> TODAY'S SUMMARY (195 articles)
Today's cybersecurity landscape highlights several critical trends and threats. Vanderbilt University is recovering from a cyberattack, with claims of stolen data yet to be confirmed. The Qilin ransomware group has reportedly targeted over 365 organizations in recent months, emphasizing the growing threat of ransomware affiliates. A significant number of vulnerabilities were addressed in Microsoft's November Patch Tuesday, including a zero-day flaw in Outlook that is actively exploited. Furthermore, recent reports indicate that hackers are leveraging AI tools for credential theft and impersonation fraud, raising concerns about the security of AI systems. Lastly, vulnerabilities in Cisco BroadWorks and Openwave systems are being actively exploited despite available patches, illustrating the ongoing challenge of timely vulnerability management.
|
// AI-powered summary generated at 20:00
Three vulnerabilities in Anthropic's Git server for the MCP can be exploited via prompt injection
Identity-based attacks are one of the primary paths attackers use to breach corporate networks. Tenfold shows how Identity Threat Detection helps spot suspicious account activity before real damage occurs. [...]
HackerOne has unveiled the Good Faith AI Research Safe Harbor, a new industry framework that establishes authorisation and legal protections for researchers testing AI systems in good faith. As AI systems scale rapidly across critical products and services, legal ambiguity around testing can slow re...
A fake ad blocker crashes your browser, then uses ClickFix tricks to make you run the malware yourself.
Ping Identity announced its Universal Services, a set of identity services that enable organizations to move beyond authentication and continuously establish, validate, and protect trust across every digital interaction. As impersonation attacks, synthetic identities, and AI-driven social engineerin...
Researchers with security firm Miggo used an indirect prompt injection technique to manipulate Google's Gemini AI assistant to access and leak private data in Google Calendar events, highlighting the challenges AI presents that traditional security measures can't address.
The post Exploiting Google...
PwC’s 29th Global CEO Survey shows cyber risk rising to the top of CEO concerns as confidence in short term business growth weakens
The two bugs, an arbitrary file read and an SSRF bug, can be exploited without user interaction to leak credentials, databases, and other data.
The post Chainlit Vulnerabilities May Leak Sensitive Information appeared first on SecurityWeek.
Forscher haben fünf bösartige Chrome-Erweiterungen entdeckt.T. Schneider – shutterstock.com
Forscher des Security-Anbieters Socket haben eine koordinierte Kampagne entdeckt, die auf bösartigen Chrome-Add-ons basiert. Die Angreifer haben die Abwehrmechanismen des Chrome Web S...
Update Chainlit to the latest version ASAP Two "easy-to-exploit" vulnerabilities in the popular open-source AI framework Chainlit put major enterprises' cloud environments at risk of leaking data or even full takeover, according to cyber-threat exposure startup Zafran.…
Â
The post When Security Incidents Break: The Questions Every CISO Asks (And How We Securely Built a Solution in Record Time) appeared first on Security Boulevard.
A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions.
"These flaws can be exploited through promp...
Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT).
The activity delivers "weaponized files via Dynamic Link Library (DLL) sideloading, combined wi...
Learn how security leaders and SOC teams can work together to close the gap between platform decisions and operational needs. Join Sumo Logic and BleepingComputer on January 29 for a practical webinar on aligning security tools with real-world workflows. [...]
A 40-year-old Jordanian man has admitted to selling unauthorized access to computer networks of at least 50 companies, the US Attorney’s Office of the District of New Jersey has announced. Feras Khalil Ahmad Albashiti has pleaded guilty last Thursday to fraud and related activity in connection with...
Cybersecurity Researchers at ReliaQuest warn of an ongoing campaign delivered to “high-value individuals” via LinkedIn messages
British authorities are rolling out Report Fraud, a platform intended to win back public trust over how law enforcement responds to widespread cybercrime and fraud.
Prompt injection for the win Anthropic has fixed three bugs in its official Git MCP server that researchers say can be chained with other MCP tools to remotely execute malicious code or overwrite files via prompt injection.…
Canada’s Investment Regulator Confirms Data Breach Affecting 750,000 Investors The Canadian Investment Regulatory Organization (CIRO) has confirmed that a sophisticated phishing attack it suffered in August 2025 impacted approximately 750,000 Canadian investors. After more than 9,000 hours of forens...
At its core, Chainalysis is a data company with a dataset that maps the global cryptocurrency ecosystem, providing unmatched intelligence…
The post Introducing Workflows: No-Code Automation for Data-Scientist-Level Blockchain Insights appeared first on Chainalysis.