> TODAY'S SUMMARY (135 articles)
Today's cybersecurity news highlights several critical threats and trends. Weak SQL Server passwords have been exploited to deploy cryptominers and Gh0st RAT, emphasizing the need for stronger credential management. A critical remote code execution vulnerability (CVE-2026-119618) in Apache's HTTP/2 module has been patched, affecting numerous servers. The WhiteArmor gang has claimed responsibility for a data breach at shipping giant Maersk, demanding a $5 million ransom for the stolen data. Additionally, law enforcement has dismantled the infrastructure behind Gootloader, CastleRAT, and StealC malware operations, recovering over 6 million stolen credentials. As cyber threats evolve, organizations must adopt proactive security measures and stay updated on vulnerabilities within their systems.
|
// AI-powered summary generated at 16:00
Tracked as CVE-2025-37164, the critical flaw could allow unauthenticated, remote attackers to execute arbitrary code.
The post HPE Patches Critical Flaw in IT Infrastructure Management Software appeared first on SecurityWeek.
5 min readTrue zero trust requires verified identity at every request and eliminating static credentials entirely.
The post Identity Over Network: Why 2026 Zero Trust Is About Who/What, Not Where appeared first on Aembit.
The post Identity Over Network: Why 2026 Zero Trust Is About Who/What, Not W...
NIS2 puts identity and access controls under the spotlight, with weak passwords and poor authentication now a compliance risk. Specops Software explains how to align password policies and MFA with NIS2 requirements. [...]
Hewlett Packard Enterprise (HPE) has resolved a maximum-severity security flaw in OneView Software that, if successfully exploited, could result in remote code execution.
The critical vulnerability, assigned the CVE identifier CVE-2025-37164, carries a CVSS score of 10.0. HPE OneView is an IT infras...
Flaw in remote-access appliance lets attackers chain bugs for root-level takeover SonicWall has warned customers of a zero-day flaw in its SMA 1000 remote-access appliance that's being actively exploited, potentially allowing attackers to escalate privileges and take over boxes.…
Apiiro introduced Apiiro AI SAST, a new approach to static application security testing (SAST) that automates code risk detection, validation and fixes with the precision and cognitive process of an expert application security engineer. Grounded in Apiiro’s patented Deep Code Analysis (DCA), Apiiro...
Our dependence on digital infrastructure has grown exponentially amid unprecedented technological advancements. With this reliance comes an increasingly threatening landscape and expanding attack surfaces. As cyberthreats become more sophisticated, so must our defensive strategies. Enter large lang...
Cloudflare’s R2 SQL, a distributed query engine, now supports aggregations. Explore how we built distributed GROUP BY execution, using scatter-gather and shuffling strategies to run analytics directly over your R2 Data Catalog.
Between June 2024 and December 2025, Fortra analysts tracked a persistent business email compromise (BEC) operation that we have now classified as Scripted Sparrow. The group carries out well-crafted highly targeted phishing campaigns that masquerade as professional services firms to mislead finance...
AppGate announced the launch of Agentic AI Core Protection, a new capability within AppGate ZTNA designed to secure AI workloads deployed in enterprise core environments across on-prem and cloud venues. This innovation enables organizations to embrace AI-driven transformation while maintaining robus...
Justice Department claims unlicensed exchange funneled ransomware profits US feds have dismantled a crypto laundering service that they say helped cybercrooks wash tens of millions of dollars in dirty digital cash, seizing its servers and unsealing charges against an alleged Russian operator.…
Jeudi 18 décembre 2025, le Sénat a adopté une proposition de loi pour limiter l’exposition précoce aux écrans, encadrer les réseaux sociaux et organiser une prévention structurée, de la santé à l’école....
It was discovered that c-ares, a library that performs DNS requests and name resolution asynchronously, does not properly handle termination of queries which may result in denial of service. For the stable distribution (trixie), this problem has been fixed in version 1.34.5-1+deb13u1.
French authorities arrested two crew members of an Italian passenger ferry suspected of infecting the ship with malware that could have enabled them to remotely control the vessel. [...]
CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in ASUS Live Update to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The flaw ori...
Attackers are targeting Microsoft 365 users with device code authorization phishing, a technique that fools users into approving access tokens, Proofpoint warns. The method abuses Microsoft’s OAuth 2.0 device authorization grant flow by presenting users with device codes that, when entered, inadvert...
Criminals are tricking WhatsApp users into linking an attacker’s browser to their account using fake login pages and routine-looking prompts.
Cybercriminals are spreading the Stealka infostealer disguised as game cheats, mods, and pirated software. It targets sensitive information, cryptocurrency, and account credentials
In a decision that only affects Pennsylvanians but could have privacy implications elsewhere, the state's Supreme Court ruled that police did not need a warrant to access a rape suspect's Google searches.
A recent OpenAI-related breach via third-party provider Mixpanel exposes how AI supply chain vulnerabilities enable phishing, impersonation, and regulatory risk—even without direct system compromise.
The post What the Latest OpenAI Security Breach Reveals About the State of AI Protection appeared...