> TODAY'S SUMMARY (15 articles)
Today's cybersecurity landscape highlights several critical threats and trends. Attackers are exploiting a command injection vulnerability in SiteGuard WAF, allowing them to execute commands as root or SYSTEM on compromised servers. In another development, the Rust-based CikaBika bot is turning Discord into a command center for executing malicious activities and stealing files from infected Windows systems. Meanwhile, two vulnerabilities in HAProxy have been identified that could lead to denial of service attacks. Data breaches continue to pose significant risks, with the FFTir organization reporting a 40 GB data leak including sensitive information. Additionally, the cybersecurity job market shows a 26% decline in postings, although demand for AI security engineers is rising, indicating a shift in the industry.
|
// AI-powered summary generated at 16:00
2026 marks a critical turning point for cybersecurity leaders as AI-driven threats, data sovereignty mandates, and hybrid infrastructure risks reshape the CISO agenda. Discover the strategic priorities that will define tomorrowâs security posture.
The post 2026 Cyber Predictions: Accelerating AI, D...
Attackers abuse WhatsAppâs device-linking feature to hijack accounts via pairing codes in the GhostPairing campaign. Attackers are exploiting WhatsAppâs device-linking feature to hijack accounts using pairing codes in a campaign dubbed GhostPairing, without requiring authentication. Gen Digital firs...
Since the end of the year is quickly approaching, it is undoubtedly a good time to look back at what the past twelve months have brought to usùŠ And given that the entire cyber security profession is about protecting various systems from ĂąÂÂbad thingsù (and we've all correspondingly seen more tha...
The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2025-14174 Apple and the Google Threat Analysis Group discovered that processing maliciously crafted web content may lead to memory
srcset="https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock_2144734163.jpg?quality=50&strip=all 8786w, https://b2b-contenthub.com/wp-content/uploads/2025/12/shutterstock_2144734163.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthu...
Seeing a "no DMARC record found" error for your domain? Learn what it means, how it exposes you to spoofing and BEC, and how to move safely to p=reject.
The post No DMARC record found: Fix this critical mistake appeared first on Security Boulevard.
Information published.
Information published.
The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics (formerly CJ Korea Express).
"The threat actor leveraged QR codes...
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
The post China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear appeared first on SecurityWeek.
'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network.
In this Help Net Security interview, Ăystein Thorvaldsen, CISO at KSAT, discusses how adversaries view the ground segment as the practical way to reach space systems and why stations remain a focal point for security efforts. He notes that many risks stem from supply chain gaps and legacy infrastruc...
Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.
Smaller firms are far less likely than multinationals to protect their CISOs from personal liability for security breaches, according to a study by RSAC.
Experts quizzed by CSO said the finding was concerning because without protection CISOs face legal and financial risk ti...
Regulatory limits on explicit targeting have not stopped algorithmic profiling on the web. Ad optimization systems still adapt which ads appear based on usersâ private attributes. At the same time, multimodal LLMs have lowered the barrier for turning these hidden signals into profiling tools. A new...
AI use is expanding faster than the infrastructure that supports it, and that gap is starting to matter for security, resilience, and access. A new position paper argues that access to AI should be treated as an intergenerational civil right, rather than a service shaped mainly by market forces. The...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The f...