> TODAY'S SUMMARY (53 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A notable authentication bypass vulnerability (CVE-2026-102895) has been identified in GPUStack, raising concerns for users managing AI workloads. Notion has confirmed a data breach affecting chat transcripts linked to its Fireworks AI service, although the impact is limited. Additionally, hackers are exploiting vulnerabilities in ScreenConnect and deploying malware, while a significant number of GitHub repositories have been compromised with credential-stealing payloads. The UK’s NCSC has launched a Cyber Adversary Testing initiative to enhance organizational resilience. Meanwhile, Maersk is facing a $5 million extortion demand following a data breach. Organizations are urged to adopt a proactive security mindset, emphasizing mitigation over traditional patching strategies.
|
// AI-powered summary generated at 12:00
The ‘download’ button on the official EmEditor website served a malicious installer.
The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek.
Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls. [...]
Privacy may be dead, but civilians are turning conventional wisdom on its head by surveilling the cops as much as the cops surveil them.
The React 19 library for building application interfaces was hit with a remote code vulnerability, React2Shell, about a month ago. However, as researchers delve deeper into the bug, the larger picture gradually unravels.
The vulnerability enables unauthenticated remote code...
The final weeks of 2025 did not arrive quietly. A single software flaw rippled across the internet, healthcare providers disclosed deeply personal data exposures, and millions of everyday devices quietly joined large scale attacks. As we step into 2026, the ColorTokens Threat Advisory brief captures...
From Donald Trump to DOGE to Chinese hackers, this year the internet's chaos caused outsized real-world harm.
Synthesia’s AI avatars revolutionizing digital media with realism and consent. Learn how these advancements impact trust and user experience.
The post Creating Hyperrealistic Deepfakes: The Challenges of Labeling appeared first on Security Boulevard.
Tech companies are increasingly warning their customers that they have been targeted by governments with advanced government spyware, such as NSO's Pegasus or Paragon's Graphite. What happens after receiving a threat notification?
As 2025 draws to a close, Tony looks back at the cybersecurity stories that stood out both in December and across the whole of this year
Dubbed MongoBleed, the high-severity flaw allows unauthenticated, remote attackers to leak sensitive information from MongoDB servers.
The post Fresh MongoDB Vulnerability Exploited in Attacks appeared first on SecurityWeek.
Cybersecurity researchers have disclosed details of what has been described as a "sustained and targeted" spear-phishing campaign that has published over two dozen packages to the npm registry to facilitate credential theft.
The activity, which involved uploading 27 npm packages from six different n...
Une faille de sécurité, surnommée MongoBleed (CVE-2025-14847), affecte plus de 87 000 instances MongoDB exposées sur le Web. Voici comment se protéger.
Le post MongoBleed : cette faille de sécurité expose les secrets de 87 000 serveurs MongoDB a été publié sur IT-Connect.
A hacker named Lovely made public 2.3 million records representing Wired subscriber information.
The post Hacker Claims Theft of 40 Million Condé Nast Records After Wired Data Leak appeared first on SecurityWeek.
Countries that banded together to challenge Boeing in the air try to do the same to AWS, Microsoft, and Google on the ground Feature More than half a century ago, a consortium of European aerospace businesses from the UK, France, Germany and Spain joined forces to take on America's Boeing. Fast for...
China-linked APT Evasive Panda used DNS poisoning to deliver the MgBot backdoor in targeted cyber-espionage attacks in Türkiye, China, and India. Kaspersky researchers spotted the China-linked APT group Evasive Panda (aka Daggerfly, Bronze Highland, and StormBamboo) running a targeted cyber-espionag...
A list of topics we covered in the week of December 22 to December 28 of 2025
A recently disclosed security vulnerability in MongoDB has come under active exploitation in the wild, with over 87,000 potentially susceptible instances identified across the world.
The vulnerability in question is CVE-2025-14847 (CVSS score: 8.7), which allows an unauthenticated attacker to remote...
Romance scams succeed because they feel human. New research shows that feeling no longer requires a person on the other side of the chat. The three stages of a romance-baiting scam Romance scams depend on scripted conversation Romance baiting scams build emotional bonds over weeks before steering vi...
The year of agentic AI came with promises of massive productivity gains for businesses, but the rush to adopt new tools and services also opened new attack paths in enterprise environments.
Here are some of the top security risks to the AI ecosystem that were revealed this...
D'après Google, les utilisateurs de Gmail vont pouvoir changer l'adresse e-mail @gmail.com de leur compte : voici ce qu'il faut savoir sur cette nouveauté.
Le post Messagerie : Google va enfin vous laisser changer votre adresse @gmail.com a été publié sur IT-Connect.