> TODAY'S SUMMARY (5 articles)
Today's cyber news highlights several significant threats and developments. Huawei has announced the launch of a fully Chinese-manufactured PC amidst rising geopolitical tensions. Japan has declared an information security emergency, signaling heightened concerns over cyber threats. NVIDIA is facing scrutiny after reports emerged of a suspected Chinese espionage plot targeting CEO Jensen Huang, prompting an independent investigation. Additionally, a hacker has claimed responsibility for stealing data from 22 million French motorists, raising alarms over personal data security. Lastly, the NoName hacking group is reportedly targeting companies such as Free, La Poste Mobile, and Danfoss, with threats of data theft and DDoS attacks.
|
// AI-powered summary generated at 04:00
Most universities have a careers fair. At Bauman Moscow State Technical University, however, an elite group of students appear to have something rather more unusual: a direct pipeline into some of the world's most notorious state-sponsored hacking groups.
Read more in my article on the Hot for Se...
Other noteworthy stories that might have slipped under the radar: US gov targets 72-hour patch cycles, malware uses Windows Phone Link to steal OTPs, spy operation targets Eurasian drone industry.
The post In Other News: Train Hacker Arrested, PamDOORa Linux Backdoor, New CISA Director Frontrunner a...
USN-8248-1 fixed vulnerabilities in NASM. Unfortunately the update
introduced a regression which could cause NASM to crash. This update fixes
the problem by reverting the fix for CVE-2021-33450 and CVE-2021-33452 in
Ubuntu 24.04 LTS.
We apologize for the inconvenience.
Original advisory details:...
A week after Copy Fail, another Linux local privilege escalation vulnerability dubbed “Dirty Frag” has been revealed, along with a PoC exploit. What is Dirty Frag In effect, Dirty Frag refers to two flaws: A xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284, aka Copy Fail 2.0), now patched in...
Nearly 200,000 Zara customers were exposed in a third-party breach linked to ShinyHunters, revealing emails, purchase history, and support data. Personal data belonging to nearly 197,000 Zara customers has been compromised following a cyberattack on a former technology provider used by Inditex, the...
Attackers move faster than overwhelmed SOC teams can realistically investigate alerts. Prophet Security breaks down how AI can help analysts investigate alerts faster and focus on real threats. [...]
Broken disclosure embargo left admins facing a fresh root-level flaw with no CVE
The group that stole data from Instructure users claims that it will release the data of students from nearly 9,000 education institutions around the country.
The post ShinyHunters claims nearly 9,000 schools affected by Canvas data breach appeared first on CyberScoop.
The attack on the Trellix source code repository disclosed last week has been claimed by the RansomHouse threat group, which leaked a small set of images as proof of the intrusion. [...]
Researchers at Moscow-based cybersecurity firm Kaspersky said they identified overlapping infrastructure and tools used by both groups — including command-and-control systems operating on the same compromised host — suggesting some coordination.
Agentic AI is more popular than ever, but researchers keep finding trivial ways to hijack LLMs for nefarious purposes.
The post Flaw in Claude’s Chrome extension allowed ‘any’ other plugin to hijack victims’ AI appeared first on CyberScoop.
Karakurt and DPRK facilitators sentenced, PCPJack worm steals cloud credentials while evicting rivals, and attackers exploit an unpatched PAN-OS zero-day.
A researcher found Edge loads saved passwords into computer memory when it starts, making them easier to steal if a device is already compromised.
After years of insisting end-to-end encryption was the future of online comms, Zuckcorp has handed itself full visibility into user chats once again
CISA has given U.S. federal agencies four days to secure their networks against a high-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM) exploited in zero-day attacks. [...]
Days after the first attack, ShinyHunters is applying pressure with ransom messages on school login portals.
The hackers gained the ability to modify equipment operational parameters, creating a direct risk to the public water supply.
The post Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants appeared first on SecurityWeek.
Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks Ivanti released May security updates for Endpoint Manager Mobile that fix five vulnerabilities, including CVE-2026-6973, a high-severity flaw exploited in targeted attacks. The bug requires admin privileges, but reporting indicates it may be...
Anthropic Claude’s Chrome browser extension, known as Claude in Chrome, has a bug that can allow other malicious extensions to hijack it, compromising trusted AI workflows.
Researchers at LayerX Security have warned that Claude’s overly trusted browser communication flows...
Dirty Frag: unpatched Linux kernel flaw grants root access on Ubuntu, RHEL and Fedora. A working exploit is already public. Security researchers have disclosed a new unpatched vulnerability in the Linux kernel, code-named Dirty Frag, that allows an unprivileged local user to gain full root access on...