> TODAY'S SUMMARY (40 articles)
Today's cybersecurity landscape highlights several critical threats and trends. Notably, the Dutch police have arrested two individuals linked to NFC relay attacks that drained over $400,000 from victims' bank accounts by tricking them into installing malicious apps. Additionally, a Quest Diagnostics breach has exposed sensitive patient records, prompting concerns about data security in healthcare. AI continues to pose challenges, with reports indicating that malicious downloads can deceive AI coding agents into executing harmful code, while advanced AI models are searching for ways to bypass restrictions. Furthermore, an ongoing campaign is exploiting stolen GitHub tokens to access private repository secrets, emphasizing the persistent risk of credential theft. Lastly, the emergence of synthetic identities has left U.S. lenders vulnerable to an estimated $2.4 billion in fraud.
|
// AI-powered summary generated at 12:01
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.
The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forg...
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.
The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek.
This week on The Kettle, we discuss some arrests and how Mythos' mathematical expertise has led to a second exploited bug that no human would have found
Frappes sur Yandex : les data centers au cœur de la guerre hybride, entre pannes cloud et soupçons sur les bots.
NVIDIA's new agent safety platform puts enforcement in the right place. It still must know what it is letting through.
The post Your AI agent is only as safe as the packages it downloads appeared first on CyberScoop.
The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters
Three days after customers in Southeast Asia began reporting drained wallets, Ledger says the damage is limited. In its 72-hour update on X on October 11, the Paris-based hardware wallet maker said “all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold...
CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure. CyberXero is an operation that combines traditional hacking tools with AI agents to carry out cyberattacks. According to SOCRadar researchers, the attackers u...
Vacaf : un vendeur pirate informatique revendique 1,39 million de lignes sur des familles et des enfants.
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. For the stable distribution (trixie), these problems have been fixed in version 155.0.8059.39-1~deb13u1.
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.
The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrar...
Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next.
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek.
Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers
Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity.
Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agen...
Une machine à café connectée Keurig a envoyé plus d'un téraoctet de données en dix jours, au point de saturer un point d'accès Wi-Fi.
Le post Une machine à café connectée envoie plus de 1 To de données en 10 jours sur le Wi-Fi a été publié sur IT-Connect.
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.
The post Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch appeared first on SecurityWeek.
Microsoft is advising users and businesses to update Windows devices before digital certificates used to verify Windows Update servers expire in May and June 2027. The certificates expire on May 17 or June 19, depending on the Windows version. Devices without replacement certificates will lose acces...
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
The activity, which brings together commodity offensive tools like Cobal...