> TODAY'S SUMMARY (46 articles)
Today's cybersecurity landscape reveals significant threats across various sectors. Capcom confirmed a data breach exposing 11.7 million user accounts, emphasizing the risks associated with gaming platforms. In a concerning trend, an attacker compromised Microsoft 365 accounts at 79 organizations without needing passwords, utilizing replayed sign-in sessions and hidden inbox rules. Vulnerabilities in PHP continue to be exploited, with millions of attack attempts related to PHP2Shell and newly discovered RCE flaws prompting urgent patching. Additionally, Russian-linked hackers have launched destructive attacks in Ukraine, while compromised TLS certificates from eMudhra Limited highlight the ongoing risks in digital trust infrastructure. The rise of AI in cybersecurity is also notable, with AI tools being used both defensively and as vectors for new attacks.
|
// AI-powered summary generated at 12:01
California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach.
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
Compare Firefox, LibreWolf, Brave, Vivaldi, and Zen for privacy, fingerprinting protection, Google independence, and everyday usability.
You load your site, or visit an API endpoint your app relies upon, and instead of a page you find a brief, unhelpful message: 401 Unauthorized. Sometimes a browser password box appears. Other times, a blank white page presents only that number. In either case, visitors are shut out, and if the error...
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publi...
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said.
The post Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign appeared first on CyberScoop.
It was discovered that XZ Utils incorrectly handled certain memory
allocation failures when reinitializing decoders for specific compressed
file formats. An attacker could possibly use this issue to trigger an
invalid memory write, resulting in a denial of service or arbitrary code
execution.
Unit 42 investigates network compromises across numerous industries
A Nigerian national who worked with a group to hack tax prep businesses and conduct millions of dollars in fraud using customer data was sentenced this week.
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.
An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for...
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering. Google says furt...
From October 26, only high and critical cases stay private as project seeks help sharing the workload
The CA certificates in the ca-certificates package were updated.
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded.
The post ConnectWise customers hit by supply-chain attack linked to compromised API secret appeared first on CyberScoop.
This update removes the "emSign ECC Root CA - G3" CA certificate due to
intermediate CA certificates being compromised.
In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS,
the ca-certificates package contained outdated CA certificates. This update
refreshes the included certif...
Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues. Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure...
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.
The post US Agencies Detail Incident Response Practices for Rogue AI Agents appeared first on SecurityWeek.
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that...
sudo-rs could be made to run programs as an administrator.
Several security issues were fixed in Squid.