> TODAY'S SUMMARY (120 articles)
Today's cybersecurity landscape highlights significant threats and vulnerabilities. Check Point has linked a suspected Chinese malware supplier to multiple hacking campaigns utilizing a shared malware framework. Meanwhile, critical flaws in Xen Orchestra have been exploited, allowing attackers to execute arbitrary code with admin privileges. Microsoft’s November Patch Tuesday addressed over 1,200 vulnerabilities, including a zero-day in Outlook that could leak NTLM hashes. Additionally, hackers are targeting Qlik Sense servers and exploiting vulnerabilities in Cisco BroadWorks and Openwave. Lastly, the rise of AI-enhanced impersonation fraud continues to pose challenges, with three arrests reported in connection to these schemes. Organizations are urged to prioritize patch management and enhance their security posture against evolving threats.
|
// AI-powered summary generated at 16:00
Fortinet announced new enhancements to FortiCNAPP that help organizations better understand and prioritize cloud risk beyond what many CNAPP solutions offer. By correlating cloud configuration, identity exposure, vulnerabilities, network enforcement, data sensitivity, and runtime behavior within a s...
Fortinet a confirmé l'existence d'une faille zero-day critique permettant de contourner l'authentification FortiCloud SSO. Protégez-vous de la CVE-2026-24858.
Le post Fortinet coupe le SSO en attendant les patchs pour la nouvelle faille zero-day : CVE-2026-24858 a été publié sur IT-Connect.
Teleport has unveiled the Teleport Agentic Identity Framework, an AI-centered framework that provides organizations with a roadmap for securely deploying agentic AI across production cloud and on-premises environments. The framework will evolve alongside the industry and community needs, defining th...
Yubico announced a significant expansion of YubiKey as a Service, introducing new capabilities that make modern organizations more agile and cyber resilient. With new Self-Service Ordering of YubiKeys enabled through a more streamlined Customer Portal, organizations can deliver phishing-resistance c...
Koi researchers found “PackageGate” flaws in NPM, PNPM, VLT, and Bun that let attackers perform supply chain attacks and run malicious code. Security firm Koi uncovered a set of vulnerabilities collectively tracked as “PackageGate” affecting major JavaScript package managers like NPM, PNPM, VLT, and...
Volante Technologies announced the launch of its Multi-cloud Resiliency Service, engineered to keep financial institutions’ payment operations running seamlessly during major cloud provider outages. Built on Volante’s cloud-native payments platform, the service provides cross-cloud continuity, elimi...
Indurex was founded by Jalal Bouhdada, who previously led industrial cybersecurity company Applied Risk.
The post Indurex Emerges From Stealth to Close Security Gap in Cyber-Physical Systems appeared first on SecurityWeek.
Pondurance launched RansomSnare, a new module for its MDR service that halts ransomware attacks at the moment the malicious process attempts to encrypt files and prevents threat actors from exfiltrating sensitive data. RansomSnare is a next-generation ransomware prevention capability that works by i...
To add an extra layer of protection to its end-to-end encryption, WhatsApp has begun rolling out a new privacy and security feature called Strict Account Settings. It is designed to help users protect their accounts from sophisticated cyberattacks. “We think you should be able to have a private conv...
Tracked as CVE-2026-24858, the bug allows attackers to log into devices registered to other FortiCloud accounts.
The post Fortinet Patches Exploited FortiCloud SSO Authentication Bypass appeared first on SecurityWeek.
You make delegation decisions every day.
Sometimes they look like management choices: who owns a workflow, which team runs a tool, how quickly something should ship. Other times, they barely register at all. You accept a default setting. You enable automation. You let a sys...
A total of 12 vulnerabilities have been fixed in OpenSSL, all discovered by a single cybersecurity firm.
The post High-Severity Remote Code Execution Vulnerability Patched in OpenSSL appeared first on SecurityWeek.
Google announced updates to the Android theft protection features that expand existing safeguards and make stolen devices harder to use. These updates are available on Android 16 and later. One update builds on Failed Authentication Lock, a feature introduced in Android 15 that locks the screen afte...
The Digital Services Act (DSA) Human Rights Alliance has, since its founding by EFF and Access Now in 2021, works to ensure that the European Union follows a human rights-based approach to platform governance by integrating a wide range of voices and perspectives to contextualise DSA enforcement and...
The Digital Services Act (DSA) Human Rights Alliance has, since its founding by EFF and Access Now in 2021, worked to ensure that the European Union follows a human rights-based approach to platform governance by integrating a wide range of voices and perspectives to contextualise DSA enforcement an...
A 149M-credential breach shows why encryption alone isn’t enough. Infostealer malware bypasses cloud security by stealing passwords at the endpoint—where encryption offers no protection.
The post Another Credential Leak, Another Dollar appeared first on Security Boulevard.
Three decades ago, when Steve Katz became the world’s first CISO at Citicorp/Citigroup, he quickly realized that his role was more than solving problems with tech. Katz had to communicate well, meet with C-level executives, and do anything in his power to reduce risk.
“The...
CERT UEFI Parser, a new open-source security analysis tool from the CERT Coordination Center has been released to help researchers and defenders examine the structure of Unified Extensible Firmware Interface (UEFI) software and identify classes of vulnerabilities that are often difficult to study. U...