> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
The vendor hasn’t released a patch for the vulnerability or described the scope and objective of confirmed attacks.
The post A critical Palo Alto PAN-OS zero-day is being exploited in the wild appeared first on CyberScoop.
We have released our latest compliance guide, ISO/IEC 42001:2023 on AWS, which provides practical guidance for organizations designing and operating an Artificial Intelligence Management System (AIMS) using AWS services. As organizations deploy AI and generative AI workloads in the cloud, aligning w...
nghttp2 could be made to crash if it received specially crafted network traffic.
USN-8233-1 fixed a vulnerability in nghttp2. This update provides the
corresponding update for Ubuntu 26.04 LTS.
Original advisory details:
Andrew MacPherson discovered that nghttp2 did not properly validate
internal state when the session termination API was called. A remote
attacker could pos...
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system. [...]
U.S. prosecutors said a ransomware gang fueled Russian government corruption, and allowed the gang's leaders to avoid paying taxes and dodge the country's military draft.
Cuts appear to hit sales, product, and marketing, accounting for under 10% of staff
EditorConfig could be made to crash if it opened a specially crafted file.
Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requires manually rebooting targeted systems for recovery. [...]
Braintrust, a startup that makes an “operating system for engineers building AI software,” notified customers that hackers broke into one of its Amazon cloud environments, and is asking customers to rotate their API keys.
Le piratage confirmé d'un hôtel de luxe d'un groupe français expose passeports, profils clients et accès techniques, révélant une faille majeure dans la promesse de discrétion.
13% say they’ve sold logins or know someone who has, survey suggests
It was discovered that EditorConfig incorrectly handled specially crafted
configuration files. A local attacker could possibly use this issue to
cause EditorConfig to crash, resulting in a denial of service.
The initiative, named CI Fortify, focuses on isolation and recovery efforts that would see critical infrastructure organizations proactively disconnect from third-party dependencies and find ways to operate without reliable telecommunications and internet.
L’autorité italienne de protection des données personnelles (GPDP) a publié une décision de sanction à l’encontre d’Esselunga S.p.A. (comprenant le prononcé d’une amende de 5 000 €) pour des manquements relatifs au droit d’accès aux données personnelles. Cette affaire débute par une plainte déposée...
L'autorité italienne de protection des données (GPDP) a publié une décision de sanction à l'encontre de la commune de Cassino, comprenant le prononcé d'une amende de 2 500 €, pour des manquements en lien avec la publication en ligne de données personnelles, notamment financières, dans une délibérati...
On May 5, 2026, DENIC published broken DNSSEC signatures for the .de TLD, making millions of domains unreachable. Here's what 1.1.1.1 saw, how serve stale cushioned the impact, and how we restored resolution.
L’autorité belge de protection des données (APD) a publié une décision de sanction à l’encontre d’une entreprise employant un technicien, comprenant le prononcé d’une réprimande pour des manquements relatifs au droit d’accès aux données personnelles. Cette affaire débute par une plainte déposée le 2...
La commissaire fédérale à la protection des données et à la liberté d'information (BfDI) rend compte de l’activité de supervision de la protection des données et présente les priorités et constats contenus dans son 34e rapport d’activité.La BfDI signale une hausse notable des demandes en 2025 : 11.8...
An Iranian state-sponsored espionage group is pretending to be a regular ransomware gang in a new wave of ransomware attacks targeting enterprises.
APT group MuddyWater (aka Seedworm) is masquerading as the Chaos ransomware-as-a-service group to confuse incident response an...