> TODAY'S SUMMARY (47 articles)
Today's cybersecurity landscape highlights a growing concern over AI-driven threats. The UK's National Cyber Security Centre (NCSC) warns that AI-powered attacks, particularly in ransomware, could target critical infrastructure by 2028, as legacy systems remain vulnerable. Meanwhile, a significant breach at Revolve has compromised the card details of up to 1.5 million customers, and a data breach at Harvard University has exposed 851,000 accounts. On the botnet front, Google has dismantled the XCPE botnet, which leveraged over 1.3 million devices for malicious activities. Additionally, ongoing exploitation of critical vulnerabilities, such as those in Siemens IoT devices and CryptoPayment Gateway plugins, underscores the urgent need for robust cybersecurity measures. The prevalence of AI in both attacks and defenses continues to shape the threat landscape, necessitating immediate action from organizations.
|
// AI-powered summary generated at 12:00
It's 2026 and Virtzilla reckons it's OK to pay for MFA
CVSSv3 Score:
5.3
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially...
CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Revised on 2026-...
WhatsApp déploie l'envoi programmé de messages auprès de bêta-testeurs Android : jusqu'à deux semaines à l'avance, en privé comme dans les groupes.
Le post WhatsApp : la programmation des messages arrive en bêta sur Android a été publié sur IT-Connect.
CVSSv3 Score:
4.8
An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
7.9
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests....
Un pirate russophone a compromis 429 sites WordPress en 61 secondes et volé 628 000 fiches ukrainiennes avec l'aide de 51 agents Claude Code.
Le post CyberXero : ce pirate a utilisé 51 agents Claude Code pour attaquer WordPress et l’Ukraine a été publié sur IT-Connect.
CVSSv3 Score:
9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
4.9
An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field.
Revised on 2026-10-13 00:00:00
Microsoft dévoile Maia 300 et fera de ses puces Maia le système d'inférence principal de Copilot et de ses services dès 2027, à l'échelle du gigawatt.
Le post Maia 300 : Microsoft fera de ses puces maison le moteur d’inférence de Copilot a été publié sur IT-Connect.
CVSSv3 Score:
6.7
An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
4.9
A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests
Revised on 2026-10-13 00:00:00
Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of the initial outcomes. When the team gets a new set of charts, graphs and plots that visualize something, like performance, they offer an excellent oppo...
CVSSv3 Score:
2.1
A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
3.4
A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Revised on 2026-10-13 00:00:00
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies.
The activity, which targets Android devices built on MediaTek platforms across several br...
CVSSv3 Score:
9.4
An Improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.
Revised on 2026-10-13 00:00:00
AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology creates consequences we cannot easily reverse. I learned the importance of that res...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Genesis World. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.8.