> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
It was discovered that PyJWT, a Python implementation of JSON web tokens insufficiently validated the "crit" header parameter, which could result in incomplete enforcement of authentication settings. For the oldstable distribution (bookworm), this problem has been fixed in version 2.6.0-1+deb12u1.
Plus: Meta officially kills encrypted Instagram DMs, the Trump administration targets “violent left wing extremists,” leaked documents reveal Russia's school for elite hackers, and more.
Braintrust warned customers to rotate API keys after hackers breached an AWS account, exposing secrets tied to cloud-based AI models. AI observability startup Braintrust warned customers to rotate API keys after attackers gained unauthorized access to one of the company’s AWS accounts, potentially e...
Two vulnerabilities have been discovered in the Linux kernel that may lead to local privilege escalation. For the oldstable distribution (bookworm), these problems have been fixed in version 6.1.170-3. We recommend that you upgrade your linux packages.
cPanel has released updates to address three vulnerabilities in cPanel and Web Host Manager (WHM) that could be exploited to achieve privilege escalation, code execution, and denial-of-service.
The list of vulnerabilities is as follows -
CVE-2026-29201 (CVSS score: 4.3) - An insufficient input vali...
La société d'orfèvrerie Unoaerre a été victime d'une cyberattaque qui a paralysé son système d'exploitation, ce qui a conduit les cybercriminels à exiger une rançon de 3,8 millions d'euros en bitcoins. Les premières enquêtes suggèrent que cette attaque pourrait avoir des liens avec des pays du Moyen...
La société Matsuzawa Shoten a présenté ses excuses à ses partenaires commerciaux pour les désagréments causés par la panne de son système de gestion des commandes, survenue le 9 mai à la suite d'un accès non autorisé et d'une infection par un rançongiciel. Les travaux de restauration du système de c...
Following criticism, lawmakers have narrowed the GUARD Act, a bill aimed at restricting minors’ access to certain AI systems. The earlier version could have applied broadly to nearly every AI-powered chatbot or search tool. The amended bill focuses more narrowly on so-called “AI companions”—conversa...
Evidence of them has been found by analyzing DNA in the seawater.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
The five new vulnerabilities discovered in Ivanti’s on-premises mobile endpoint management solution are a “classic example of the legacy trap” that CSOs must avoid, says an expert.
“Patch today to survive the weekend,” said Robert Enderle of the Enderle Group, “but start pl...
RansomHouse claimed responsibility for the Trellix breach, adding the security firm to its Tor data leak site and sharing screenshots of internal systems. The RansomHouse ransomware group has claimed responsibility for the recent cyberattack on cybersecurity firm Trellix. To support its claims, the...
The settlement, announced by California officials Friday, is the largest fine issued under the California Consumer Privacy Act (CCPA) in its more than five-year history.
Slovakian national Alan Bill, 33, pleaded guilty in January to a conspiracy to distribute controlled substances charge after admitting to his role in running Kingdom Market — a platform used by drug dealers and cybercriminals between March 2021 and December 2023.
A cross-site scripting vulnerability was discovered in Postorius, the administrative web frontend for Mailman 3. For the oldstable distribution (bookworm), this problem has been fixed in version 1.3.8-3+deb12u1. For the stable distribution (trixie), this problem has been fixed in
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, SQL injection, cross-site scripting, information disclosure or the execution of arbitrary code. For the stable distribution (trixie), these problems have...
L'Autorité de protection des données (APD) a publié une décision de sanction à l'encontre d'un cabinet d’avocats, comprenant le prononcé d'une amende de 4 920 €, pour des manquements en lien avec l'obligation d'information et le respect du droit d'accès des personnes concernées. Cette affaire débute...
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, SQL injection, cross-site scripting or the execution of arbitrary code. For the oldstable distribution (bookworm), these problems have been fixed
L'autorité irlandaise de protection des données (DPC) a publié une décision de sanction à l'encontre de Permanent TSB (PTSB), comprenant le prononcé d'une amende de 277 500 €, pour des manquements liés à la sécurité des données et à la notification de violations. Cette affaire fait suite à une enquê...
L'Autorité hellénique de protection des données a émis un avis défavorable sur un projet de loi du Ministère de l'Intérieur (ΥΠΕΣ) visant à instaurer un système de contrôle de présence et d'accès par données biométriques pour les agents du secteur public.Le projet de disposition prévoyait l'utilisat...
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For the oldstable distribution (bookworm), these problems have been fixed in version 140.10.2esr-1~deb12u1.