> TODAY'S SUMMARY (53 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A notable authentication bypass vulnerability (CVE-2026-102895) has been identified in GPUStack, raising concerns for users managing AI workloads. Notion has confirmed a data breach affecting chat transcripts linked to its Fireworks AI service, although the impact is limited. Additionally, hackers are exploiting vulnerabilities in ScreenConnect and deploying malware, while a significant number of GitHub repositories have been compromised with credential-stealing payloads. The UK’s NCSC has launched a Cyber Adversary Testing initiative to enhance organizational resilience. Meanwhile, Maersk is facing a $5 million extortion demand following a data breach. Organizations are urged to adopt a proactive security mindset, emphasizing mitigation over traditional patching strategies.
|
// AI-powered summary generated at 12:00
The New York Police Department's “mosque-raking” program targeted Muslim communities across NYC. Now, as the city's first Muslim mayor takes office, one man is fighting—again—to fully expose it.
Automaker's third security snafu in three years Thousands of Nissan customers are learning that some of their personal data was leaked after unauthorized access to a Red Hat-managed server, according to the Japanese automaker.…
Aflac, one of the largest insurance companies in the U.S., confirmed hackers stole reams of personal data, including Social Security numbers, identity documents, and health information.
In 2024, EFF wrote our initial blog about what could go wrong when police let AI write police reports. Since then, the technology has proliferated at a disturbing rate. Why? The most popular generative AI tool for writing police reports is Axon’s Draft One, and Axon also happens to be the largest pr...
The US legal profession was just one of the pillars of American democracy that was targeted in the early days of the second Trump administration. At EFF, we were proud to publicly and loudly support the legal profession and, most importantly, continue to do our work challenging the government’s eros...
A newly discovered macOS malware mimics legitimate apps code-signed and notarized by Apple
Each December we take a moment to publish a series of blog posts that look back at the things we’ve accomplishes in fighting for your rights and privacy the past 12 months. But this year I’ve been thinking not just about the past 12 months, but also over the past 25 years I’ve spent at EFF.  As many...
The MacSync Stealer macOS malware can now infect victims’ computers using what appears to be a legitimate application with minimal user interaction, according to Apple device management and security vendor Jamf.
Until now, macOS campaigns needed to persuade users to launch...
Redmond gets in early for the twelve whoopsies of Christmas Microsoft has hustled out an out-of-band update to address a Message Queuing issue introduced by the December 2025 update.…
Crooks used fraudulent ads on major search engines to mimic banks and harvest people's login credentials, netting at least $14.6 million, the U.S. authorities said in announcing a takedown of the operation.
In this session of the Strategic CISOs webinar series, Sravish Sridhar (CEO, TrustCloud) sat down with Myke Lyons (CISO, Cribl) and Jon Zayicek (Customer Security Assurance Leader, Cribl) to break down how Cribl built a customer trust program that helps buyers self-serve proof, reduces questionnaire...
A University of Phoenix data breach affecting nearly 3.5 million individuals has been claimed by the Clop ransomware collective
Session 7A: Network Security 2
Authors, Creators & Presenters: Stijn Pletinckx (University of California, Santa Barbara), Christopher Kruegel (University of California, Santa Barbara), Giovanni Vigna (University of California, Santa Barbara)
PAPER
A Large-Scale Measurement Study Of The PROXY Pr...
Cyber risk is often discussed in technical language, often in a way which is difficult to decipher the real business impact. CVSS scores, vulnerabilities, attack paths and threat actors all have their place but for many decision‑makers, this language doesn’t translate into real-world business outcom...
France's postal service, La Poste, said it was hit by a disruptive cyberattack that knocked its services offline.
For most of its life inside the enterprise, Salesforce was treated as “just” a critical application, a powerful CRM that needed strong profiles, roles, and sharing rules, and maybe some Shield features if you had the budget. That world is gone. Today, Salesforce is the hub of an ecosystem that incl...
Is Santa Claus real? This Christmas special of The AI Fix podcast sets out to answer that question in the most sensible way possible: by consulting chatbots, Google's festive killjoys, and the laws of relativistic physics.
Your hosts unwrap a festive grab-bag of AI absurdity as Waymo self-driving...
A critical flaw in the n8n automation platform could allow attackers to execute arbitrary code if exploited under specific conditions. Researchers warn that a critical vulnerability, tracked as CVE-2025-68613 (CVSS score of 9.9), in the n8n workflow automation platform could allow attackers to achie...
For observers of crypto regulation, December 2024 feels like a long time ago. The global policy landscape today looks markedly…
The post 2025 Crypto Regulatory Round-Up: What Changed and What’s Ahead appeared first on Chainalysis.
The Uzbek government's national license plate scanning system was discovered exposed to the internet for anyone to access without a password.