> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026Â ) for more information.
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
It was discovered that OpenJPEG did not properly handle memory when
encoding image files. An attacker could use this issue to cause OpenJPEG to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.
The men’s separate schemes impacted almost 70 U.S. companies and generated a combined $1.2 million in revenue for the North Korean regime.
The post American duo sentenced for hosting laptop farms for North Korean IT workers appeared first on CyberScoop.
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
The hardest part of cybersecurity isn't the technology, it’s the people.
Every major breach you’ve read about lately usually starts the same way: one employee, one clever email, and one "Patient Zero" infection.
In 2026, hackers are using AI to make these "first clicks" nearly impossible to spot. If...
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.
20-year-old California resident Marlon Ferro, known online as “GothFerrari,” was sentenced to 78 months in prison for his role in a cryptocurrency theft operation tied to more than $250 million in stolen digital assets. Federal prosecutors said Ferro participated in a criminal network active between...
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.
Cisco’s AI security researchers have analyzed ways to target vision-language models (VLMs) using pixel-level perturbation.
The post Attackers Could Exploit AI Vision Models Using Imperceptible Image Changes appeared first on SecurityWeek.
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.
Two U.S. nationals were sentenced to 18 months in prison each for operating so-called laptop farms that helped North Korean IT workers fraudulently obtain remote employment at nearly 70 American companies. [...]
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026Â ) for more information.
Claude AI Guided Hackers Toward OT Assets During Water Utility Intrusion Dragos reported that attackers used Claude and GPT models during an intrusion into a municipal water and drainage utility in Monterrey, Mexico. The AI tools helped the actor plan activity, build tooling, process victim data, an...