> TODAY'S SUMMARY (83 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Notably, the FBI and CISA issued warnings regarding cyberattacks targeting industrial refrigeration systems, which could lead to severe consequences for food and medical supplies. OpenSSH has revealed a significant flaw that allows remote attackers to bypass authentication on certain Linux systems, while a breach at Chainalysis exposed sensitive credentials for all its customers. Additionally, CEO impersonation scams utilizing AI have resulted in over $100 million in losses, emphasizing the growing sophistication of cybercriminal tactics. In response to these threats, organizations are urged to enhance their security measures, particularly around password management and vulnerability patching.
|
// AI-powered summary generated at 16:00
Multiple security vulnerabilities were discovered in the SOGo groupware server, which could result in cross-site scripting, shell injection, password reset poisoning or SQL injection. For the stable distribution (trixie), this problem has been fixed in version 5.12.1-3+deb13u3.
Several security issues were fixed in OpenSSH.
Several security issues were fixed in curl.
It was discovered that missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. For the stable distribution (trixie), this problem has been fixed in version 1.6.9-2+deb13u1.
Another IoT cyberattack, this one in France:
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
[…]
Normally, supermarket freezers go through a short period of d...
The cybersecurity startup plans to expand engineering and go-to-market teams in the US and UK.
The post Harmonic Security Raises $50 Million for Workforce AI Protection appeared first on SecurityWeek.
Want to delete your Facebook account for good? Here's how to permanently delete or temporarily deactivate it, export your data, and cut Messenger loose.
Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities. Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs fr...
Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources and energy.
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]
Researchers at Forescout said the discovery shows how ClickFix is evolving from a delivery technique into full-blown cyber-criminal infrastructure
SecurtyWeek’s 2026 Zero Trust Strategies Summit kicks off today at 11AM ET as a fully immersive virtual conference and expo. This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies for a world where every user, de...
Learn about seven common business meetings, with practical tips for keeping each one productive and private.
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man.
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]
Customers of Russian travel website Anywayanyday were unable to book tickets or hotel rooms as the company responded to a cyberattack.
Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain
malformed DNSKEY records. A remote attacker could possibly use this issue
to cause Bind to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04
LTS. (C...
Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma Security finding.
Noma’s researchers found a vulnerability affecting Anthropic’...
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies an...
In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally.
The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.