> TODAY'S SUMMARY (110 articles)
Today's cybersecurity landscape highlights several critical threats and trends. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of active exploitation of PHP vulnerabilities, specifically the PHP2Shell flaws, which could enable remote code execution. A significant cyberattack on the University of New Mexico disrupted hospital operations, showcasing the ongoing risks to healthcare systems. In the online retail sector, nearly 1,000 stores were compromised with scanner-evading malware. Furthermore, the rise of AI-generated fake login pages is making phishing more effective, while the recent deepfake incident involving a UK politician underscores the dangers of misinformation and digital impersonation. Lastly, vulnerabilities in major software products, including Microsoft and Citrix, continue to pose substantial risks to organizations.
|
// AI-powered summary generated at 16:00
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos Era 300. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 10.0. The following CVEs are assigned: CVE-2026-4149.
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following C...
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. Google is aware that exploits for both CVEs exist in the wild. For the oldstable distribution (bookworm), these problems have been fixed
This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. Th...
This vulnerability allows local attackers to escalate privileges on affected installations of VMware ESXi. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The follo...
This episode discusses Meta Ray-Ban Smart Glasses, which blend a camera, microphone, AI features, and social media integration into sunglasses that look like normal fashion eyewear, raising major privacy concerns. It highlights reports that footage captured by the glasses may be reviewed by human co...
This vulnerability allows local attackers to escalate privileges on affected installations of VMware ESXi. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The follo...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2022-45188.
Written by Katie Barnett, Director of Cyber Security at Toro Solutions
Insider risk is still often framed around intent, with the focus placed on malicious employees, disgruntled contractors, or deliberate misuse of access for personal gain.Those cases exist and they matter, but they are rarely wher...
Learn how to implement cryptographic agility in MCP resource servers to protect AI infrastructure from quantum threats using PQC and modular security frameworks.
The post Cryptographic Agility in MCP Resource Server Orchestration appeared first on Security Boulevard.
La société Omikenji a publié un communiqué faisant le point sur la panne informatique survenue le 16 mars à la suite d'un accès non autorisé. L'enquête a révélé qu'une intrusion via un VPN et un chiffrement par ransomware avaient eu lieu, et qu'une partie des données de certains serveurs avait été t...
An attacker sending a malformed miIO message over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here.
This report describes a heap buffer overflow, which leads to remote code execution.
The vulnerability described in this advisory affects a potentially wide range of Xi...
An attacker sending malformed miIO messages over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here.
This report describes a use of cryptographically weak PRNG implementation issue, which leads to reliable prediction of cryptographic primitives used in the proprietary...
Une vulnérabilité a été découverte dans OpenSSL. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
An attacker sending malformed miIO messages over WiFi to a Xiaomi Smart camera device can trigger the vulnerability described here.
This report describes a secure protocol design issue, which leads to authentication bypass in the proprietary Xiaomi miIO protocol.
The vulnerability described in this...
In this blogpost, the newest full-time member of our research team describes his internship project.
If you would also like to try your hand at our hacking tools and techniques, don’t hesitate to check out our training offerings! Currently available: https://www.offensivecon.org/trainings/2026/explo...
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Une vulnérabilité a été découverte dans Google Chrome. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur. Google indique que la vulnérabilité CVE-2026-3909 est activement exploitée.
Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés par le CERT-FR dans le cadre d'une analyse de risques pour prioriser l'application des...