> TODAY'S SUMMARY (7 articles)
Today's cyber news highlights several key threats and trends. Hackers are increasingly targeting AI systems, as demonstrated by a recent incident where credentials were stolen, leading to $740,000 in unauthorized compute usage for a cloud provider. Microsoft researchers revealed vulnerabilities in AI models, showing that attackers can create backdoors by manipulating just a few neurons. Additionally, recent updates for Slackware address critical security issues, including remote code execution and memory errors in their httpd and Git packages. The ongoing risk of vehicle hacking is underscored by a podcast discussing how attackers can gain control over car systems. As cyber threats evolve, organizations must prioritize robust security measures against these emerging vulnerabilities.
|
// AI-powered summary generated at 04:00
Ransomware remains the biggest concern for CISOs in 2026, according to WEF’s Global Cybersecurity Outlook 2026 report.
The post Cyber Fraud Overtakes Ransomware as Top CEO Concern: WEFÂ appeared first on SecurityWeek.
Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes relat...
CVSSv3 Score:
5.7
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in FortiVoice may allow a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.
Revised on 2026-01-13 00:00:00
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
CVSSv3 Score:
6.8
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or...
Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.
CVSSv3 Score:
7.4
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiSwitchManager cw_acd daemon may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Revised on 2026-01-13 00:00:00
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally.
CVSSv3 Score:
3.4
A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in FortiSandbox may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.
Revised on 2026-01-13 00:00:00
Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVSSv3 Score:
9.3
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiFone Web Portal page may allow an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.
Revised on 2026-01-13 00:00:00
Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.
CVSSv3 Score:
9.4
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests.
Revised on 2026-01-13 00:00:00...
Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.