> TODAY'S SUMMARY (125 articles)
Today's cybersecurity news highlights several critical threats and vulnerabilities. The PHP Foundation has issued emergency patches for two severe remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively termed PHP2Shell, which are being actively exploited; website owners are urged to update immediately. Additionally, a new phishing-as-a-service platform, Athena StealthRoute, utilizes AI to generate deceptive lures, indicating a growing trend in AI-assisted cybercrime. Meanwhile, ransomware attacks are surging, with rival gangs evolving their tactics to exploit various vulnerabilities. The U.S. government has mandated the removal of DeepSeek AI products from federal systems due to security risks. Overall, the landscape is marked by rapid exploitation of vulnerabilities and the increasing sophistication of cyber threats.
|
// AI-powered summary generated at 16:01
Obsidian Security today announced that it has extended the reach of its platform for protecting software-as-a-service (SaaS) applications to include any integrations. Additionally, the company is now making it possible to limit which specific end users of a SaaS application are allowed to grant and...
To all those who are fighting the good fight in the world of cyber, keep collaborating to ensure our world never succumbs to the chaos of the Upside Down.
The post The Upside Down is Real: What Stranger Things Teaches Us About Modern Cybersecurity appeared first on SecurityWeek.
A critical security flaw has been disclosed in the GNU InetUtils telnet daemon (telnetd) that went unnoticed for nearly 11 years.
The vulnerability, tracked as CVE-2026-24061, is rated 9.8 out of 10.0 on the CVSS scoring system. It affects all versions of GNU InetUtils from version 1.9.3 up to and i...
I’ve seen this movie before. That’s why a recent LinkedIn post by Ilya Kabanov stopped me mid-doomscroll. Kabanov described how frontier AI companies are quietly but decisively shifting into cybersecurity. They are not joining as partners or tacking on features. They are stepping up as product make...
Microsoft will soon add new fraud protection features to Teams calls, warning users about external callers who attempt to impersonate trusted organizations in social engineering attacks. [...]
An operational security failure allowed researchers to recover data that the INC ransomware gang stole from a dozen U.S. organizations. [...]
Admins say attackers are still getting in despite recent patches FortiGate firewalls are getting quietly reconfigured and stripped down by miscreants who've figured out how to sidestep SSO protections and grab sensitive settings right out of the box.…
Critical vulnerability in Appsmith allows account takeover via flawed password reset process
Session 9D: Github + OSN Security
Authors, Creators & Presenters: Aditya Sirish A Yelgundhalli (New York University), Patrick Zielinski (New York University), Reza Curtmola (New Jersey Institute of Technology), Justin Cappos (New York University)
PAPER
Rethinking Trust In Forge-Based Git Securi...
Bunmi Bloom, co-founder of Sena Forensics, joins the Forensic Focus Podcast to discuss the emotional reality of working in digital forensics and the psychological toll of long-term exposure to traumatic material.
TechCrunch obtained a sample of the stolen data, which contained names, email addresses, dates of birth, and the user's approximate geographic location. Under Armour confirmed some sensitive information was taken in the breach.
L'Agence espagnole de protection des données (AEPD) a publié une décision déclarant une infraction à l'encontre du ministère de l'éducation du gouvernement de Castille-et-León pour des manquements liés au non-respect d'une de ses décisions antérieures.Cette affaire débute par une plainte concernant...
La Commission Nationale de l'Informatique et des Libertés (CNIL) a publié une décision de sanction de 3 500 000 € à l'encontre d'une société pour avoir transmis les données des membres de son programme de fidélité à un réseau social à des fins publicitaires, sans base légale valable. Cette affaire d...
Note: This is a guest post by IT security consultant Adarsh Kumar. I’ve been using Burp Suite day to day for years, so when Burp AI was introduced, I was curious how it would actually hold up dur
Le président de l'Office de Protection des Données Personnelles (UODO) polonais a communiqué au vice-ministre des Affaires étrangères la nécessité d'intégrer au droit national des mesures protégeant spécifiquement les délégués à la protection des données (DPD) contre un licenciement lié à l'exercice...
DataDome Bot Protect supports Web Bot Auth, enabling cryptographic verification of AI agents to eliminate fraud risk while maintaining business continuity.
The post Web Bot Auth: Verifying User Identity & Ensuring Agent Trust Through the Customer Journey appeared first on Security Boulevard.
A SmarterMail flaw (WT-2026-0001) is under active attack just days after its January 15 patch, with no CVE assigned yet. A newly disclosed flaw in SmarterTools SmarterMail is being actively exploited just two days after a patch was released. The issue, tracked as WT-2026-0001 and lacking a CVE, was...
Security flaw in RealHomes CRM plugin allowed file uploads; patches released for 30,000+ sites
A team of researchers from the Graz University of Technology in Austria has revived page Linux page cache attacks.
The post Old Attack, New Speed: Researchers Optimize Page Cache Exploits appeared first on SecurityWeek.
Hybrid work has driven a surge in Active Directory password resets, turning minor lockouts into major productivity drains. Specops shows why remote access, cached credentials, and security policies are fueling the spike. [...]