> TODAY'S SUMMARY (19 articles)
Today's cybersecurity landscape is marked by several critical threats and trends. Recently patched vulnerabilities in Barracuda devices are being actively exploited, allowing attackers root access. Cisco's BroadWorks and Openwave flaws are also under attack despite available patches. Apple has addressed Bluetooth and AirPlay vulnerabilities, reinforcing the need for prompt patching as 45% of EU IT service providers delay critical updates. New malware threatens Exchange servers, and leaked exploit kits are compromising iPhones via ads. Additionally, Microsoft released a substantial patch update addressing 1,094 vulnerabilities, including a critical zero-day in Outlook that risks credential theft. Cybersecurity resilience remains a priority as organizations grapple with the rising tide of AI-discovered vulnerabilities.
|
// AI-powered summary generated at 08:00
Italian authorities have fined Internet security company Cloudflare $16.3 as a result of the content delivery network specialist's refusal to block access to pirate sites on its 1.1.1.1 DNS service.
The post Cloudflare Says ‘Non C’è Modo’ (No Way) In Defiance of Italy Piracy Shield Law appeared fir...
Parrot OS is a Debian-based Linux distribution built for cybersecurity work. Security practitioners use it for penetration testing, digital forensics, malware analysis, and privacy-focused research. The operating system bundles security tools, development utilities, and privacy features into a maint...
Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access.
"The infection chain follows a ti...
Discover why business email remains mission-critical infrastructure, and how governance, automation, and AI integration future-proof it.
The post Email is Not Legacy. It’s Infrastructure. appeared first on Security Boulevard.
Explore how Russia's efforts to control the probiv market highlight the challenges of data leaks, insider threats, and the conflict between control and security.
The post Russia’s Crackdown on Probiv Data Leaks May Have Fed the Beast Instead appeared first on Security Boulevard.
Security teams are dealing with pressures tied to AI use, geopolitical instability, and expanding cybercrime that reach beyond technical controls, according to findings from the World Economic Forum’s Global Cybersecurity Outlook 2026. AI drives risk growth and defensive change Respondents view AI a...
Ransomware remains the biggest concern for CISOs in 2026, according to WEF’s Global Cybersecurity Outlook 2026 report.
The post Cyber Fraud Overtakes Ransomware as Top CEO Concern: WEF appeared first on SecurityWeek.
Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes relat...
CVSSv3 Score:
5.7
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiVoice may allow a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Revised on 2026-01-13 00:00:00
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSSv3 Score:
6.8
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or...
Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.
CVSSv3 Score:
7.4
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiSwitchManager cw_acd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Revised on 2026-01-13 00:00:00
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally.
CVSSv3 Score:
3.4
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in FortiSandbox may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.
Revised on 2026-01-13 00:00:00
Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.