas said it struck a deal with hackers to delete the data they pilfered in a cyberattack that created chaos for students, many of them in the middle of finals.
The post Deal Reached With Hackers to Delete Data Stolen From the Canvas Educational Pla...
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
Learn how to build phishing awareness training that helps employees recognize attacks, report them quickly, and reduce risk in your organization.
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
This vulnerability was found and addressed by AMD. We are documenting it in the Security Update Guide to encourage customers to install the May 2026 version of Windows as soon as possible.
The vulnerability assigned to this CVE is in certain processor models offered by AMD. The mitigation for this...