> TODAY'S SUMMARY (16 articles)
Today's cybersecurity landscape highlights significant threats, notably the FBI's attribution of the record $6.3 billion Binance crypto heist to North Korean hackers, known as TraderTraitor. This breach underscores the ongoing risk posed by state-sponsored cybercriminals in the cryptocurrency sector. Additionally, a new vulnerability in Android, dubbed "SMS of Death," allows attackers to crash call services through a hidden message, posing a severe risk to users. In other news, hackers exploited a critical flaw in Canonical's LXD, enabling unauthorized logins as trusted clients. Furthermore, malicious code on Polymarket's website led to the theft of approximately $2.7 million from traders, showcasing vulnerabilities in online platforms. Lastly, a sophisticated malware campaign targeting government systems in Asia has been identified, underscoring the evolving nature of cyber threats.
|
// AI-powered summary generated at 20:00
Threat actors are reusing Tycoon 2FA tools across other phishing kits following the platform’s disruption.
The post Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks appeared first on SecurityWeek.
Plus: Major data breaches at a gym chain and hotel giant, a disruptive DDoS attack against Bluesky, dubious ICE hires, and more.
A Mirai variant called Nexcorium exploits a flaw in TBK DVRs to infect devices and use them in DDoS attacks, along with outdated TP-Link routers. Fortinet researchers found that threat actors are exploiting vulnerabilities in TBK DVRs and end-of-life TP-Link routers to spread a Mirai variant called...
In boardroom discussions, data breaches are typically evaluated through the lens of financial impact, regulatory exposure, and operational disruption. While these factors are critical, they often overshadow a more fundamental concern: the consumer. Every piece of personal data collected by an organi...
Grinex, a Kyrgyzstan-incorporated cryptocurrency exchange sanctioned by the U.K. and the U.S. last year, said it's suspending operations after it blamed Western intelligence agencies for a $13.74 million hack.
The exchange said it fell victim to what it described as a large-scale cyber attack that b...
Attackers exploit three Microsoft Defender zero-days, code-named BlueHammer, RedSun, and UnDefend, to gain elevated access. Attackers are exploiting three recently disclosed zero-day flaws in Microsoft Defender to gain higher privileges on compromised systems. The vulnerabilities, called BlueHammer,...
Threat actors are exploiting security flaws in TBK DVR and end‑of‑life (EoL) TP-Link Wi-Fi routers to deploy Mirai-botnet variants on compromised devices, according to findings from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42.
The attack targeting TBK DVR devices has been found to exploi...
L'Hôpital Privé Ahmed Al-Kadi de Durban a confirmé avoir été victime d'une attaque par rançongiciel, suite à un accès non autorisé à ses systèmes informatiques le 18 avril. Bien que les soins aux patients n'aient pas été impactés, l'établissement a alerté le public et les autorités concernant cette...
Le groupe de ransomware CMD Organization a ciblé le fournisseur d'hôtellerie Goodstone Group, basé en Tasmanie, et a divulgué des documents compromettant des données sensibles telles que des scans de passeports d'employés. L'entreprise a confirmé avoir été victime d'une cyberattaque le 18 avril 2026...
Belgium's NIS2 conformity assessment deadline hits April 18, 2026, and other EU member states are ramping enforcement close behind. See what auditors will demand from your SOC: incident reporting timelines, Article 20 management liability, and automatic documentation.
The post Belgium’s NIS2 Audit W...
Le 18 avril 2026, le système informatique de la WG Neukölln a été visé par une cyberattaque par rançongiciel au cours de laquelle des données ont été chiffrées et copiées, notamment des documents relatifs à ses membres et partenaires commerciaux, les attaquants menaçant de les publier. Cette intrusi...
Maintainers of Thymeleaf, a widely used template engine for Java web applications, fixed a rare critical vulnerability that allows unauthenticated attackers to execute malicious code on servers.
The vulnerability, tracked as CVE-2026-40478, is rated 9.1 on the CVSS severity...
In this post, we explore how ChatGPT generated an adversarial image that hijacked my Claude Opus 4.7 to invoke the memory tool and persist false memories for future chats.
This matters because Opus 4.6+ is genuinely a lot harder to attack than previous models, but it still fell for a ChatGPT genera...
Two security issues were discovered in Luanti, a multiplayer infinite-world block sandbox game, which could result in incomplete restrictions for installed mods or sandbox escape. For the stable distribution (trixie), these problems have been fixed in version 5.10.0+dfsg-5+deb13u1.
Andrew Nesbitt discovered that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. This could result in directory traversal out of the package area. For the oldstable distribution (bookworm), this problem has been fixed in version 2.1.2-1+deb12u1.
TL;DR Grinex, the sanctioned successor to the Russian exchange Garantex, suspended operations yesterday following a claimed 1 billion ruble ($13.7…
The post Sanctioned Russia-Linked Exchange Grinex Suspends Operations Following Alleged Cyberattack appeared first on Chainalysis.
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed PSP, JPEG 2000, PSD or ANI files are opened. For the oldstable distribution (bookworm), these problems have been fi...
Pretty fantastic video from Japan of a giant squid eating another squid.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
Cisco admins are scrambling to patch a critical flash memory overflow vulnerability in over 200 Cisco Systems IOS XE-based models of wireless access points (APs), caused by a recent flawed software update.
If the issue is not corrected quickly, the AP’s memory will become s...
Nicholas Moore hacked into three U.S. government networks using stolen credentials, and then bragged about it and posted victims' personal data on Instagram under the handle @ihackedthegovernment.