> TODAY'S SUMMARY (1 articles)
Today’s cybersecurity news highlights critical vulnerabilities in PHP, known as PHP2Shell, which underscore issues in coordinated vulnerability disclosure. These vulnerabilities pose significant risks to enterprises relying on PHP for web applications, potentially exposing sensitive data and systems. Organizations are urged to assess their PHP implementations and apply necessary patches swiftly. Additionally, the ongoing trend of increasing sophistication in cyberattacks emphasizes the need for robust security measures and proactive incident response strategies. As attackers adapt, businesses must prioritize vulnerability management and employee training to mitigate risks effectively.
|
// AI-powered summary generated at 04:00
How to ensure the ‘organisational memory’ of past vulnerabilities is not lost.
BeyondTrust patched a critical pre-auth flaw in Remote Support and PRA that could let attackers execute code remotely. BeyondTrust released security updates to address a critical flaw, tracked as CVE-2026-1731 (CVSS score of 9.9), in its Remote Support and older Privileged Remote Access products. Th...
Moritz Woermann discovered that missing input sanitising in Shaarli, a personal bookmarking service, could result in cross-site scripting. For the oldstable distribution (bookworm), this problem has been fixed in version 0.12.1+dfsg-8+deb12u2. For the stable distribution (trixie), this problem has b...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the oldstable distribution (bookworm), these problems have been fixed in version 6.1.162-1.
Cloud security titan Zscaler Inc. has acquired SquareX, a pioneer in browser-based threat protection, in an apparent move to step away from traditional, clunky security hardware and toward a seamless, browser-native defense. The acquisition, which did not include financial terms, integrates SquareX...
SmarterTools confirmed last week that the Warlock ransomware gang breached its network after compromising an email system, but did not impact business applications or account data. [...]
A cybersecurity incident affecting the government of Senegal has forced the closure of an office tasked with managing sensitive information, including national ID cards, passports and other biometric data.
For thirty years, internet users have benefited from a key federal law that allows everyone to express themselves, find community, organize politically, and participate in society. Section 230, which protects internet users’ speech by protecting the online intermediaries we rely on, is the legal sup...
For thirty years, internet users have benefited from a key federal law that allows everyone to express themselves, find community, organize politically, and participate in society. Section 230, which protects internet users’ speech by protecting the online intermediaries we rely on, is the legal sup...
This week on the Lock and Code podcast, we revisit an episode from 2025 in which we tried to answer: Is your phone listening to you?
We are sad to report the passing of longtime EFF Board member, Dave Farber. Dave was 91 and lived in Tokyo from age 83, where he was the Distinguished Professor at Keio University and Co-Director of the Keio Cyber Civilization Research Center (CCRC).  Known as the Grandfather of the Internet, Dave m...
We are sad to report the passing of longtime EFF Board member, Dave Farber. Dave was 91 and lived in Tokyo from age 83, where he was the Distinguished Professor at Keio University and Co-Director of the Keio Cyber Civilization Research Center (CCRC).  Known as the Grandfather of the Internet, Dave m...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the stable distribution (trixie), these problems have been fixed in version 6.12.69-1.
La Commission Nationale de l'Informatique et des Libertés (CNIL) a publié son bilan pour l'année 2025, détaillant les sanctions et mesures correctrices prononcées, principalement relatives aux témoins de connexion, à la surveillance des salariés et à la sécurité des données.En 2025, la CNIL a pris 2...
L'autorité polonaise de protection des données (UODO) a transmis ses observations concernant un projet de règlement sur le programme d'enseignement de la maternelle à l'école primaire.Le président de l'UODO a salué les efforts du ministère de l'Éducation pour renforcer la sensibilisation numérique d...
According to TechCrunch’s ongoing tally, including the most recent data spill involving uMobix, there have been at least 27 stalkerware companies since 2017 that are known to have been hacked, or leaked customer and victims’ data online.Â
L'autorité italienne de protection des données (GPDP) a sanctionné un établissement scolaire pour la publication en ligne des résultats d'examens et des calendriers d'épreuves orales nominatifs des élèves.Suite à une plainte, il a été constaté que le Lycée Classique et Scientifique Alessandro Volta...
This year, we have a new method for Domain Control Validation arriving called DNS-PERSIST-01. It is quite a fundamental change from how we do DCV now, so let's take a look at the benefits and the drawbacks.First, a quick recapWhen you approach a Certificate Authority, like
A straightforward guide to the differences between risk and threat, security and compliance, and other frequently confused cybersecurity terms.
Security researchers from LayerX identified a new flaw in 50 Claude Desktop Extensions that could lead to unauthorized remote code execution