> TODAY'S SUMMARY (1272 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Microsoft has patched a zero-day vulnerability in Outlook (CVE-2026-124194) that is reportedly being actively exploited. Additionally, a serious vulnerability in Barracuda’s email security gateways could allow attackers root access to the devices. The ransomware attack on Vanderbilt University continues to unfold, with reports of significant data theft. Notably, Google has addressed its eighth Chrome zero-day of the year, emphasizing ongoing exploitation of browser vulnerabilities. Moreover, the rising trend of spyware targeting everyday users is alarming, with attackers increasingly infiltrating personal devices. Finally, a supply chain attack affecting Qubole has compromised sensitive customer data, further underlining the risks associated with third-party services.
|
// AI-powered summary generated at 20:00
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans les produits Synology. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Introducing Pathfinding.cloud, a library of AWS IAM privilege escalation paths
Une vulnérabilité a été découverte dans Mozilla Firefox. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
De multiples vulnérabilités ont été découvertes dans GLPI. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
Un cyberattaque prĂ©sumĂ©e a visĂ© le système financier du gouvernement de Sonora, provoquant la suspension temporaire des services numĂ©riques de la SecretarĂa de Hacienda. Les autoritĂ©s ont confirmĂ© des tentatives de piratage et ont initiĂ© une analyse pour contenir les risques. Les services ont Ă©tĂ© rĂ©...
In today's modern technological world, IT infrastructure must deliver uncompromising speed and reliability to meet the critical demands of the business. Centralized automated platforms, such as Red Hat Ansible Automation Platform, are essential for managing critical IT infrastructure. These platform...
Le Servicio Nacional de GeologĂa y MinerĂa (Sernageomin) a Ă©tĂ© victime d'une attaque informatique, ce qui a provoquĂ© une interruption temporaire de son portail institutionnel et de ses plateformes internes. Les protocoles d'urgence ont Ă©tĂ© activĂ©s pour protĂ©ger les opĂ©rations critiques et garantir l...
A Russian state-sponsored cyberespionage group has been targeting energy companies and critical infrastructure providers by exploiting misconfigurations in network-edge devices.
The group has been operating since at least 2021 and has exploited device misconfigurations befo...
A cyber attack hit Petróleos de Venezuela (PDVSA), Venezuela’s state-owned oil company, over the weekend, disrupting its export operations. Venezuela’s state oil company PDVSA was hit by a cyberattack over the weekend that disrupted export operations. The company says the incident only affected some...
The company was charged with materially misrepresenting the cybersecurity of its Token Bridge software as executives failed to implement reasonable security.
The post Illusory Systems settles with FTC over 2022 cryptocurrency hack appeared first on CyberScoop.
Misconfigured servers are in, 0-days out Chinese espionage crew Ink Dragon has expanded its snooping activities into European government networks, using compromised servers to create illicit relay nodes for future operations.…
A new Android malware-as-a-service (MaaS) named Cellik is being advertised on underground cybercrime forums offering a robust set of capabilities that include the option to embed it in any app available on the Google Play Store. [...]
Presently sponsored by: 1Password Extended Access Management: Secure every sign-in for every app on every device.Perhaps it's just the time of year where we all start to wind down a bit, or maybe I'm just tired after another massive 12 months, but this week's vid is way late. Ok, going away to the p...
Jean-Claude Graf, Sandro RĂĽegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to e...
The curl project moved over its source code hosting to GitHub in March 2010, but we kept the main bug tracker running like before – on Sourceforge. It took us a few years, but in 2015 we finally ditched the Sourceforge version fully. We adopted and switched over to the pull request model and we … Co...
A new campaign dubbed 'GhostPoster' is hiding JavaScript code in the image logo of malicious Firefox extensions counting more than 50,000 downloads, to monitor browser activity and plant a backdoor. [...]
Amazon GuardDuty and our automated security monitoring systems identified an ongoing cryptocurrency (crypto) mining campaign beginning on November 2, 2025. The operation uses compromised AWS Identity and Access Management (IAM) credentials to target Amazon Elastic Container Service (Amazon ECS) and...
Researchers with Google Threat Intelligence Group have detected five China-nexus threat groups exploiting the maximum-security React2Shell security flaw to drop a number of malicious payloads, from backdoors to downloaders to tunnelers.
The post Google Finds Five China-Nexus Groups Exploiting React...