> TODAY'S SUMMARY (19 articles)
Today's cybersecurity landscape highlights several significant threats and trends. North Korean hackers are using stolen U.S. identities to impersonate IT workers, targeting companies and generating $3 million. A supply-chain attack via ConnectWise has compromised Microsoft 365 tenants, prompting security measures. Drupal has patched critical vulnerabilities that could allow remote code execution, while cybersecurity researchers discovered a malicious npm package involved in supply chain attacks. Additionally, AI agents are reportedly accessing Indian organizations undetected, raising concerns about the use of offensive AI in cyberattacks. Meanwhile, ongoing phishing operations are targeting various platforms, and notable disruptions in European supermarkets and U.S. bankruptcy notifications have been linked to cyber incidents.
|
// AI-powered summary generated at 20:01
Microsoft closed out the year with 1,139 total defects patched, making it the second-largest year in volume behind 2020, according to Trend Micro.
The post Microsoft’s last Patch Tuesday of 2025 addresses 57 defects, including one zero-day appeared first on CyberScoop.
Microsoft says Windows PowerShell now warns when running scripts that use the Invoke-WebRequest cmdlet to download web content, aiming to prevent potentially risky code from executing. [...]
The Experience Manager security update resolves 117 vulnerabilities, including 116 identified as cross-site scripting (XSS) bugs.
The post Adobe Patches Nearly 140 Vulnerabilities appeared first on SecurityWeek.
Microsoft has addressed a Windows vulnerability exploited as zero-day that allows attackers to obtain System privileges.
The post Microsoft Patches 57 Vulnerabilities, Three Zero-Days appeared first on SecurityWeek.
Tempo, the new high-performance Layer-1 blockchain incubated by Stripe and Paradigm, is being built from the ground up to power…
The post Tempo Developers Get a Head Start: Hexagate Brings Real-Time Monitoring to the Testnet appeared first on Chainalysis.
L’autorité espagnole de protection des données a publié une décision de sanction à l’encontre de l’Agence espagnole des médicaments et des produits sanitaires (AEMPS), comprenant le prononcé d’une amende pour des manquements liés à une violation de données personnelles affectant les registres nation...
This release addresses 57 vulnerabilities. 3 of these vulnerabilities are rated critical. One vulnerability was already exploited, and two were publicly disclosed before the patch was released.
Jeppe Bonde Weikop discovered that Netty incorrectly parsed HTTP
messages. When Netty is used with certain reverse proxies, a
remote attacker could possibly use this issue to perform HTTP request
smuggling attacks. (CVE-2025-58056)
Jonas Konrad discovered that Netty did not properly manage memory w...
L’autorité espagnole de protection des données (AEPD) a publié une décision de sanction à l’encontre de SPORT & SPA GEST, S.L. (NIF B97827778), comprenant le prononcé d’une amende totale de 20 000 € pour des manquements relatifs au traitement de données personnelles dans le cadre de l’utilisatio...
L'autorité italienne de protection des données a aujourd'hui publié une décision à l'encontre de Quarantadue S.r.l. (comprenant le prononcé d'une amende de 40 000 €) pour des manquements liés à la diffusion non justifiée de données personnelles dans une série télévisée.Cette affaire débute par une p...
Promotions across Microsoft’s security organization reinforce the company’s shift toward AI-driven defense and tighter operational oversight under Global CISO Igor Tsyganskiy.
The post Microsoft Names New Operating CISOs in Strategic Move to Strengthen Cyberdefense appeared first on SecurityWeek.
L’autorité espagnole de protection des données a publié une décision de sanction à l’encontre de BARCELONESA DE DROGAS Y PRODUCTOS QUÍMICOS S.A.U. ("BARCELONESA"), comprenant le prononcé d’une amende de 186 000 € pour des manquements liés à une violation de données personnelles affectant des données...
L’autorité espagnole de protection des données a publié une décision de sanction à l’encontre de l’Association Nationale des Experts et Experts Judiciaires en Informatique (NIF G86165743), comprenant le prononcé d’une amende totale de 2 000 € pour des manquements relatifs à l’information des personn...
Microsoft has released the KB5071546Â extended security update to resolve 57 security vulnerabilities, including three zero-day flaws. [...]
Several security issues were fixed in fontTools.
Noma Security today revealed it has discovered a vulnerability in the enterprise edition of Google Gemini that can be used to inject a malicious prompt that instructs an artificial intelligence (AI) application or agent to exfiltrate data. Dubbed GeminiJack, cybercriminals can use this vulnerabilit...
In the brand new Planet Hollywood Poker Room, 48 digital rights supporters played No-Limit Texas Hold’Em in the 4th Annual EFF Benefit Poker Tournament at DEF CON, raising $18,395 for EFF.
img_5930.jpg
The tournament was hosted by EFF board member Tarah Wheeler and...
Microsoft's December 2025 Patch Tuesday fixes 57Â flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication. [...]
Threat actors with ties to North Korea have likely become the latest to exploit the recently disclosed critical security React2Shell flaw in React Server Components (RSC) to deliver a previously undocumented remote access trojan dubbed EtherRAT.
"EtherRAT leverages Ethereum smart contracts for comma...