> TODAY'S SUMMARY (120 articles)
Today's cybersecurity landscape highlights significant threats and vulnerabilities. Check Point has linked a suspected Chinese malware supplier to multiple hacking campaigns utilizing a shared malware framework. Meanwhile, critical flaws in Xen Orchestra have been exploited, allowing attackers to execute arbitrary code with admin privileges. Microsoft’s November Patch Tuesday addressed over 1,200 vulnerabilities, including a zero-day in Outlook that could leak NTLM hashes. Additionally, hackers are targeting Qlik Sense servers and exploiting vulnerabilities in Cisco BroadWorks and Openwave. Lastly, the rise of AI-enhanced impersonation fraud continues to pose challenges, with three arrests reported in connection to these schemes. Organizations are urged to prioritize patch management and enhance their security posture against evolving threats.
|
// AI-powered summary generated at 16:00
People rush to AI bots for their most sensitive tasks these days without security leading the way. The Moltbot frenzy reminds us we just wrote about this recently – the difference between AI security noise and high-impact threats. AI Security Lessons from the MoltBot Incident For folks who jumped i...
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
Permalink
The post Randall Munroe’s XKCD ‘Conic Sections’ appeared first on Security Boulevard.
Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users:
Other noteworthy stories that might have slipped under the radar: Apple updates platform security guide, LastPass detects new phishing wave, CISA withdraws from RSA Conference.
The post In Other News: Paid for Being Jailed, Google’s $68M Settlement, CISA Chief’s ChatGPT Leak appeared first on Securi...
Jan 30, 2026 - Alan Fagan - Quick Facts: AI Compliance ToolsManual tracking often falls short: Spreadsheets cannot track the millions of API calls and prompts generated by modern AI systems.Real-time is required: The best AI compliance tools monitor live traffic, not just static policy documents.Fra...
La Commission Nationale de l'Informatique et des Libertés (CNIL) a réactivé son observatoire des élections pour encadrer l'utilisation des données personnelles durant la campagne pour les élections municipales des 15 et 22 mars 2026.L'autorité de contrôle portera une attention particulière au respec...
Le Comité européen de la protection des données (CEPD) prépare des lignes directrices sur le traitement des données personnelles dans le cadre de la publicité politique ciblée en ligne, en application du nouveau règlement européen.En vue de l'élaboration de ces lignes directrices au niveau de l'Unio...
Microsoft announced that it will disable the 30-year-old NTLM authentication protocol by default in upcoming Windows releases due to security vulnerabilities that expose organizations to cyberattacks. [...]
L'Autorité Nationale de Surveillance du Traitement des Données à Caractère Personnel (ANSPDCP) a publié une décision de sanction à l'encontre d'un responsable du traitement personne physique, comprenant le prononcé d'une amende de 10 000 €, pour des manquements liés à la gestion d'un site web publia...
La Commission Nationale de l'Informatique et des Libertés (CNIL) et le Commissariat à la protection de la vie privée du Canada ont conclu une déclaration de coopération visant à renforcer leur collaboration sur les défis posés par les nouvelles technologies.Signée le 10 décembre 2025 en marge de la...
Google's dual-purpose crawler creates an unfair AI advantage. To protect publishers and foster competition, the UK’s Competition and Markets Authority must mandate crawler separation for search and AI.
The Polish government accused a Russian government hacking group of hacking into energy facilities taking advantage of default usernames and passwords.
The latest phase of the global law enforcement action resulted in seizing three industrial-scale illegal IPTV services. [...]
A comprehensive developer guide to implementing secure authentication in modern applications. Covers OAuth 2.0, OIDC, passwordless authentication, passkeys, and enterprise SSO with production-ready code examples.
The post The Complete Guide to Authentication Implementation for Modern Applications ap...
Seoul Metropolitan Police, as part of their investigation into the data breach at online retail giant Coupang, brought in acting CEO Harold Rogers.
Session 10D: Machine Unlearning
Authors, Creators & Presenters: Derui Wang (CSIRO's Data61), Minhui Xue (CSIRO's Data61), Bo Li (The University of Chicago), Seyit Camtepe (CSIRO's Data61), Liming Zhu (CSIRO's Data61)
PAPER
Provably Unlearnable Data Examples
The exploitation of publicly accessib...
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Cryptographic API;
- Padata parallel execution mechanism;
- Netfilter;
(CVE-2022-49698, CVE-2025-21726, CVE-2025...
CrowdStrike assessed that two new threat actor groups have spun off from North Korean Labyrinth Chollima hackers
The actions impaired some of IPIDEA’s proxy infrastructure, but not all of it. The effort underscores the back-and-forth struggle of taking out pieces of cybercriminals’ vast and growing infrastructure.
The post Google’s disruption rips millions out of devices out of malicious network appeared first...
From an Anthropic blog post:
In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attacks on networks with dozens of hosts using only standard, open-source tools, instead of the custom tools needed by previous generations. This illustrates how...