> TODAY'S SUMMARY (157 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A supply-chain attack involving AWS integrations has been uncovered, where attackers backdoored trusted connections to steal sensitive data from multiple customers. France has attributed significant cyberattacks on industrial refrigeration systems to Iranian state-sponsored hackers, resulting in operational disruptions and potential fire hazards. Additionally, a vulnerability in SonicWall's SSL VPN has been exploited, enabling attackers to bypass multi-factor authentication, raising concerns over corporate security. Meanwhile, hackers are actively exploiting the "SSHole" vulnerability in OpenSSH to breach Linux systems. Organizations are urged to strengthen their defenses amid these escalating threats, particularly as attacks targeting industrial controls and supply chains increase.
|
// AI-powered summary generated at 20:00
Last week, there were disclosed in that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence...
Bill discusses why obsessing over strategy games is actually a secret weapon to outsmart threat actors.
USN-8155-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding updates for openssl and openssl1.0 packages for Ubuntu 14.04
LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
Viktor Dukhovni discovered that OpenSSL incorrectly negotiated...
USN-8154-1 fixed vulnerabilities in Django. This update provides the
corresponding updates for Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
Original advisory details:
Seokchan Yoon discovered that Django incorrectly handled copying memory
when parsing multipart uploads with excessive whitespace. A rem...
Details have emerged about a now-patched security vulnerability in a widely used third-party Android software development kit (SDK) called EngageLab SDK that could have put millions of cryptocurrency wallet users at risk.
"This flaw allows apps on the same device to bypass Android security sandbox a...
Eligible U.S. digital asset firms and industry organizations “that meet Treasury’s criteria” will be able to receive, at no cost, the same actionable cybersecurity information Treasury regularly shares with traditional U.S. financial institutions.
As long as people have had more than one purchasing option, they’ve been comparing those options and looking for bargains. Online shoppers are no exception; in fact, one of the potential benefits of the internet is that it expands our options for everything from car rentals to airline tickets to dis...
L'autorité de protection des données de Lettonie, l'Inspection d'État des données (DVI), a publié des clarifications sur les exigences de maintien de la qualification pour les délégués à la protection des données (DPD) inscrits sur sa liste officielle.Pour conserver leur inscription sur cette liste,...
L'Autorité des Données Personnelles (AP) néerlandaise a publié une étude thématique sur l'utilisation par les municipalités de véhicules équipés de systèmes de balayage pour le contrôle du stationnement, révélant l'émission de centaines de milliers d'amendes injustifiées.L'étude estime que sur 3 à 5...
Possible link to Mr. Raccoon's claimed Adobe break-in A new extortion crew has targeted “several dozen high-value” corporations through phishing and helpdesk social-engineering, according to Google.…
L'Agence Espagnole de Protection des Données (AEPD) a publié une décision de sanction à l'encontre de KVIKU SPAIN, S.L. (comprenant le prononcé d'une amende de 5 000 €) pour des manquements en lien avec la licéité du traitement de données personnelles. Cette affaire débute par une plainte d'une pers...
L'autorité espagnole de protection des données (AEPD) a publié une décision de sanction à l'encontre de EMPRENDEDORES ONLINE, LLC, comprenant le prononcé d'une amende de 10 000 €, pour des manquements en lien avec la sécurité des données et la base légale du traitement. Cette affaire débute par cinq...
Posted by Ben Ackerman, Chrome team, Daniel Rubery, Chrome team and Guillaume Ehinger, Google Account Security team
Following our April 2024 announcement, Device Bound Session Credentials (DBSC) is now entering public availability for Windows users on Chrome 146, and expanding to macOS in an upco...
Le Comité européen de la protection des données (CEPD) a publié son rapport annuel pour 2025, synthétisant ses travaux axés sur l’accompagnement des parties prenantes par des orientations et un dialogue renforcé.En 2025, l'activité du CEPD a été marquée par l'adoption de la "Déclaration d’Helsinki s...
After almost twenty years on the platform, EFF is logging off of X. This isn’t a decision we made lightly, but it might be overdue. The math hasn’t worked out for a while now.
The Numbers Aren’t Working Out
We posted to Twitter (now known as X) five to ten times a day in 2018. Those tweets garnered...
A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations (NGOs) and suspected universities to deploy a new Lua-based malware called LucidRook.
"LucidRook is a sophisticated stager that embeds a Lua in...
Hackers hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla, and pushed a malicious version with multiple backdoors. [...]
New libpng packages are available for Slackware 15.0 and -current to fix a security issue.
OpenAI is finalizing a cybersecurity product slated for a restricted release to select partners. The new model, as reported by Axios, could signal growing anxiety among developers that their latest creations may be too dangerous for the public. The shift comes as artificial intelligence (AI) capabi...
The enterprise is deploying AI agents at a pace that has outrun every security framework written to govern them. These agents don’t just answer questions — they browse websites, retrieve documents, call APIs, execute code, manage email, initiate financial transactions, and spawn sub-agents to tackl...