> TODAY'S SUMMARY (15 articles)
Today's cybersecurity landscape highlights several critical threats and trends. Attackers are exploiting a command injection vulnerability in SiteGuard WAF, allowing them to execute commands as root or SYSTEM on compromised servers. In another development, the Rust-based CikaBika bot is turning Discord into a command center for executing malicious activities and stealing files from infected Windows systems. Meanwhile, two vulnerabilities in HAProxy have been identified that could lead to denial of service attacks. Data breaches continue to pose significant risks, with the FFTir organization reporting a 40 GB data leak including sensitive information. Additionally, the cybersecurity job market shows a 26% decline in postings, although demand for AI security engineers is rising, indicating a shift in the industry.
|
// AI-powered summary generated at 16:00
Information published.
Information published.
Threat actors with ties to the Democratic People's Republic of Korea (DPRK or North Korea) have been instrumental in driving a surge in global cryptocurrency theft in 2025, accounting for at least $2.02 billion out of more than $3.4 billion stolen from January through early December.
The figure repr...
Information published.
Think your Kindle is harmless? Think again! In this episode, we unpack a Black Hat Europe talk revealing how a boobytrapped audiobook could exploit the Amazon eBook reader - potentially letting an attacker break into your account and seize control of your credit card.
Plus a blast from 2021's "su...
Explore homomorphic encryption for privacy-preserving analytics in Model Context Protocol (MCP) deployments, addressing post-quantum security challenges. Learn how to secure your AI infrastructure with Gopher Security.
The post Homomorphic Encryption for Privacy-Preserving MCP Analytics in a Post-Qu...
A Chinese-linked threat group identified as “Ink Dragon” is targeting common weaknesses in Internet Information Services (IIS) servers to build a global espionage network that is difficult to track or disrupt, security vendor Check Point has reported.
Also nicknamed “Earth...
Une vulnérabilité a été découverte dans Sonicwall Secure Mobile Access. Elle permet à un attaquant de provoquer une élévation de privilèges. Sonicwall indique que cette vulnérabilité est exploitée conjointement avec la vulnérabilité CVE-2025-23006 qui permet une exécution de code arbitraire à...
Une vulnérabilité a été découverte dans les produits Cisco. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance avec les droits administrateurs. Cisco indique que cette vulnérabilité est activement exploitée et fournit des recommandations dans son bulletin de...
La commission scolaire Eastern Townships a détecté une attaque informatique visant ses serveurs, mais ses bases de données ne semblent pas avoir été affectées. Les équipements à l’origine de l’attaque ont été identifiés et mis hors fonction. Les services informatiques ne seront pas disponibles le le...
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer des problèmes de sécurité non spécifiés par l'éditeur.
Creating a golden image of an operating system (OS) is a popular and recommended practice for deploying a new system to any environment, whether it's a data center or public cloud. This enables rapid deployment of systems that are easy to maintain and conforms to your unique Standard Operating Envi...
Earthbound Holding, LLC experienced a data security incident on December 18, 2025, which may have involved personal information, including names and Social Security numbers. The incident was discovered on December 18, 2025, and the company took steps to secure the network and investigate. The breach...
La société Aesto, LLC a été victime d'un incident de sécurité réseau qui a affecté une partie limitée de son infrastructure Amazon Web Services, exposant potentiellement des informations de santé protégées. L'incident s'est produit entre le 2 décembre 2025 et le 18 décembre 2025. Aesto ne dispose d'...
The Zeroday Cloud hacking competition in London has awarded researchers $320,000 for demonstrating critical remote code execution vulnerabilities in components used in cloud infrastructure. [...]
Attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits, earning the defect the highest verified public exploit count of any CVE ever.
The post React2Shell fallout spreads to sensitive targets as public exploits hit all-time high appeared first on...
No timeline for a patch Suspected Chinese-government-linked threat actors have been battering a maximum-severity Cisco AsyncOS zero-day vulnerability in some Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances for nearly a month, and there's no timeline for a fix.…
In July 2016, the Web Hosting Talk forum suffered a data breach that was subsequently listed for sale. The breach of the vBulletin based forum exposed 515k user records including usernames, email addresses, IP addresses and salted MD5 password hashes.
Plus: automated SBOMs, $250,000 bounties ahead interview No good idea - like rewarding open source software developers and maintainers for their contributions - goes unabused by cybercriminals, and this was the case with the Tea Protocol and two token farming campaigns.…
French authorities arrested a 22-year-old suspect on Tuesday for a cyberattack that targeted France's Ministry of the Interior earlier this month. [...]