> TODAY'S SUMMARY (23 articles)
Today's cybersecurity news highlights several significant threats and trends:
1. A data leak at the State Bank of India exposed 3,897 customer records on the dark web, raising concerns about the source and integrity of the data.
2. The U.S. CISA has added vulnerabilities affecting Plex2Shell, Siemens, and SiteGuard to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply patches promptly.
3. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which could allow unauthenticated remote code execution, have leaked, prompting an emergency patch release.
4. A Belarus-aligned hacktivist group has infiltrated a Russian healthcare organization for nearly two years, utilizing a backdoor hidden in VMware Tools.
5. Stolen keys from UpdraftCentral have been used to backdoor WordPress sites, emphasizing the risks associated with developer account compromises.
Overall, the day reflects ongoing vulnerabilities in software and infrastructure, alongside significant breaches affecting both financial institutions and web services.
|
// AI-powered summary generated at 08:00
Lamb-Star Engineering, LLC suffered a data security incident on January 20, 2026, resulting in unauthorized access to some individuals' personal information. The incident was discovered on January 20, 2026, and Lamb-Star promptly disconnected the affected systems and remote access to the network. Th...
An email from Claude landed in my inbox Friday morning with a subject line that stopped me cold: “Using Claude for your everyday life.”
Related: AI’s fortune teller effect
Not “Unlock the power of AI” or “Transform your productivity.” Just… … (more…)
The post MY TAKE: From ‘holy mackeral’ to ‘daily...
A malvertising campaign is using a fake ad-blocking Chrome and Edge extension named NexShield that intentionally crashes the browser in preparation for ClickFix attacks. [...]
Key Takeaways Healthcare breaches have cost an eye‑watering $7.42 million per incident in 2025, and it’s not surprising that regulators are dialing up new requirements like multi‑factor authentication, encryption for all ePHI, and yearly audits. Small practices may be able to get by with basic tools...
Is Your Organization Truly Safe from Non-Human Identity Threats? Could a digital passport be the source of your organization’s next major security breach? Understanding the dynamics of Non-Human Identities (NHIs) is crucial for organizations aiming to secure their operations against cyber threats. W...
Google’s Mandiant security division has come up with an unusual tactic to persuade organizations to stop using the aged and hugely insecure NTLMv1 authentication protocol: publish a data lookup that makes cracking NTLMv1 credentials trivial for attackers.
The intention, Man...
How Can Organizations Effectively Manage Non-Human Identities? Are you aware of the potential threats posed by machine identities in your organization? With cybersecurity professionals navigate the complexities of managing Non-Human Identities (NHIs), understanding the nuances of these machine ident...
How Can Non-Human Identities Enhance Cloud Security? Can organizations truly secure their cloud environments without addressing the role of Non-Human Identities (NHIs)? With technology continues to advance, NHIs have become a crucial component, particularly in managing secrets and enhancing security...
On December 10th, 2025, we received a submission for a Privilege Escalation vulnerability in Advanced Custom Fields: Extended, a WordPress plugin with more than 100,000+ active installations. This vulnerability makes it possible for an unauthenticated attacker to grant themselves administrative priv...
Are You Maximizing the Potential of AI in Cloud-Native Security? The intersection of artificial intelligence (AI) and cloud-native security is transforming how organizations safeguard their digital. With AI capabilities advancing rapidly, security is witnessing unprecedented changes that promise mor...
Ransomware attackers targeting a Fortune 100 company in the finance sector used a new malware strain, dubbed PDFSider, to deliver malicious payloads on Windows systems. [...]
Session 9B: DNN Attack Surfaces
Authors, Creators & Presenters: Myungsuk Moon (Yonsei University), Minhee Kim (Yonsei University), Joonkyo Jung (Yonsei University), Dokyung Song (Yonsei University)
PAPER
ASGARD: Protecting On-Device Deep Neural Networks with Virtualization-Based Trusted Executi...
David Mendenhall discovered that Dungeon Crawl Stone Soup was incorrectly
handling Lua bytecode embedded in an uploaded .crawlrc file. An attacker
could possibly use this issue to execute arbitrary code.
Several security issues were fixed in Apache HTTP Server.
L'autorité italienne de protection des données (Garante) a publié une décision de sanction à l'encontre d'Elba Catering Distribuzioni s.r.l.s., comprenant le prononcé d'une amende de 2 000 €, pour des manquements en lien avec son système de vidéosurveillance.Cette affaire débute par un signalement d...
L'Autorité Nationale de Surveillance du Traitement des Données à Caractère Personnel (ANSPDCP) a publié une décision de sanction à l'encontre de Continental Automotive Products SRL, comprenant le prononcé d'une amende de 15 000 €, pour des manquements liés à la minimisation et à la sécurité des donn...
Ingram Micro says a ransomware attack exposed personal data of about 42,000 people, including names, birth dates, SSNs, and job-related details. Ingram Micro is a global technology distributor and supply-chain services company. It acts as a middleman between IT vendors (like Microsoft, Cisco, HP, Ap...
Le Comité européen de la protection des données (CEPD) a adopté un rapport sur l'application de la Directive Police-Justice ainsi que des recommandations sur les règles d'entreprise contraignantes pour les sous-traitants.Dans le cadre de l'évaluation de la Directive Police-Justice par la Commission...
L'Inspection nationale de la protection des données de Lettonie (DVI) a publié des éclaircissements sur la légalité de l'enregistrement secret d'une réunion professionnelle par un salarié.Un salarié qui enregistre une réunion de sa propre initiative devient responsable du traitement des données pers...
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
Permalink
The post Randall Munroe’s XKCD ‘Funny Numbers’ appeared first on Security Boulevard.