> TODAY'S SUMMARY (179 articles)
Today's cybersecurity landscape reveals several significant threats and trends. United Airlines has restricted the use of AI agents for flight bookings due to concerns over credential sharing and potential unauthorized purchases. Maersk confirmed a data breach attributed to the WhiteArmor ransomware group, which is demanding a $5 million ransom after exploiting a legacy system. A critical zero-day vulnerability in Microsoft's Windows SignDrop allows local users to gain SYSTEM privileges, raising alarms for affected systems. Additionally, cybersecurity researchers uncovered a credential theft campaign that targeted over 60,000 GitHub repositories, utilizing hijacked accounts to deploy malware. Finally, new vulnerabilities in various software, including Apache and MongoDB, highlight the ongoing need for vigilant patch management and security practices.
|
// AI-powered summary generated at 20:00
Wound Technology Network, Inc. suffered a data breach where an unauthorized individual copied certain information between December 6, 2025, and December 9, 2025. The potentially impacted information varied by individual and included what was viewed or copied without authorization. Woundtech is provi...
As the React2Shell flaw threatens React & Next.js apps, learn how SentinelOne detects, validates, and protects vulnerable workloads.
Proof of life? Or an active social media presence? Criminals are altering social media and other publicly available images of people to use as fake proof of life photos in "virtual kidnapping" and extortion scams, the FBI warned on Friday. …
Plugging the React2Shell vulnerability in the open source React server and Next.js in IT environments has just become even more urgent with reports that exploits are already in the wild.
Researchers at Greynoise said today they are seeing “opportunistic, largely automated e...
Model Context Protocol connects LLM apps to external data sources or tools. We examine its security implications through various attack vectors.
The post New Prompt Injection Attack Vectors Through MCP Sampling appeared first on Unit 42.
A debate over actual exploitation is muddying response efforts. Multiple researchers say they’ve observed working proof of concepts while others assert evidence of attacks is lacking.
The post Attackers hit React defect as researchers quibble over proof appeared first on CyberScoop.
Chinese-sponsored groups are using the popular Brickstorm backdoor to access and gain persistence in government and tech firm networks, part of the ongoing effort by the PRC to establish long-term footholds in agency and critical infrastructure IT environments, according to a report by U.S. and Can...
The vampire squid (Vampyroteuthis infernalis) has the largest cephalopod genome ever sequenced: more than 11 billion base pairs. That’s more than twice as large as the biggest squid genomes.
It’s technically not a squid: “The vampire squid is a fascinating twig tenaciously hanging onto the cephalopo...
Who needs JavaScript? Security researcher Lyra Rebane has devised a novel clickjacking attack that relies on Scalable Vector Graphics (SVG) and Cascading Style Sheets (CSS).…
The Signalgate scandal that enveloped US Secretary of Defense Pete Hegseth in March appears to be symptomatic of a wider lax attitude towards the use of non-approved messaging apps by officials and employees, a Senate Committee has concluded.
In March, the US Senate Committ...
Security community needs to rally and share more info faster, one researcher says Amid new reports of attackers pummeling a maximum security hole (CVE-2025-55182) in the React JavaScript library, Cloudflare's technology chief said his company took down its own network, forcing a widespread outage ea...
Chinese state-sponsored threat actors are backdooring VMware vCenter and VMware ESXi servers with a malware program written in Go, allowing them to maintain long-term persistence in victim networks. According to a joint report by the US Cybersecurity and Infrastructure Securit...
Aikido found that AI coding tools from Google, Anthropic, OpenAI and others regularly embed untrusted prompts into software development workflows.
The post More evidence your AI agents can be turned against you appeared first on CyberScoop.
Intégration directe des renseignements sur les menaces (Threat-Intelligence) de Sophos dans Microsoft 365 Copilot.
Microsoft has been named a Leader in the 2025 Gartner® Magic Quadrant™ for Email Security, which we believe highlights the innovative capabilities of Microsoft Defender for Office 365.
The post Microsoft named a leader in the 2025 Gartner® Magic Quadrant™ for Email Security appeared first on Microso...
Barts Health NHS Trust has announced that Clop ransomware actors have stolen files from a database by exploiting a vulnerability in its Oracle E-business Suite software. [...]
The bill, first introduced late last year, deals with regulations, training, grants and more.
The post Bipartisan health care cybersecurity legislation returns to address a cornucopia of issues appeared first on CyberScoop.
In a case that affected 13 companies, including U.S. government contractors, a Maryland man was sentenced to 15 months in prison for allowing North Korean nationals to use his identity.
A new agentic browser attack targeting Perplexity's Comet browser that's capable of turning a seemingly innocuous email into a destructive action that wipes a user's entire Google Drive contents, findings from Straiker STAR Labs show.
The zero-click Google Drive Wiper technique hinges on connecting...
L'Agence Espagnole de Protection des Données (AEPD) a publié une décision de sanction à l'encontre de LOCATION DE VOITURES SOLEIL LEVANT S.L., comprenant le prononcé d'une amende de 3 600 €, pour des manquements en lien avec son système de vidéosurveillance.Cette affaire débute par une plainte dépos...