> TODAY'S SUMMARY (54 articles)
Today's cybersecurity news highlights several key threats and trends. Vanderbilt University has experienced a ransomware attack, reportedly by the BYOD group, compromising sensitive data. The Russian state-sponsored Turla group is utilizing a new malware toolset named "Cereal" to infiltrate Microsoft Exchange servers of government entities in Kazakhstan and Romania, showcasing escalating cyber-espionage tactics. Google has issued its eighth zero-day patch for Chrome this year, addressing a vulnerability actively exploited in the wild. Meanwhile, Apple and SAP have released important security updates to fix critical flaws in their software. Finally, spyware attacks are increasingly targeting a broader range of individuals, emphasizing the need for enhanced vigilance and protection measures.
|
// AI-powered summary generated at 12:00
Today, Cisco Talos is introducing new capabilities for Snort3 users within Cisco Secure Firewall to give you greater flexibility in how you manage, organize, and prioritize detection rules.
TL;DR
AI-powered vulnerability remediation often fails because it lacks context about how your applications actually work. Runtime intelligence solves this by providing AI with real-world application behavior data, architecture insights, and dependency information. This context-aware approach...
Introduction PKI is one of the most important facets of current data protection and the foundation of secure communication and data exchange. Just like any other Information Technology (IT) asset, PKI poses a management headache in large organizations as the organization’s digital requirements grow....
Entrust says AI is helping fraudsters open new accounts and bypass biometric checks
Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites.
The malicious npm packa...
Google has released an emergency security update to fix the seventh Chrome zero-day vulnerability exploited in attacks this year. [...]
One of the sad truths about this world of seemingly endless hacks and data breaches is that companies just won't apologise.
Even when customers, partners, and employees are left wondering when their data will be published by malicious hackers on the dark web, breached organisations will seemingly...
As organizations enter 2026, the real threat isn’t novel exploits but blind spots in supply chain security, proximity attack surfaces, and cross-functional accountability. This piece explains why fundamentals must become continuous, operational disciplines for modern cyber resilience.
The post What...
Socura finds 460,000 compromised credentials belonging to FTSE 100 company employees
From prompt injection to cascading agent failures, GenAI expands the enterprise attack surface. A governance-first, security-focused approach—rooted in trusted data, guardrails, and ongoing oversight—is now critical for responsible AI adoption.
The post Governing the Unseen Risks of GenAI:Â Why Bias...
We recently detected and blocked a large-scale fake account creation campaign. The attacker attempted to register tens of thousands of accounts using bots, automating the entire signup process through a modified version of Chrome. To evade detection, the bots included anti-detect techniques such as...
Google patched two Chrome flaws, including a V8 type-confusion bug, tracked as including CVE-2025-13223, which was exploited in the wild. Google released Chrome security updates to address two flaws, including a high-severity V8 type confusion bug tracked as CVE-2025-13223 that has been actively exp...
For every organization, no matter the size or industry, the integrity and security of data is more crucial than ever as it faces the possibility of a cyber breach everyday. But what separates a company that bounces back quickly from one that suffers irreparable damage? The answer largely resides in...
As state and federal authorities seek broad access to a seized phone, a Virginia prosecutor argues for narrowly tailored digital searches — a clash that could redefine Fourth Amendment protections for modern devices.
The post The Battle Over The Search of a Cell Phone – Feds v. Locals appeared firs...
Microsoft on Monday disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 5.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps).
The tech giant said it was the largest D...
CVSSv3 Score:
7.1
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in FortiClient Windows may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as He...
CVSSv3 Score:
6.3
A buffer overflow vulnerability [CWE-120] in FortiExtender json_cli may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.
Revised on 2025-11-18 00:00:00
The flaw was reported by Google's Threat Analysis Group and was likely exploited by a commercial spyware vendor.
The post Chrome 142 Update Patches Exploited Zero-Day appeared first on SecurityWeek.
CVSSv3 Score:
7.1
A Heap-based Buffer Overflow vulnerability [CWE-122] in FortiClient Windows may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys" driver. The attacker would need to bypass the Windows heap integrity protections.
Revi...
CVSSv3 Score:
3.9
A CRLF Header Injection vulnerability [CWE-93] in FortiMail user GUI may allow an attacker to inject headers in the response via convincing a user to click on a specifically crafted link
Revised on 2025-11-18 00:00:00