> TODAY'S SUMMARY (4 articles)
Today's cybersecurity highlights include a significant data breach involving СберСпасибо, with 3,288,711 accounts compromised. Microsoft has issued its November 2026 Patch Tuesday update, addressing 1,328 vulnerabilities, including 60 rated as critical, emphasizing the need for urgent patching. Additionally, a critical remote code execution vulnerability has been identified in Ruflo MCP Bridge version 3.16.2, posing serious risks to affected systems. Organizations are advised to prioritize updates and monitor for potential exploitation of these vulnerabilities. Overall, the cybersecurity landscape remains fraught with threats, underscoring the importance of robust security measures.
|
// AI-powered summary generated at 04:00
The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects. [...]
Researchers said it’s the first-ever mapping of attack traffic to mobile operator signalling infrastructure.
The post Surveillance campaigns use commercial surveillance tools to exploit long-known telecom vulnerabilities appeared first on CyberScoop.
CISA said the unnamed department was infected with malware called “FIRESTARTER” that allowed the hackers to return to the Cisco device in March without re-exploiting the original vulnerabilities.
TL;DR On April 18, 2026, attackers linked to North Korea’s Lazarus Group stole ~$292 million (116,500 rsETH) from KelpDAO’s LayerZero…
The post Inside the KelpDAO Bridge Exploit: How ~$292 Million in rsETH Was Released Against a Non-Existent Burn appeared first on Chainalysis.
Author, Creator & Presenter: Andrew Bullen, AI Security Lead At Stripe
Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations' YouTube Channel.
Permalink
The post [un]prompted 2026 –...
Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster and more efficiently. [...]
When Anthropic unveiled Mythos and Project Glasswing, the reaction was immediate and polarized. Some dismissed it as fear-driven marketing, while others treated it as a credible shift in the threat landscape. Like with many things, the truth is probably somewhere in the middle. I wanted to test that...
The campaigns exploited a weakness in telecom infrastructure to allow the unnamed vendors to secretly pose as real cellular providers and pinpoint victims’ locations.
I had a few conversations over the past days that all pointed to the same conclusion: many technology companies are still being built like old SaaS companies. That is a mistake. If you are building a technology product now, the priority is not a polished frontend. It is the backend: the data layer,...
GitGuardian analysis of the @bitwarden/cli compromise: GitHub used as C2, new Cloudflare exfiltration domain found, linked to April 22 Checkmarx KICS compromise via Dependabot.
The post @bitwarden/cli – GitGuardian Views on helloworm00 appeared first on Security Boulevard.
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custom malware suite on compromised hosts.
"As with many other intrusions in recent years, UNC6692 relied heavily on impersonating IT helpdesk em...
Will Anthropic’s Mythos, with its AI-powered identification of software and infrastructure weaknesses, upset the financial services industry by means of new, AI-developed attacks? Major bank leaders were called to an urgent meeting by Treasury Secretary Scott Bessent and Federal Reserve Chair Jerom...
In this newsletter, Joe discusses why understanding other disciplines can often flow back into the macro and micro of cybersecurity, especially in a world of AI.
Rituals disclosed a breach where hackers accessed and downloaded some My Rituals members’ data, including names and addresses. Luxury cosmetics giant Rituals disclosed a data breach impacting My Rituals members after attackers gained unauthorized access to its systems and downloaded part of the data...
Mend.io tracks TeamPCP's latest supply chain attack.
The post The Butlerian Jihad: Compromised Bitwarden CLI Deploys npm Worm, Poisons AI Assistants, and Dumps GitHub Secrets appeared first on Security Boulevard.
HTB's 2025 benchmark tested 796 security teams. Only 21% passed web security challenges.
The post When Elite Cyber Teams Can’t Crack Web Security appeared first on Security Boulevard.
OpenMPT could be made to crash if it received specially crafted input.
Meta is tracking employees and using behavioral data to train AI while planning layoffs. Are workers helping build their own replacements?
L'Autorité de protection des données (APD) a publié une décision de sanction à l'encontre de la société Y.NV, comprenant le prononcé d'une amende de 8 500 €, pour des manquements en lien avec la conservation et la gestion de la boîte de messagerie d'un ancien salarié. Cette affaire débute par la pla...
Cybersecurity professionals have long had high hopes for a quantum Internet, given that any attempt to intercept data alters it, which exposes the intrusion. This basic principle of physics positions quantum networking as a potential structural shift in cybersecurity. New research from New York Uni...