> TODAY'S SUMMARY (68 articles)
Today's cybersecurity landscape highlights several critical threats and developments. The new Hirudo Android malware is particularly concerning, as it replaces legitimate banking apps to steal credentials while evading security measures. Additionally, Microsoft's October Patch Tuesday saw a record 1,413 vulnerabilities addressed, including a zero-day actively exploited in the wild. Researchers also demonstrated the potential dangers of AI, with one team creating a full-chain Chrome exploit in just six days using public AI models. Meanwhile, fake "Meta Careers" pages are being used to phish Facebook and Google logins, emphasizing the ongoing risk of credential theft. Lastly, a crackdown on North Korean IT farms highlights the geopolitical dimensions of cyber threats.
|
// AI-powered summary generated at 12:01
For decades, the United States has built its defense posture around predictable timelines for technological progress. That assumption no longer holds, according to researchers at Los Alamos National Laboratory. Their paper argues that AI is advancing so quickly that the current defense system cannot...
This vulnerability allows remote attackers to bypass authentication on affected installations of NVIDIA AIStore. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-33186.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NVIDIA AIStore. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-33185.
Depuis octobre 2025, une nouvelle faille dans Fortinet FortiWeb est exploitée pour créer des comptes admins à distance, sans authentification : patchez !
The post Fortinet FortiWeb : des pirates créent des comptes admins avec cette faille dont un exploit est disponible ! first appeared on IT-Connect...
Executives may debate AI strategy, but many of the advances are happening at the employee level. A recent Moveworks study shows that AI adoption is being led from the ground up, with employees, not senior leaders, driving the change. The research found that large companies are seeing non-technical e...
Hereâs a look at the most interesting products from the past week, featuring releases from Action1, Avast, Cyware, Firewalla, and Nokod Security. Action1 addresses Intune gaps with patching and risk-based vulnerability prioritization Action1 announced new integrations that extend Microsoft Intune wi...
DoorDash has disclosed a data breach that hit the food delivery platform this October. Beginning yesterday evening, DoorDash, which serves millions of customers across the U.S., Canada, Australia, and New Zealand, started emailing those impacted by the newly disclosed security incident. [...]
A Fortinet FortiWeb path traversal vulnerability is being actively exploited to create new administrative users on exposed devices without requiring authentication [...]
Overview On November 12, NSFOCUS CERT detected that Microsoft released the November Security Update patch, which fixed 63 security issues involving widely used products such as Windows, Microsoft Office, Microsoft SQL Server, Azure, and Microsoft Visual Studio, including privilege escalation, high-r...
New research released Thursday by Rubrik Zero Labs finds that the AI wave, and in particular agentic AI, has created a âtroubling gap between the expanding identity attack surface and organizationsâ ability to recover from resulting compromises.â
According to the report, Id...
Maintenance to end next year after âhelpful optionsâ became âserious security flawsâ Kubernetes maintainers have decided itâs not worth trying to save Ingress NGINX and will instead stop work on the project and retire it in March 2026.âŠ
Explore self-sovereign identity (SSI) in authentication systems, its benefits, technical components, and practical applications for enterprise SSO and CIAM solutions.
The post Defining Self-Sovereign Identity in Authentication Systems appeared first on Security Boulevard.
Explore different authentication provider types (social, passwordless, MFA) and learn best practices for choosing the right one to enhance security and user experience in your applications.
The post Authentication Provider Types: A Guide to Best Practices appeared first on Security Boulevard.
Amazon Inspector security researchers have identified and reported over 150,000 packages linked to a coordinated tea.xyz token farming campaign in the npm registry. This is one of the largest package flooding incidents in open source registry history, and represents a defining moment in supply chain...
What do the Secure-by-Design and "Secure-by-Default" badges really mean?
The post âSecure-by-Designâ and âSecure-by-Defaultâ Badges from SecureIQLab â and Why They Matter in WAAP appeared first on SecureIQ Lab.
The post âSecure-by-Designâ and âSecure-by-Defaultâ Badges from SecureIQLab â and Why The...
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Elles permettent à un attaquant de provoquer un problÚme de sécurité non spécifié par l'éditeur.
Weâve been dedicated to advancing Red Hat Advanced Cluster Security for Kubernetes in line with the rapid evolution of Kubernetes security. With version 4.9, weâre introducing key integrations and updates designed to help streamline your workflows. To that end, weâve improved our ability to integrat...
Une vulnérabilité a été découverte dans Cisco Catalyst Center. Elle permet à un attaquant de provoquer une élévation de privilÚges.