> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape highlights several critical threats and trends. Cybercriminals are increasingly using DNS for data exfiltration, prompting organizations to enhance detection and prevention measures. A critical vulnerability (CVE-2026-108142) in Veeam Backup & Replication 13 has been patched, emphasizing the need for timely updates. Similarly, Microsoft Authenticator's AuthMask vulnerability (CVE-2026-80097) allowed unauthorized access to Microsoft 365 accounts, necessitating user vigilance. Meanwhile, a significant number of data breach victims were affected through third-party vendors, underscoring supply chain risks. Additionally, an offensive AI agent, dubbed "Skynet," has been developed to exploit unprotected AI models, marking a worrying trend in cyberattacks. Lastly, NIST is pushing for a transition to post-quantum cryptography, reflecting the urgency of preparing for future threats.
|
// AI-powered summary generated at 08:00
Two questions remain: who is abusing the CVEs? And why did Citrix take so long to disclose?
An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July.
Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agenc...
Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. [...]
Dutch police said the hacker, arrested for being part of the ShinyHunters cybercriminal gang, had plans to organize the murder of two people on his laptop.
The AIxCC competition winner will analyze messaging app code and compiled binaries for vulnerabilities, with technology that could also help commercial customers secure their software.
The post DARPA Selects Xint to Use AI in Securing Military Messaging Apps appeared first on SecurityWeek.
Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.
The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since Januar...
A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors.
The new Spectre-v2 varia...
A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...]
Branch Target Reuse (BTR) is a new Spectre v2 attack targeting JIT compilers in web browsers, language runtimes, and the operating system kernel
The post New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks appeared first on SecurityWeek.
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
compressed metadata. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-84384)
Yuqi Qiu and Xiang Li discovered that libheif...
Plasma Workspace could allow unintended access to user sessions.
Emacs could be made to crash or expose sensitive information if it opened a specially crafted file.
Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure.
The post ​​Beyond source code: A path to the keys to the kingdom appeared first on Microsoft Security Blog.
Débit Wi-Fi 7 décevant ? Lien 1 GbE, largeur de canal, MLO : les pièges qui brident votre réseau, mesurés avec une borne TP-Link Omada.
Le post Wi-Fi 7 en pratique : ce qui bride vraiment votre débit a été publié sur IT-Connect.
Glow Security finds more than 13,000 publicly accessible images that expose corporate development work
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy." [...]
The arrest of a 24-year-old man in Amsterdam, which occurred a week before ShinyHunters hacked the FBI, marks a major turning point for law enforcement’s push to track down the group’s members.
The post Alleged ShinyHunters leader arrested in the Netherlands appeared first on CyberScoop.
Magnet Forensics’ Christopher Vance tackles the biggest roadblocks in mobile forensics, from keeping a seized phone isolated, powered and safe from reboot timers to handling 1TB devices and proprietary data.
It was discovered that c-ares incorrectly handled certain query completion
callbacks. An attacker could possibly use this issue to trigger a use-
after-free or double-free, resulting in a denial of service or arbitrary
code execution.
People are increasingly concerned about the ways in which mass surveillance is tracking our every move: from Flock license plate readers to face recognition to creepy ads that – based on what we see and do online – seem to know everything we’re thinking and planning. It didn’t have to be this way, a...