> TODAY'S SUMMARY (110 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Cybercriminals are increasingly targeting everyday users with spyware, indicating a shift towards more indiscriminate attacks. Additionally, vulnerabilities in widely used platforms like SAP and Google Chrome have been actively exploited, with SAP releasing critical patches for multiple flaws. The Russian state-linked Turla group continues to pose a threat, using advanced tools like "Cereal" to intercept emails from government servers. Meanwhile, supply chain attacks remain a concern, evidenced by the recent Qubole incident, which compromised numerous organizations' credentials. Overall, the rise in cloud vulnerabilities and the exploitation of AI in cyberattacks are emerging as critical areas for organizations to address.
|
// AI-powered summary generated at 16:00
Borough says attackers copied 'historical' info as three-council cyber woes drag on Kensington and Chelsea Council has admitted that data was quietly lifted from its systems during last week's cyber meltdown, confirming that the outage was not just an IT faceplant but a bona fide data breach.âŠ
It was discovered that Django incorrectly handled certain characters in the
FilteredRelation object. An attacker could possibly use this issue to
execute arbitrary SQL commands. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and Ubuntu 25.10.
(CVE-2025-1...
Infected 4.3 million Chrome and Edge users via extensions; ShadyPanda exploited browser marketplaces
Cybercrime has fully shifted to a subscription model, with phishing kits, Telegram OTP bots, infostealer logs, and even RATs now rented like SaaS tools. Varonis explains how this "crime-as-a-service" economy lowers the barrier to entry and gives low-skill attackers on-demand access to advanced capab...
A joint investigation led by Mauro Eldritch, founder of BCA LTD, conducted together with threat-intel initiative NorthScan and ANY.RUN, a solution for interactive malware analysis and threat intelligence, has uncovered one of North Koreaâs most persistent infiltration schemes: a network of remote IT...
The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue.
GlassWorm was first documented in Octob...
In an unprecedented intelligence operation, security researchers exposed how North Korean IT recruiters target and lure developers into renting their identities for illicit fundraising. [...]
Google has shipped patches for 51 Android vulnerabilities, including two high-severity flaws (CVE-2025-48633, CVE-2025-48572) that âmay be under limited, targeted exploitationâ. According to the December Android security bulletin, both vulnerabilities affect the Android Framework, which is a collect...
Google has released the December 2025 Android security bulletin, addressing 107 vulnerabilities, including two flaws actively exploited in targeted attacks. [...]
Forward Edge-AI announced two major milestones in advancing quantum-resistant communications: the United States Patent and Trademark Office (USPTO) has issued a Notice of Allowance for its patent application covering attack-resilient, trust-verified communications, and the company has delivered its...
When familiar security concepts carry unfamiliar meanings for different audiences, teams talk past each other without even realizing it. This silent disconnect weakens communication, clarity, and outcomes.
The post The Great Disconnect: Unmasking the âTwo Separate Conversationsâ in Security appeared...
With submissions showcasing advances in automation, inclusion, workforce development, and real-world resilience, this yearâs programme highlights the multifaceted role of todayâs CSO. As threats evolve and organizational complexity grows, the CSO is now a strategist, communica...
Malicious prompts rewritten as poems have been found to bypass AI guardrails. Which models resisted and which failed the poetic jailbreak test?
Cybersecurity researchers have disclosed details of an npm package that attempts to influence artificial intelligence (AI)-driven security scanners.
The package in question is eslint-plugin-unicorn-ts-2, which masquerades as a TypeScript extension of the popular ESLint plugin. It was uploaded to the...
Regulator says Illuminate ignored years of warnings, stored kids' data in plain text, and kept districts in the dark US edtech provider Illuminate Education just got dinged by the Federal Trade Commission for allegedly failing to keep an attacker from pilfering data on 10 million students.âŠ
USN-7855-1 introduced a regression in Unbound
An ongoing phishing campaign impersonates popular brands, such as Unilever, Disney, MasterCard, LVMH, and Uber, in Calendly-themed lures to steal Google Workspace and Facebook business account credentials. [...]
The extensions were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access.
The post Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors appeared first on SecurityWeek.
By: Dikla Barda, Roman Zaikin, and Oded Vanunu On November 30, 2025, Check Point Research detected a critical exploit targeting Yearn Financeâs yETH pool on Ethereum. Within hours, approximately $9 million was stolen from the protocol. The attacker achieved this by minting an astronomical number of...
Microsoft has confirmed that the KB5070311 preview update is triggering bright white flashes when launching the File Explorer in dark mode on Windows 11 systems. [...]