An undisclosed number of Engie customers have had their data compromised after a supply chain incident
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]
The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog
The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek.
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.
The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
Banks say third-party AI agents put customer accounts at risk. Is security the only concern?
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the companyâs total funding to more than $800 million. Bessemer Venture Partners led the round, with participation from all existing Upwind investors, including Greylock Partners, Cyber...
Un paquet ICMP suffit pour exécuter du code avant Secure Boot sur une machine en boot PXE. Voici ce qu'il faut savoir sur la faille UEFI CVE-2026-97631.
Le post Faille UEFI CVE-2026-97631 : un paquet ICMP suffit pour exécuter du code avant le Secure Boot a été publié sur IT-Connect.
FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers.
The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Sui...
Attackers are distributing malware through fake ChatGPT and Claude desktop applications, using legitimate, digitally signed executables from OpenAI and Anthropic to load malicious code onto victimsâ Windows systems, according to Check Point Research.
The campaign, tracked a...
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on o...
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]
A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and r...
A threat actor dubbed Gheist is turning compromised GitHub accounts into credential-harvesting platforms. By planting malicious GitHub Actions workflows in private repositories, the attackers can expose repository and environment secrets, then retrieve them through GitHub APIs...
The FBI seized the domain of a âbulletproofâ hosting provider accused of facilitating a range of cybercrimes, including money laundering and the distribution of child sexual abuse material.
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.
Project Quarry aims to provide a 'shared language' for evaluating agent behavior
AI developers may have a security setting enabled and still end up running attacker-controlled code. Pillar Security has disclosed a high-severity vulnerability in Unslothâs model loader that could allow arbitrary Python code execution when processing a maliciously crafted mod...
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network.
UEFI firmware is the software that runs first w...