> TODAY'S SUMMARY (18 articles)
Today's cybersecurity landscape reveals several critical threats and trends. A new free vulnerability database for maritime systems has been launched, indexing nearly 30,000 vulnerabilities, highlighting ongoing concerns in the maritime sector. In Ukraine, attackers exploited weaknesses in Dahua IP cameras, emphasizing the risks associated with remote surveillance systems. A significant vulnerability in Microsoft Authenticator for Android has been identified, allowing rogue apps to hijack work accounts. Rapid7's report indicates that 71% of vulnerability exploits occur within a week of disclosure, stressing the urgency for organizations to patch flaws quickly. Additionally, the University of New Mexico Health System faced a major cyber incident that forced patient diversions and clinic closures, underscoring the real-world impact of cyber threats.
|
// AI-powered summary generated at 08:00
Company's Project Glasswing and Cyber Verification Program metamorphose into triple tier threat hunting club
The FBI and Secret Service warned Fortinet users that FortiBleed, uncovered this summer, is a continuing threat.
The post Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks appeared first on CyberScoop.
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]
Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in
command-line arguments when enabling a subscription on a WSL instance.
An attacker could possibly use this issue to obtain sensitive information
and gain unauthorized access to Ubuntu Pro repositories.
An update to a state wiretapping law will end private lawsuits over some internet tracking and surveillance, pitting businesses against privacy groups and unions.â
The post Wiretapping change sparks big privacy fight in the Golden State appeared first on CyberScoop.
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
In cloud-centered environments, establishing trust between workloads is fundamental to securing machine-to-machine communication. Traditional approaches such as API keys, shared secrets, and static service account credentials werenât designed for the scale and ephemeral nature of cloud workloads. Th...
Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus.
The products, which claim to offer campai...
The US Federal Bureau of Investigation has removed an Accenture contractor working on its PeopleSoft installation over their role in a data breach that exposed personal details of FBI employees, Reuters reported Monday.
This is the first time that anyone other than the hack...
Compare Mac and PC privacy across data collection, cloud services, government requests, encryption, privacy settings, and everyday control.
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.
Threat actors are known to name their malicious software after a legitimate operating system co...
Paul Nakasone said the reported reorganization is likely necessary to meet faster-moving cyberthreats and competition in AI, but warned its success will rest on execution and a workforce facing mounting retirement pressure.
The post Former NSA chief Nakasone says agency overhaul is âprobably neededâ...
On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024). Learn what this means for you, and how RFC 8509 trust anchor sentinels allow you to test whether your DNS resolver is ready for the rollover.
It was discovered that librsvg incorrectly handled duplicate XML entity
declarations while processing SVG documents containing nested XML
inclusions. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code.
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]
All that glitters âŠ
It was discovered that libsoup incorrectly handled certain HTTP/2 requests.
A remote attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-4271)
It was discovered that libsoup incorrectly handled certain HTTPS...
UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]
L'autorité sud-coréenne de protection des données a émis une alerte concernant les risques d'escroqueries suite à de récentes fuites de données dans le secteur financier.Suite à plusieurs fuites de données personnelles survenues dans le secteur financier, les autorités ont émis une alerte à l'intent...
La Commission européenne a procédé à l'enregistrement d'une Initiative Citoyenne Européenne (ICE) intitulée "Création d'un espace numérique européen (.IA) pour une gouvernance souveraine de l'IA".Les organisateurs de cette initiative invitent la Commission à proposer un cadre pour des "espaces numér...