> TODAY'S SUMMARY (65 articles)
Today's cybersecurity landscape highlights several critical threats and trends. The UK NCSC warns organizations to update systems using PHP due to critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that were leaked prior to an emergency patch release. Ransomware attacks are escalating, with groups like The Gentlemen and Qilin intensifying their tactics in a competitive landscape. Additionally, the CISA reports that the SafePay ransomware gang has breached over 600 critical infrastructure entities globally. Concerns around AI are growing, as its capabilities may empower less skilled attackers to conduct sophisticated exploits. Lastly, a significant flaw in Signal's calling library has emerged, which may allow ongoing eavesdropping after calls end, prompting users to update their apps.
|
// AI-powered summary generated at 12:01
Tesla hacked, 37 zero-days demoed at Pwn2Own Automotive 2026 Security researchers earned $516,500 after exploiting 37 zero-day vulnerabilities on the first day of the Pwn2Own Automotive 2026 competition in Tokyo. Synacktiv Team took home $35,000 after successfully chaining an information leak and an...
Threat actors may have wanted to take advantage of the holiday weekend in the United States to increase their chances of success.
The post LastPass Users Targeted With Backup-Themed Phishing Emails appeared first on SecurityWeek.
Still dominant in Germany's networks, among others The European Commission (EC) wants a revised Cybersecurity Act to address any threats posed by IT and telecoms kit from third-country sources, potentially forcing member states to confront the thorny issue of suppliers such Huawei in their national...
Boston, MA, USA, 21st January 2026, CyberNewsWire
The post New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization appeared first on Security Boulevard.
The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code.
The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek.
The Rust project updated crates.io to include a Security tab on individual crate pages. The tab shows security advisories drawn from the RustSec database and lists which versions of a crate may have known issues. This change gives developers a way to view advisory information before selecting a crat...
Its very own Snooper’s Charter comes a month after proposed biometric tech expansion The Irish government is planning to bolster its police's ability to intercept communications, including encrypted messages, and provide a legal basis for spyware use.…
OpenAI is rolling out age prediction on ChatGPT consumer plans to help determine whether an account likely belongs to someone under 18. Age prediction builds on protections already in place. ChatGPT relies on an age prediction model that evaluates behavioral and account level signals. These include...
Sophisticated malware previously thought to be the work of a well-resourced cyber-crime group was built by one person - with the aid of AI tools
Threat actors behind the long-running Contagious Interview campaign were seen expanding from traditional social-engineering lures to the abuse of Microsoft Visual Studio Code (VS Code) as an execution and persistence mechanism.
According to new findings from Jamf Threat Lab...
Researchers showed how prompt injection hidden in a calendar invite can bypass privacy controls and turn an AI assistant into a data-leaking accomplice.
Minister unwraps ambassadors of the Software Security Code of Practice Britain's digital economy minister has sent forth a raft of companies as "ambassadors" to help organizations across the land embrace the UK's Software Security Code of Practice.…
By integrating identity threat detection with MFA, organizations can protect sensitive data, maintain operational continuity, and reduce risk exposure.
The post Why Identity Security Must Move Beyond MFA appeared first on SecurityWeek.
Several security issues were fixed in iperf3.
Chinese electronic manufacturer and Apple partner Luxshare Precision Industry has allegedly been breached by affiliates of the RansomHub ransomware-as-a-service outfit. Luxshare is one of the primary assemblers of Apple’s wireless earbuds, iPhones, and Vision Pro devices, as well as a producer of co...
Security researchers have hacked the Tesla Infotainment System and earned $516,500 after exploiting 37 zero-days on the first day of the Pwn2Own Automotive 2026 competition. [...]
The EU’s Cybersecurity Act 2.0 will aim to address some of the challenges of the current CSA, including the slow rollout of certification schemes
The Embedded Systems Threat Matrix (ESTM) aims to help organizations protect critical embedded systems.Â
The post MITRE Launches New Security Framework for Embedded Systems appeared first on SecurityWeek.
No matter how many times we say it, the idea comes back again and again. Hopefully, this letter will hold back the tide for at least a while longer.
Executive summary: Scientists have understood for many years that internet voting is insecure and that there is no known or foreseeable technology that...
Une faille importante (CVE-2026-23745) a été découverte dans node-tar, une bibliothèque populaire pour Node.js. Voici les risques et les mesures de correction.
Le post Node.js – CVE-2026-23745 : cette faille de sécurité dans la bibliothèque node-tar est à prendre au sérieux a été publié sur IT-Conne...