> TODAY'S SUMMARY (110 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Cybercriminals are increasingly targeting everyday users with spyware, indicating a shift towards more indiscriminate attacks. Additionally, vulnerabilities in widely used platforms like SAP and Google Chrome have been actively exploited, with SAP releasing critical patches for multiple flaws. The Russian state-linked Turla group continues to pose a threat, using advanced tools like "Cereal" to intercept emails from government servers. Meanwhile, supply chain attacks remain a concern, evidenced by the recent Qubole incident, which compromised numerous organizations' credentials. Overall, the rise in cloud vulnerabilities and the exploitation of AI in cyberattacks are emerging as critical areas for organizations to address.
|
// AI-powered summary generated at 16:00
Microsoft addressed over 1,100 CVEs as part of Patch Tuesday releases in 2025, including 40 zero-day vulnerabilities.
Key takeaways:
Microsoft's 2025 Patch Tuesday releases addressed 1,130 CVEs. This is the second year in a row where the CVE count was over 1,000.
Elevation of Privilege vulnerabil...
React2Shell continues to witness heavy exploitation, with threat actors leveraging the maximum-severity security flaw in React Server Components (RSC) to deliver cryptocurrency miners and an array of previously undocumented malware families, according to new findings from Huntress.
This includes a L...
The state of streaming is... bad. It’s very bad. The first step in wanting to watch anything is a web search: “Where can I stream X?” Then you have to scroll past an AI summary with no answers, and then scroll past the sponsored links. After that, you find out that the thing you want to watch was ma...
Posted by Chrome Root Program Team
Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure...
Session 5C: Federated Learning 1
Authors, Creators & Presenters: Phillip Rieger (Technical University of Darmstadt), Alessandro Pegoraro (Technical University of Darmstadt), Kavita Kumari (Technical University of Darmstadt), Tigist Abera (Technical University of Darmstadt), Jonathan Knauer (Tec...
The Cybersecurity and Infrastructure Security Agency (CISA), alongside several other U.S. and international agencies, released an advisory covering the cyberattacks launched by CyberArmyofRussia_Reborn (CARR), NoName057(16) and several related groups.
Officials in Cambridge, Massachusetts, and Eugene, Oregon, found that some Flock Safety license plate readers were still active after the municipalities asked for services to be terminated.
Microsoft is working on a new Teams security feature that will analyze suspicious traffic with external domains to help IT administrators tackle potential security threats. [...]
New research has uncovered exploitation primitives in the .NET Framework that could be leveraged against enterprise-grade applications to achieve remote code execution.
WatchTowr Labs, which has codenamed the "invalid cast vulnerability" SOAPwn, said the issue impacts Barracuda Service Center RMM, I...
AttackIQ has issued recommendations in response to the Cybersecurity Advisory (CSA) released by the Cybersecurity and Infrastructure Security Agency (CISA) on December 9, 2025, which details the ongoing targeting of critical infrastructure by pro-Russia hacktivists.
The post Response to CISA Advisor...
The U.S. National Institute of Standards and Technology (NIST) is building a taxonomy of attack and mitigations for securing artificial intelligence (AI) agents. Speaking at the AI Summit New York conference, Apostol Vassilev, a research team supervisor for NIST, told attendees that the arm of the...
L’autorité coréenne de protection des données a publié une décision invitant la société Coupang à améliorer ses conditions d’utilisation, ses procédures de suppression de compte, ainsi que ses mesures de notification et de prévention des préjudices secondaires à la suite d’une fuite de données.Cette...
Cisco Vulnerability Management (formerly Kenna) has long been a valuable partner for security teams. With its end-of-life now underway, Tenable One offers a clear path forward, delivering end-to-end unified exposure management for the future of risk management.
Key takeaways:
Tenable’s strong part...
L'Agence espagnole de protection des données (AEPD) lance le Laboratoire de l'AEPD, un espace dédié à la production de connaissance, à l'analyse prospective, à la coopération et à la diffusion de bonnes pratiques en matière de protection des données.Le Laboratoire, projet inscrit au Plan stratégique...
L’autorité nationale de contrôle de la protection des données personnelles a publié une décision de sanction à l’encontre de Crowd Entertainment Limited, comprenant le prononcé d’une amende de 15 000 € pour des manquements relatifs à la gestion des demandes d’accès aux données personnelles.Cette aff...
More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys. [...]
L’autorité espagnole de protection des données a publié une décision de sanction à l’encontre de ONEY SERVICIOS FINANCIEROS EFC, S.A. (ONEY), comprenant le prononcé d’une amende de 90 000 € pour des manquements liés à la sécurité des données personnelles dans son espace client en ligne.Cette affaire...
The insights gained from Cybersecurity Awareness Month, right through to Microsoft Ignite 2025, demonstrate that security remains a top priority for business leaders.
The post From awareness to action: Building a security-first culture for the agentic AI era appeared first on Microsoft Security Blog...
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
Permalink
The post Randall Munroe’s XKCD ‘Beam Dump’ appeared first on Security Boulevard.
Researchers have uncovered a campaign where free 3D models for Blender with embedded Python scripts are being used to distribute the StealC V2 infostealer.