> TODAY'S SUMMARY (44 articles)
Today's cybersecurity landscape reveals significant threats impacting various sectors. A cyberattack targeting refrigeration systems in France has spoiled food across hundreds of supermarkets due to unpatched firmware vulnerabilities. Retail giant Ahold Delhaize has taken its systems offline following a cyber incident, indicating ongoing risks in the retail sector. GitLab has patched a critical vulnerability that could allow unauthenticated remote code execution, emphasizing the importance of timely updates. Additionally, a data breach in Denmark linked to weak passwords has compromised 8.8 million accounts. Emerging malware, such as XWorm RAT, is evolving to offer enhanced surveillance capabilities, posing new risks for user privacy. Lastly, low-cost Android phones are being shipped with pre-installed malware, raising concerns about supply chain security.
|
// AI-powered summary generated at 12:00
After years of negotiations, officials from around the world will convene in Hanoi this weekend for the signing of the landmark UN cybercrime convention.
Detailing an improved Cache Smuggling technique to turn 3rd party software into passive malware downloader.
A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code execution (RCE). [...]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft WSUS, and Adobe Commerce and Magento Ope...
SESSION Session 1A: WiFi and Bluetooth Security
PAPER Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack
In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijackin...
Redmond says it's fixed this particular indirect prompt injection vuln Microsoft fixed a security hole in Microsoft 365 Copilot that allowed attackers to trick the AI assistant into stealing sensitive tenant data – like emails – via indirect prompt injection attacks.…
The threat actors behind a large-scale, ongoing smishing campaign have been attributed to more than 194,000 malicious domains since January 1, 2024, targeting a broad range of services across the world, according to new findings from Palo Alto Networks Unit 42.
"Although these domains are registered...
House Oversight Committee Chairman James Comer wants the developer of the controversial dating-safety app TeaOnHer to explain if its privacy and content moderation practices adhere to federal law.
The Middle East is undergoing one of the fastest digital transformations in the world. National initiatives such as Saudi Vision 2030, Kuwait Vision 2035, and the UAE Digital Government Strategy are fueling large-scale modernization across every sector. However, as this progress accelerates, the reg...
A recent npm supply chain attack compromised 18 popular packages. This post explains how Cloudflare’s graph-based machine learning model, which analyzes 3.5 billion scripts daily, was built to detect and block exactly this kind of threat automatically.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
Permalink
The post Randall Munroe’s XKCD ‘’Ping” appeared first on Security Boulevard.
The percentage of companies choosing to pay ransoms dropped significantly,
while threat actors shift their tactics in response to decreasing profits.
The post Insider Threats Loom while Ransom Payment Rates Plummet appeared first on Security Boulevard.
Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with a proof-of-concept (Poc) exploit publicly available and has come under active exploitation in the wild.
The vulnerability in question is CVE-2025-59287 (CV...
Attackers are now exploiting a critical-severity Windows Server Update Service (WSUS) vulnerability, which already has publicly available proof-of-concept exploit code. [...]
Sean Cairncross, in remarks at a summit, also said the United States needs to send a stronger message that Chinese cyberattacks are unwelcome.
The post National cyber director says U.S. needs to counter Chinese surveillance, push American tech appeared first on CyberScoop.
Comparing WhatsApp, Discord, Snapchat, Facebook Messenger, and Telegram, based on their privacy settings and the amount of data they collect.
Europol disrupts SIM-box fraudsters, Jingle Thief exploits cloud identities for gift card theft, and PhantomCaptcha targets Ukrainian NGOs.
Cybersecurity researchers could face criminal charges for performing their legitimate work if the United Nations Convention against Cybercrime is ratified in a process beginning in Hanoi, Vietnam, this weekend, critics say.
Tech industry group Cybersecurity Tech Accord said...
Amazon says a major DNS failure was behind a massive AWS (Amazon Web Services) outage that took down many websites and online services on Monday. [...]
Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign We investigated a campaign waged by financially motivated threat actors operating out of Morocco. We refer to this campaign as Jingle Thief, due to the attackers’ modus operandi of conducting gift card fraud during festive seasons. Jingle...