> TODAY'S SUMMARY (1272 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Microsoft has patched a zero-day vulnerability in Outlook (CVE-2026-124194) that is reportedly being actively exploited. Additionally, a serious vulnerability in Barracuda’s email security gateways could allow attackers root access to the devices. The ransomware attack on Vanderbilt University continues to unfold, with reports of significant data theft. Notably, Google has addressed its eighth Chrome zero-day of the year, emphasizing ongoing exploitation of browser vulnerabilities. Moreover, the rising trend of spyware targeting everyday users is alarming, with attackers increasingly infiltrating personal devices. Finally, a supply chain attack affecting Qubole has compromised sensitive customer data, further underlining the risks associated with third-party services.
|
// AI-powered summary generated at 20:00
The promise of personal AI assistants rests on a dangerous assumption: that we can trust systems we haven’t made trustworthy. We can’t. And today’s versions are failing us in predictable ways: pushing us to do things against our own best interests, gaslighting us with doubt about things we are or th...
We’re getting Sigstore’s rekor-monitor ready for production use, making it easier for developers to detect tampering and unauthorized uses of their identities in the Rekor transparency log. This work, funded by the OpenSSF, includes support for the new Rekor v2 log, certificate validation, and integ...
For years, compliance has been one of the most resource-intensive responsibilities for cybersecurity teams. Despite growing investments in tools, the day-to-day reality of compliance is still dominated by manual, duplicative tasks. Teams chase down screenshots, review spreadsheets, and cross-c...
A significant portion of cyber breaches begin with one simple issue: weak passwords. With modern cracking tools capable of testing billions of combinations per second, many passwords that users consider “strong” can be compromised in minutes — sometimes even faster.This makes password strength an im...
In 2025, we set out with a simple mission: take Burp Suite on the road and meet the global AppSec community where you are. Burp On Tour was born from our desire to learn from you; the brilliant people
Wiz says React2Shell attacks accelerating, ranging from cryptominers to state-linked crews Half of the internet-facing systems vulnerable to a fast-moving React remote code execution flaw remain unpatched, even as exploitation has exploded into more than a dozen active attack clusters ranging from b...
Free unofficial patches are available for a new Windows zero-day vulnerability that allows attackers to crash the Remote Access Connection Manager (RasMan) service. [...]
NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems Researchers have disclosed a newly identified Windows backdoor called NANOREMOTE that abuses the Google Drive API for command‑and‑control functions. The malware can execute commands, transfer files, and steal data covertl...
Elastic found a new Windows backdoor, NANOREMOTE, similar to FINALDRAFT/REF7707, using the Google Drive API for C2. Elastic Security Labs researchers uncovered NANOREMOTE, a new Windows backdoor that uses the Google Drive API for C2. Elastic says it shares code with the FINALDRAFT (Squidoor) implant...
All critical vulnerabilities in Microsoft, third-party, and open source code are eligible for rewards if they impact Microsoft services.
The post Microsoft Bug Bounty Program Expanded to Third-Party Code appeared first on SecurityWeek.
Les mises à jour de décembre 2025 sont là : KB5072033 pour Windows Server 2025 et KB5071547 pour Windows Server 2022. Voici un récapitulatif des changements.
Le post Le point sur les mises à jour de décembre 2025 pour Windows Server a été publié sur IT-Connect.
Notepad++ found a vulnerability in the way the software updater authenticates update files.Â
The post Notepad++ Patches Updater Flaw After Reports of Traffic Hijacking appeared first on SecurityWeek.
The National Cyber Security Centre has released new learnings from a cyber deception pilot
After years of trying VPNs for myself, privacy-minded family members, and a few mission-critical projects, here’s what I wish everyone knew.
Discord consomme trop de RAM sur Windows, mais des optimisations sont en cours, comme le redémarrage automatique si l'application consomme plus de 4 Go de RAM.
Le post Windows 11 : Discord travaille sur des améliorations pour consommer moins de RAM a été publié sur IT-Connect.
The browser has become the main interface to GenAI for most enterprises: from web-based LLMs and copilots, to GenAI‑powered extensions and agentic browsers like ChatGPT Atlas. Employees are leveraging the power of GenAI to draft emails, summarize documents, work on code, and analyze data, often by c...
Cyberkriminelle haben Daten bei der Gemeindeverwaltung Untereisesheim gestohlen und im Darknet veröffentlicht. BeeBright – shutterstock.com
Mitte Oktober funktionierte im Rathaus Untereisesheim fast nichts mehr. Die Gemeindeverwaltung war Ziel eines Cyberangriffs, bei dem I...
Introduction Between July 2024 and February 2025, 6 suspicious image files were uploaded to VirusTotal. Thanks to a lead from Meta, these samples came to the attention of Google Threat Intelligence Group. Investigation of these images showed that these images were DNG files targeting the Quram libra...
CISA has ordered U.S. federal agencies to patch a critical GeoServer vulnerability now actively exploited in XML External Entity (XXE) injection attacks. [...]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds an OSGeo GeoServer flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an OSGeo GeoServer flaw, tracked as CVE-2025-58360 (CVSS Score of 8.2), to its Known Exploi...