> TODAY'S SUMMARY (46 articles)
Today's cybersecurity landscape highlights several significant threats and trends. U.S. agencies, including CISA and the FBI, have issued warnings about attacks targeting industrial refrigeration controllers, emphasizing the need for improved security measures. Meanwhile, a data breach at Amplifon Americas has compromised the personal information of 1.3 million individuals, underscoring ongoing vulnerabilities in health data security. In the automotive sector, researchers exploited default credentials in mobile apps to gain unauthorized access to vehicles, raising concerns about IoT device security. Additionally, phishing attacks are on the rise, with Microsoft reporting 7.3 billion threats in Q3 2026. Finally, an exploited vulnerability in SonicWall's SSL-VPN could allow attackers to bypass multi-factor authentication, highlighting the critical need for timely patching and security awareness.
|
// AI-powered summary generated at 12:00
Pillow could be made to crash if it opened a specially crafted file.
ClamAV could be made to crash if it opened a specially crafted HTML file.
A Chinese national posed as a U.S. researcher, tricking NASA staff in a phishing campaign to steal sensitive data tied to defense software and exports. A Chinese national ran a spear-phishing campaign by posing as a U.S. researcher and tricked NASA employees into sharing sensitive information. The N...
Several security issues were fixed in strongSwan.
PackageKit could be made to install packages as the administrator.
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.
Most of it feels like stuff we should have fixed years ago. Bad extensio...
Several security issues were fixed in NTFS-3G.
Dozens of browser extensions openly sell user data via privacy policy disclosures
BrowserGate claims LinkedIn secretly fingerprints users via extensions and device data, sending encrypted results to third parties for tracking. BrowserGate is an investigation conducted by Fairlinked (https://browsergate.eu/), an association of commercial LinkedIn users, which documents what it des...
Hackers are impersonating Microsoft Teams help desk workers to trick victims into installing data-stealing malware, researchers found.
The initial vulnerability was exploited by Russia-linked APT28 in attacks against Ukraine and EU countries.
The post Incomplete Windows Patch Opens Door to Zero-Click Attacks appeared first on SecurityWeek.
Space Force awards 11 firms prototype deals to build orbital interceptors The United States Space Force (USSF) has awarded eleven companies contracts to develop space-based interceptors for President Trump's Golden Dome program, in agreements worth up to $3.2 billion.…
The American technology giant provides water and energy monitoring and utility meters to hundreds of millions of homes and businesses.
​22-year-old Evan Tangeman of Newport Beach, California, was sentenced to 70 months in prison for laundering funds stolen in a massive $230 million cryptocurrency heist. [...]
NIST’s shift toward selective CVE enrichment creates significant visibility gaps for teams relying solely on the National Vulnerability Database. As AI accelerates vulnerability disclosure rates, organizations need independent, high-fidelity intelligence to prioritize risks that the NVD may now over...
Three seconds of audio is all it takes to clone a voice for fraud. Adaptive Security shows how deepfake calls trick employees into sending real money—and why most defenses don't catch them. [...]
Â
The post Scaling Our Vision: Welcoming Tamar Nulman and Omri Arnon to the Legit Team appeared first on Security Boulevard.
An administrative role meant for AI agents within Microsoft’s Entra ID ecosystem could allow privilege escalation and tenant takeover attacks, as it had privileges over more than agent-related objects.
Researchers at Silverfort found that users assigned to Microsoft’s “Agen...
China-sponsored threat groups like Salt Typhoon and Flax Typhoon are increasingly relying on multiple massive botnets comprising edge and IoT devices to run their cyber espionage and network intrusion campaigns, CISA and other security agencies say. The use of such "covert networks" makes it more d...
A code reuse issue enabled comma characters in certificate principals to be interpreted as list separators.
The post OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years appeared first on SecurityWeek.