> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:
Agent Standup transforme vos sessions Claude Code, Codex et Mistral Vibe en appel visio animé, avec partage d'écran et replay. Gratuit, open source et local.
Le post Agent Standup : vos agents Claude Code et Codex réunis dans un appel visio pour suivre vos sessions a été publié sur IT-Connect.
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions. Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equi...
Every reply tells scammers your number is active, which makes it worth more on the dark web and a better target for fraud.
Mozilla lance Firefox Enterprise : une console de gestion hébergée chez vous, du DLP intégré et des contrôles sur l'IA pour gérer Firefox à l'échelle d'un parc.
Le post Mozilla dévoile Firefox Enterprise : une console on-premise pour piloter le navigateur sur vos PC a été publié sur IT-Connect.
It's 2026 and Virtzilla reckons it's OK to pay for MFA
CVSSv3 Score:
5.3
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiManager fgfmd daemon may allow a remote attacker impersonating a fortimanager cluster node to execute unauthorized code or commands via specially...
CVSSv3 Score:
7.7
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] in FortiMail webmail may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Revised on 2026-...
WhatsApp déploie l'envoi programmé de messages auprès de bêta-testeurs Android : jusqu'à deux semaines à l'avance, en privé comme dans les groupes.
Le post WhatsApp : la programmation des messages arrive en bêta sur Android a été publié sur IT-Connect.
CVSSv3 Score:
4.8
An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
7.9
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiAnalyzer, FortiManager, FortiManager Cloud and FortiAnalyzer Cloud may allow a low privileged user to execute arbitrary commands via crafted requests....
Un pirate russophone a compromis 429 sites WordPress en 61 secondes et volé 628 000 fiches ukrainiennes avec l'aide de 51 agents Claude Code.
Le post CyberXero : ce pirate a utilisé 51 agents Claude Code pour attaquer WordPress et l’Ukraine a été publié sur IT-Connect.
CVSSv3 Score:
9.6
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
4.9
An improper neutralization of script-related HTML tags in a web page in FortiManager and FortiAnalyzer may allow an attacker to perform a cross site scripting (XSS) attack via the Identify Provider name field.
Revised on 2026-10-13 00:00:00
Microsoft dévoile Maia 300 et fera de ses puces Maia le système d'inférence principal de Copilot et de ses services dès 2027, à l'échelle du gigawatt.
Le post Maia 300 : Microsoft fera de ses puces maison le moteur d’inférence de Copilot a été publié sur IT-Connect.
CVSSv3 Score:
6.7
An Improper Locking vulnerability [CWE-667] in FortiOS may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
4.9
A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests
Revised on 2026-10-13 00:00:00
Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of the initial outcomes. When the team gets a new set of charts, graphs and plots that visualize something, like performance, they offer an excellent oppo...
CVSSv3 Score:
2.1
A Double Free vulnerability [CWE-415] in FortiOS, FortiProxy and FortiSwitch may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.
Revised on 2026-10-13 00:00:00
CVSSv3 Score:
3.4
A missing authorization vulnerability [CWE-862] in FortiSIEM GUI may allow an authenticated attacker to execute unauthorized code or commands via Specially crafted HTTP requests
Revised on 2026-10-13 00:00:00