> TODAY'S SUMMARY (120 articles)
Today's cybersecurity landscape highlights significant threats and vulnerabilities. Check Point has linked a suspected Chinese malware supplier to multiple hacking campaigns utilizing a shared malware framework. Meanwhile, critical flaws in Xen Orchestra have been exploited, allowing attackers to execute arbitrary code with admin privileges. Microsoft’s November Patch Tuesday addressed over 1,200 vulnerabilities, including a zero-day in Outlook that could leak NTLM hashes. Additionally, hackers are targeting Qlik Sense servers and exploiting vulnerabilities in Cisco BroadWorks and Openwave. Lastly, the rise of AI-enhanced impersonation fraud continues to pose challenges, with three arrests reported in connection to these schemes. Organizations are urged to prioritize patch management and enhance their security posture against evolving threats.
|
// AI-powered summary generated at 16:00
Dependency management used to be a private embarrassment: an Ant script, a /lib folder, and classpath roulette. You could ship anyway, and the consequences mostly stayed inside your org.Â
The post Trust At Scale: The Commons, Threats, and AI in the Loop | Sonatype appeared first on Security Bo...
Sonatype warns that open source threats became industrialized with a surge in malicious packages in 2025
A recent Forbes investigation revealed that Microsoft has allegedly been handing over Bitlocker encryption recovery keys to law enforcement when served with warrants. Microsoft says it receives about 20 such requests annually. Taken narrowly, this may appear to be a routine case of lawful compliance...
Chainalysis claims Chinese money launderers now account for 20% of global activity
When security teams discuss credential-related risk, the focus typically falls on threats such as phishing, malware, or ransomware. These attack methods continue to evolve and rightly command attention. However, one of the most persistent and underestimated risks to organizational security remains f...
Teams using automation platforms are starting to treat conversational AI as another operational interface. That change is reflected in a new feature from n8n, which has introduced a built-in Chat Hub designed to let users interact with AI models and internal automation through a single chat interfac...
France intends to phase out non-European videoconferencing platforms such as Zoom and Microsoft Teams from its public administration, opting instead for a nationally developed solution due to security considerations. Ending the use of paid software licenses is expected to generate significant saving...
New Strict Account Settings allow users to block attachments and media and silence calls from unknown people.
The post WhatsApp Boosts Account Security for At-Risk Individuals appeared first on SecurityWeek.
One vendor. Many engines. The same security problems. In boardrooms across the globe, a compelling narrative dominates enterprise security strategy: consolidate the security stack to reduce complexity, lower costs, and improve operational efficiency. Fewer vendors promise simpler management, cleaner...
ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation
Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads.
"Discovered and patched in July 2025,...
We are doing another curl + distro online meeting this spring in what now has become an established annual tradition. A two-hour discussion, meeting, workshop for curl developers and curl distro maintainers. 2026 curl distro meeting details The objective for these meetings is simply to make curl bet...
McAfee announced upgrades to Scam Detector that improve protection across common scam channels. The enhanced tool helps users check QR code safety and identify suspicious direct messages across apps. In 2025, according to McAfee’s 2026 State of the Scamiverse report, Americans were hit hard by onlin...
Dogfooding is often talked about as a best practice, but I don't often see the results of such activities. For all new features introduced on Report URI, we are always the first to try them out and see how they work. In this post, we'll look
Privileged access management (PAM) has always been about ensuring least privilege. But the nature of enterprise cybersecurity — on top of the complexity of system operations — has prompted far too many users to log in at the highest possible privilege and stay there, even when...
Cybersecurity researchers have discovered two malicious packages in the Python Package Index (PyPI) repository that masquerade as spellcheckers but contain functionality to deliver a remote access trojan (RAT).
The packages, named spellcheckerpy and spellcheckpy, are no longer available for download...
A total of 87 individuals, mostly Venezuelan nationals, have been charged for their role in the ATM jackpotting scheme.
The post US Charges 31 More Defendants in Massive ATM Hacking Probe appeared first on SecurityWeek.
If you've installed a browser extension to enhance your ChatGPT experience, you might want to think again.
Read more in my article on the Hot for Security blog.
Cloudbrink has expanded security and performance benefits for AI agents and online AI services. The new AI capabilities are available on the same platform as Cloudbrink’s secure connectivity, allowing companies to secure users, apps, and AI in a more unified way. According to a McKinsey report, 88 p...
Russian and Chinese state-sponsored threat actors have been exploiting CVE-2025-8088 since July 2025.
The post APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability appeared first on SecurityWeek.