> TODAY'S SUMMARY (150 articles)
Today’s cybersecurity news highlights significant vulnerabilities and trends. Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 flaws, including three zero-day vulnerabilities, emphasizing the critical need for timely updates. Ivanti Connect Secure is under scrutiny for zero-day vulnerabilities that allow attackers to gain root access, with the U.S. CISA listing it as a known exploited vulnerability. Meanwhile, small AI models are raising alarms for their potential to self-replicate across IoT devices, posing new security risks. In retail, Ahold Delhaize is investigating a cyberattack that forced the company to disconnect systems, while recent attacks have also disrupted refrigeration systems in French supermarkets, leading to significant food waste. Additionally, vulnerabilities in Docker Hub and GitLab highlight ongoing risks in software supply chains, underscoring the importance of robust security measures across platforms.
|
// AI-powered summary generated at 20:00
Barak Gross discovered that some Intel® Xeon® processors with SGX enabled
did not properly handle buffer restrictions. A local authenticated user
could potentially use this issue to escalate their privileges.
(CVE-2025-20053)
Avinash Maddy discovered that some Intel® processors did not properly
iso...
GlassWorm malware resurfaces in Open VSX and GitHub, infecting VS Code extensions weeks after its removal from the official marketplace. GlassWorm malware has resurfaced on the Open VSX registry and newly appeared in GitHub repositories, infecting three more VS Code extensions just weeks after its r...
CISA ordered U.S. federal agencies today to patch a critical Samsung vulnerability that has been exploited in zero-day attacks to deploy LandFall spyware on devices running WhatsApp. [...]
It was discovered that Incus, a system container and virtual machine manager, is prone to a local privilege escalation vulnerability unprivileged users are allowed access to Incus through incus-user.
California's influential privacy agency sent the state legislature three proposals, including a measure to create anti-retaliation safeguards and financial rewards for insiders who make regulators aware of corporate practices that violate state privacy law.
A Russian national will plead guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks that targeted at least eight U.S. companies between July 2021 and November 2022. [...]
A Russian national will plead guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks that targeted at least eight U.S. companies between July 2021 and November 2022. [...]
Resolution acquiesced to by 8 Dems includes CISA Act funding, layoff reversals, and could be easily undone The US Senate voted on Sunday to advance a short-term funding bill for the federal government, moving the country closer to ending its longest-ever shutdown. Part of the spending bill also rest...
It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.
It was discovered that sudo-rs incorrectly handled the targetpw and r...
One company alone was hit with more than 4,200 emails More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign.…
A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. [...]
Amazon Web Services (AWS) is excited to announce that the latest version of Information Security Registered Assessors Program (IRAP) report (2025 H1) is now available through AWS Artifact. An independent Australian Signals Directorate (ASD) certified IRAP assessor completed the IRAP assessment of AW...
NSO Group announced Friedman’s appointment on Sunday, saying that NSO’s three founders no longer have any stake in the firm.
Ce tutoriel explique comment créer un réseau privé NAT sur un serveur Proxmox VE, avec la configuration d'une règle de port forwarding.
The post Proxmox VE : découvrez comment créer un réseau privé avec NAT first appeared on IT-Connect.
When we launched the Secure Future Initiative, our mission was clear: accelerate innovation, strengthen resilience, and lead the industry toward a safer digital future. Today, we’re sharing our latest progress report that reflects steady progress in every area and engineering pillar, underscoring ou...
A new study has revealed 65% of top AI firms have leaked sensitive data on GitHub, risking $400bn in assets
FileFix — the latest variation of the ClickFix attack using social engineering. How this scheme works, and how to protect your company against FileFix.
A deep dive into architecture, security, and practical implementation for developers who want to truly understand MCP
The post MCP for Technical Professionals: A Comprehensive Guide to Understanding and Implementing the Model Context Protocol appeared first on Security Boulevard.
Wiz found the secrets and warned that they can expose training data, organizational structures, and private models.
The post Many Forbes AI 50 Companies Leak Secrets on GitHub appeared first on SecurityWeek.
Volexity has linked spear phishing operations to China-aligned UTA0388 in new campaigns using advanced tactics and LLMs