> TODAY'S SUMMARY (130 articles)
Today's cybersecurity news highlights several significant threats and vulnerabilities. DreamHost has mandated password resets for users following a disruption linked to an ongoing incident. A widespread attack has seen 953 online stores, predominantly on Magento, infected with malware that evades detection. Critical vulnerabilities in the Brotli compression library have prompted emergency patches from Microsoft, PHP, and others, as exploits are actively being leveraged. Additionally, researchers have revealed a new Android spyware platform, uCreator, which stealthily targets popular messaging apps. Meanwhile, the U.S. government faces scrutiny over its handling of surveillance laws, and malicious actors are increasingly using social engineering tactics via Microsoft Teams to deploy malware.
|
// AI-powered summary generated at 20:01
EFF was thrilled to join organizers, advocates, and activists in the East Bay for the second annual Oakland Tech Week last week. We are grateful to our friends at MediaJustice and Upturn for inviting us co-present this all-day event, “Building Beyond Big Tech: Organizing Oakland’s Future”, on Sept....
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.
"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communicatio...
Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are inviting customers to submit their own code dependencies to a new service, L...
Oleg Korniev, a 42-year-old dual citizen of Ukraine and Russia, was a principal of Your Mule Cashout, or “YMCO,” which from 2007 until 2014 set up a sophisticated network of mules in the U.S. and Europe.
A company known for wearable cardiac sensors, iRhythm, has begun notifying states of the impact of a data breach from the summer.
Attackers are increasingly ditching ransomware in favor of stealing company data and threatening to leak it. Let’s look at why this is happening and how businesses can protect themselves.
Hackers stole ASOS customer data in a cyberattack that addressed customers directly. Here's how this changes your approach to business security.
The owner of a ransomware remediation company is facing trial for defrauding customers.
Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” has been arraigned in New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company,...
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate," FBI Director Kash Patel said.
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. [...]
OpenAI continues to report incidences of “misaligned” behavior by its AI models, with three new reports dropping on Oct. 2. However, they describe relatively minor issues compared to previous alignment reports and notices covering its attacks on Hugging Face, Rubygems, and a G...
Wikimedia says OpenAI agents performed unauthorized actions on its platforms, including edits to wikis
The Belarusian Cyber Partisans concurred with Russian research that they indeed spent months inside the network for the Moscow Department of Health.
The US State Department is offering up to US $10 million for information about the whereabouts of Zhang Yu, a 44-year-old Chinese national who is accused of being a key figure in China's state-sponsored hacking group, Hafnium.
Read more in my article on the Hot for Security blog.
For the third week running, Citrix has issued a critical security warning to customers managing their own NetScaler ADC and Netscaler Gateway instances, this time warning of a memory overflow vulnerability enabling denial of service or remote code execution.
This week’s vul...
Microsoft publie LiteBox 0.1, un library OS open source écrit en Rust qui réduit l'interface avec l'hôte pour mieux isoler les applications.
Le post LiteBox 0.1 : Microsoft veut isoler les applications avec son OS-bibliothèque codé en Rust a été publié sur IT-Connect.
EFF strongly condemns Turkey’s state-led discriminatory, oppressive attacks on feminist and LGBTQ+ organisations, media platforms, student groups, and rights defenders and activists within the country.
Since mid-September, access to the websites and social media accounts of a dozen organizations ha...
Chrome 155 corrige 247 failles de sécurité, dont 4 critiques. Douze ont été trouvées avec l'aide de l'IA Claude. Voici les versions à installer.
Le post 247 failles patchées d’un coup dans Chrome 155 : l’IA est passée par là a été publié sur IT-Connect.
AI agents can use valid credentials to perform actions beyond their assigned permissions, creating risks that traditional access controls may not prevent. Token Security explains how organizations can enforce agent-specific policies without sacrificing autonomy. [...]
Anthropic launches free OSS Scanner, using AI to find open-source vulnerabilities and help maintainers fix bugs before attackers exploit them. Anthropic is launching OSS Scanner, a vulnerability scanner for open-source code that costs nothing for projects to join. It grew directly out of lessons lea...