> TODAY'S SUMMARY (179 articles)
Today's cybersecurity landscape reveals several significant threats and trends. United Airlines has restricted the use of AI agents for flight bookings due to concerns over credential sharing and potential unauthorized purchases. Maersk confirmed a data breach attributed to the WhiteArmor ransomware group, which is demanding a $5 million ransom after exploiting a legacy system. A critical zero-day vulnerability in Microsoft's Windows SignDrop allows local users to gain SYSTEM privileges, raising alarms for affected systems. Additionally, cybersecurity researchers uncovered a credential theft campaign that targeted over 60,000 GitHub repositories, utilizing hijacked accounts to deploy malware. Finally, new vulnerabilities in various software, including Apache and MongoDB, highlight the ongoing need for vigilant patch management and security practices.
|
// AI-powered summary generated at 20:00
CVSSv3 Score:
6.8
An improper neutralization of special elements used in an SQL command ('SQL injection') [CWE-89] in FortiVoice may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.
Revised on 2025-12-09 00:00:00
CVSSv3 Score:
6.9
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSandbox GUI may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.
Revi...
Deux extensions malveillantes ont été découvertes sur la Marketplace de Visual Studio Code, dissimulant un infostealer capable de dérober des données sensibles.
Le post Visual Studio Code : ces 2 extensions malveillantes volent vos données avec un malware infostealer a été publié sur IT-Connect.
CVSSv3 Score:
7.0
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSandbox may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
Revised on 2025...
CVSSv3 Score:
7.7
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in FortiVoice may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands.
Revised on 2025-12-09 00:...
Secure by Design.Categories: Products & ServicesTags: featured, Firewall, network, Sophos Firewall, v22
CVSSv3 Score:
5.9
A key management error vulnerability [CWE-320] in FortiManager, FortiAnalyzer and FortiPortal may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.
Revised on 2025-12-09 00:00:00
CVSSv3 Score:
2.6
An improper access control vulnerability [CWE-284] in FortiAuthenticator Web UI may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.
Revised on 2025-...
In this Help Net Security interview, Natalia Oropeza, Chief Cybersecurity Officer at Siemens, discusses how industrial organizations are adapting to a shift in cyber risk driven by AI. She notes that in-house capability, especially for OT response and recovery, is becoming a priority. Oropeza also e...
CVSSv3 Score:
5.3
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox may allow an attacker to perform an XSS attack via crafted HTTP requests.
Revised on 2025-12-09 00:00:00
As AI adoption accelerates across enterprises — and among digital adversaries — a heated debate has erupted over whether AI’s role in the cyber threat chain should be a top concern for CISOs.
A vocal handful of experts, along with one cybersecurity vendor, insist that warni...
Get your Hyper-V and VMware ESXi setups in order, people Researchers at security software vendor Huntress say they’ve noticed a huge increase in ransomware attacks on hypervisors and urged users to ensure they’re as secure as can be and properly backed up.…
Julian Andres Klode discovered that python-apt incorrectly handled
deb822 configuration files. An attacker could use this issue to cause
python-apt to crash, resulting in a denial of service.
The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:
The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:
AI agents are starting to take on tasks that used to be handled by people. These systems plan steps, call tools, and carry out actions without a person approving every move. This shift is raising questions for security leaders. A new research paper offers one of the first attempts to measure how wel...
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
The manufacturing industry is performing better in protecting itself against ransomware, according to a recent study from security provider Sophos.
Compared to previous years’ results, many manufacturing companies are now able to stop ransomware attacks before data is encry...
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: