> TODAY'S SUMMARY (4 articles)
Today's cybersecurity highlights include a significant data breach involving СберСпасибо, with 3,288,711 accounts compromised. Microsoft has issued its November 2026 Patch Tuesday update, addressing 1,328 vulnerabilities, including 60 rated as critical, emphasizing the need for urgent patching. Additionally, a critical remote code execution vulnerability has been identified in Ruflo MCP Bridge version 3.16.2, posing serious risks to affected systems. Organizations are advised to prioritize updates and monitor for potential exploitation of these vulnerabilities. Overall, the cybersecurity landscape remains fraught with threats, underscoring the importance of robust security measures.
|
// AI-powered summary generated at 04:00
New ransomware of choice, same critical targets North Korea’s Lazarus Group appears to have added another tool to its kit. It has begun using Medusa ransomware in extortion attacks targeting at least one US healthcare organization and an unnamed victim in the Middle East, according to Symantec and C...
Several security issues were fixed in the Linux kernel.
The ShinyHunters extortion group has published personal information in more than 12 million records allegedly stolen from CarGurus, a U.S.-based digital auto platform. [...]
Several security issues were fixed in the Linux kernel.
L'autorité italienne de protection des données (Garante per la protezione dei dati personali - GPDP) a publié une décision interdisant à Amazon Italia Logistica srl de traiter les données personnelles de ses salariés pour des manquements en lien avec la collecte systématique d'informations non perti...
L'organisation noyb a publié une analyse critique de la proposition de "Paquet Omnibus Numérique" présentée par la Commission européenne, qui vise à modifier le RGPD et la directive ePrivacy.La proposition, datée du 19 novembre 2025, a fait l'objet d'un rapport détaillé de noyb, mis à jour le 20 jan...
In 2010, OWASP added "Unvalidated Redirects and Forwards" to its Top 10 list and merged it into "Sensitive Data Exposure" in 2013. Open redirects are often overlooked, and their impact is not always well understood. At first, it does not look like a big deal. The user is receiving a 3xx status code...
Several security issues were fixed in the Linux kernel.
L'autorité italienne de protection des données (GPDP) a publié une décision de sanction à l'encontre de la Fédération Nationale des Ordres des Professions Infirmières (FNOPI), comprenant le prononcé d'une amende de 2 000 €, pour des manquements en lien avec la publication en ligne de données personn...
L'Agence Espagnole de Protection des Données (AEPD) a publié une décision déclarant des manquements à l'encontre de la Mairie de Palma pour des manquements en lien avec le traitement de données personnelles via un système d'ouverture de conteneurs à déchets par carte citoyenne. Cette affaire débute...
Several security issues were fixed in the Linux kernel.
L'autorité britannique de protection des données, l'Information Commissioner's Office (ICO), a sanctionné Reddit, Inc. pour des manquements liés à l'utilisation illicite des données personnelles d'enfants. Une amende de 14 470 000 livres sterling (environ 17 074 600 €) a été prononcée suite à une en...
Several security issues were fixed in the Linux kernel.
It was discovered that improper initialization of CPU cache memory could
allow a local attacker with hypervisor access to overwrite SEV-SNP guest
memory resulting in loss of data integrity. (CVE-2024-36331)
Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos,
and Flavien Solt...
Microsoft is expanding data loss prevention (DLP) controls to block the Microsoft 365 Copilot AI assistant from processing confidential Word, Excel, and PowerPoint documents, regardless of their location. [...]
Scott Schelble, the deputy assistant director of the FBI’s International Operations Division, told reporters that he recently met with law enforcement officials in Thailand, Cambodia and Vietnam to discuss the region’s scam operations.
A developer-targeting campaign leveraged malicious Next.js repositories to trigger a covert RCE-to-C2 chain through standard build workflows. The activity demonstrates how staged command-and-control can hide inside routine development tasks.
The post Developer-targeting campaign using malicious Next...
Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- MMC subsystem;
(CVE-2022-49267, CVE-2025-21780)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- MMC subsystem;
(CVE-2022-49267, CVE-2025-21780)