> TODAY'S SUMMARY (19 articles)
Today's cybersecurity landscape reveals significant threats and trends. Microsoft has patched two dozen remote code execution (RCE) flaws in Office, alongside other security issues, highlighting ongoing vulnerabilities in widely used software. A data breach at CenterPoint Energy has exposed personal information of over 1 million Texans, indicating continued risks for utility companies. Additionally, BeyondTrust has warned of a critical zero-day flaw in its Remote Support software, actively exploited since August. In a worrying trend, stolen AI API keys are being used for automated cyber scans, raising concerns about the misuse of legitimate technology. Lastly, the cybersecurity job market is experiencing a downturn, with postings hitting a four-year low, exacerbating the ongoing talent shortage in the field.
|
// AI-powered summary generated at 08:00
The Democratic senator from Arizona believes that global AI standards must include American values around civil rights, privacy and safety.Â
The post Sen. Mark Kelly:Â Investing in safe, secure AI is key to U.S. dominance appeared first on CyberScoop.
'Dozens' of US orgs infected Chinese cyberspies maintained long-term access to critical networks – sometimes for years – and used this access to infect computers with malware and steal data, according to Thursday warnings from government agencies and private security firms.…
Cloudflare CEO Matthew Prince claims the internet infrastructure company’s efforts to block AI crawlers are already seeing big results.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a new OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an OpenPLC ScadaBR flaw, tracked as CVE-2021-26828 (CVSS Score of 8.7), to its Known Exp...
The Cybersecurity and Infrastructure Security Agency (CISA), NSA and Canadian Centre for Cyber Security published an advisory on Thursday outlining the BRICKSTORM malware based off an analysis of eight samples taken from victim organizations.
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. For the oldstable distribution (bookworm), these problems have been fixed in version 143.0.7499.40-1~deb12u1.
He's not alone: DoD inspector general says the whole Defense Department has a messaging security problem US Defense Secretary Pete Hegseth definitely broke the rules when he sent sensitive information to a Signal chat group, say Pentagon auditors, but he's not the only one using insecure messaging,...
The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed "Aladdin" that compromised specific targets when simply viewing a malicious advertisement. [...]
CUPS could be made to stop responding if it received specially crafted network traffic.
It was discovered that incorrect handling of promiscuous NS RRSets in Unbound, a validating, recursive, caching DNS resolver, could result in cache poisoning. For the stable distribution (trixie), this problem has been fixed in version 1.22.0-2+deb13u1.
We discuss the CVSS 10.0-rated RCE vulnerabilities in the Flight protocol used by React Server Components. These are tracked as CVE-2025-55182 and CVE-2025-55182-66478.
The post Critical Vulnerabilities in React Server Components and Next.js appeared first on Unit 42.
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed an out-of-bounds read vulnerability in PDF XChange Editor, and ten vulnerabilities in Socomec DIRIS Digiware M series and Easy Config products.The vulnerabilities mentioned in this blog post have been patched by their respec...
The security of operational technology (OT) in critical infrastructure has been a recurring theme for years, but this week the US National Security Agency (NSA) and its global partners added a new concern to the mix: how the increasing use of AI in OT risks making things worse...
The journalism nonprofit Reporters Without Borders and another organization reported phishing attempts to cybersecurity researchers, who tied them to a Russia-linked group known as Callisto, ColdRiver or Star Blizzard.
And then they asked an AI to help cover their tracks Vetting staff who handle sensitive government systems is wise, and so is cutting off their access the moment they're fired. Prosecutors say a federal contractor learned this the hard way when twin brothers previously convicted of hacking-related o...
The 30-year-old Virginia resident evaded capture for years after authorities discovered pipe bombs planted near buildings in Washington, DC, the day before the January 6, 2021, Capitol attack.
Police have used facial recognition in Britain since 2017 and controversy has mounted as more aggressive deployments have been undertaken, including live facial recognition which involves processing real-time video footage of people passing a camera.
Russian telecommunications watchdog Roskomnadzor has blocked access to Apple's FaceTime video conferencing platform and the Snapchat instant messaging service, claiming they're being used to coordinate terrorist attacks. [...]
Ways to protect against the dangerous React4Shell vulnerability (CVE-2025-55182) in React server components (RSC).
The Ministry of Communications on had asked smartphone makers to install the government’s “Sanchar Saathi” app within 90 days and to prevent users from disabling it.
The post India Rolls Back Order to Preinstall Cybersecurity App on Smartphones appeared first on SecurityWeek.