> TODAY'S SUMMARY (120 articles)
Today's cybersecurity landscape highlights significant threats and vulnerabilities. Check Point has linked a suspected Chinese malware supplier to multiple hacking campaigns utilizing a shared malware framework. Meanwhile, critical flaws in Xen Orchestra have been exploited, allowing attackers to execute arbitrary code with admin privileges. Microsoft’s November Patch Tuesday addressed over 1,200 vulnerabilities, including a zero-day in Outlook that could leak NTLM hashes. Additionally, hackers are targeting Qlik Sense servers and exploiting vulnerabilities in Cisco BroadWorks and Openwave. Lastly, the rise of AI-enhanced impersonation fraud continues to pose challenges, with three arrests reported in connection to these schemes. Organizations are urged to prioritize patch management and enhance their security posture against evolving threats.
|
// AI-powered summary generated at 16:00
The protections against NPM supply chain attacks could be bypassed, leading to arbitrary code execution.
The post ‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks appeared first on SecurityWeek.
At first glance, an email address ending in .eu.org looks trustworthy. It feels institutional, maybe even official. Many people implicitly associate it with Europe, nonprofits, or established organizations.
That assumption is wrong more often than you might expect.
Because the domain looks legitimat...
HackerOne announced Agentic Pentest as a Service (Agentic PTaaS), delivering continuous security validation by combining autonomous agent execution with human expertise to ensure every finding reflects exploitable risk that security teams can trust and act on at scale. Enterprise security teams face...
French govt says state-run service 'Visio' will be more secure. Now where have we heard that name before? France has officially told Zoom, Teams, and the rest of the US videoconferencing herd to take a hike in favor of its own homegrown app.…
Microsoft Purview Data Security Investigations is now available. The tool is part of Microsoft Purview and is intended for scenarios such as data breach and leak investigations, credential exposure, internal fraud and bribery, sensitive data exposure in Teams, and inappropriate content investigation...
The US Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory mapping post-quantum cryptography (PQC) standards to common enterprise hardware and software categories, giving CIOs and security teams an early reference for evaluating quantum-safe tec...
Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509) Microsoft released emergency Office security updates to fix a security feature bypass vulnerability (CVE-2026-21509) that its threat intelligence and security teams spotted being exploited in the wild in ze...
Amazon Web Services has added IPv6 support to IAM Identity Center through new dual-stack endpoints. The update allows identity services to operate over IPv6 networks while continuing to support IPv4. The change applies to access portals, managed applications, and service APIs that use dual-stack dom...
Teleport unveils an agentic identity framework that secures AI agents without passwords, replacing static credentials with cryptographic, zero-trust identities to reduce breach risk.
The post Teleport Launches Framework to Secure Identities of AI Agents appeared first on Security Boulevard.
It was discovered that jaraco.context incorrectly handled certain zip file
paths. An attacker could possibly use this issue to extract arbitrary files
outside of the intented extraction directory.
The British Home Office published proposals that would include the creation of a new National Police Service, described by officials as Britain’s equivalent of the FBI.
TL;DR After emerging at the start of the pandemic, Chinese-language money laundering networks (CMLNs) now dominate known crypto money laundering…
The post Chinese Language Money Laundering Networks Emerge as Major Facilitators of the Illicit Crypto Economy, Now Driving 20% of Laundering Activity app...
Quantum computers are coming, with a potential computing power almost beyond comprehension.
The post Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI appeared first on SecurityWeek.
Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data.
The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek.
Hackers have stolen the personal and contact information belonging to over 29.8 million SoundCloud user accounts after breaching the audio streaming platform's systems. [...]
Austrian education ministry unaware of tracking software until campaigners launched case Microsoft illegally installed cookies on a school pupil's devices without consent, according to a ruling by the Austrian data protection authority (DSB).…
Un pirate revendique l’attaque d’une clinique esthétique et menace de vendre les données médicales de plus de 10 000 patients. Chaque patient est "vendu" 2€ !...
ADF PRO 6.2.0 is here—bringing new app updates (Snapchat, Telegram, TikTok, Tinder, WhatsApp), Apple Wallet support, smarter analysis views, and a streamlined acquisitions screen, all shaped by user feedback—request your free trial today.
The US Supreme Court is considering the constitutionality of geofence warrants.
The case centers on the trial of Okello Chatrie, a Virginia man who pleaded guilty to a 2019 robbery outside of Richmond and was sentenced to almost 12 years in prison for stealing $195,000 at gunpoint.
Police probing th...
AI is now everywhere within enterprises. Many CISOs I speak with feel stuck between wanting to move forward and not knowing where to begin. The fear of getting both security’s use of AI and securing AI within the organization wrong often stops their process before it begins. T...