Yirou Yang discovered that libxml2 incorrectly handled certain XML
catalogs. If a user or automated system was tricked into processing a
specially crafted XML catalog, an attacker could possibly use this issue to
cause libxml2 to crash, resulting in a denial of service. (CVE-2026-76781)
It was disc...
The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA.
The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop.
This post was co-authored by Sheila B. Lalwani, a doctorate student and recent COMPASS Fellow hosted by EFF.
Age verification proposals are often presented as a simple tradeoff: sacrifice a little privacy to better safeguard children online. But that framing overlooks a more fundamental question. Wh...
Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals.
The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop.
Italy’s Foreign Ministry is defending its website against a cyberattack, checking embassy sites and pushing for EU action to identify attackers. On the morning of October 8, Italy’s Ministry of Foreign Affairs said its website was being attacked. According to the ministry’s own statement, its protec...
The U.S. and other nations took down digital tools and infrastructure by Beijing-based Integrity Tech that allowed "widespread vulnerability scanning and, in some cases, intrusions" as part of the Flax Typhoon campaign.
A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]
The quantum threat is becoming an increasing concern for security leaders, but many may be mistaking protection at their website’s front door for quantum readiness across their business.
More than half (54%) of the world’s top 1 million websites now support post-quantum key...
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.
The company, Integrity Technology Group, has been sanct...
The GPU giant released a fix for the flaw, tracked as CVE-2026-47483
Pierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option.
The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence.
The rest of the wee...
Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated. Group-IB researchers published a detailed writeup on BraZetsu back on August 31, naming it a Python framework compiled with Nuitka and tying it to a Br...
The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns.
The post OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media appeared first on CyberScoop.
AI vendors are scrambling to offer zero data retention. Here's why retention became a dealbreaker, and five questions to ask about your data.
L'Inspection de la protection des données estonienne (AKI) a rapporté un nombre record de notifications de violations de données pour le troisième trimestre 2026.L'autorité a enregistré 123 notifications de violation, soit une augmentation de 116 % par rapport à la même période en 2025. Cette hausse...
La Commission Nationale de Protection des Données (CNPD) portugaise et l'Agence Nationale de Protection des Données du Brésil (ANPD) ont signé un mémorandum d'entente pour renforcer leur coopération en matière de protection des données personnelles.Signé le 2 octobre 2026, cet accord établit un cadr...
It was discovered that libde265 did not properly validate certain crafted
H.265 bitstreams, leading to a NULL pointer dereference. An attacker could
possibly use this issue to cause libde265 to crash, resulting in a denial
of service.
L'autorité autrichienne de protection des données a tenu une réunion bilatérale avec son homologue polonaise, l'Office de protection des données personnelles, pour échanger sur la gestion des plaintes générées par l'intelligence artificielle et sur les procédures transfrontalières.Cette rencontre s'...
L'Office du commissaire à l'information (ICO) britannique a obtenu des engagements de la part de dix développeurs de modèles de fondation d'intelligence artificielle et étend sa surveillance aux agents d'IA autonomes.Dans un rapport, l'ICO détaille comment dix des principaux développeurs de modèles...