> TODAY'S SUMMARY (22 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Fireworks AI has reported a breach stemming from a third-party cloud hack, emphasizing the risks associated with relying on external providers. France has attributed a cyberattack that affected supermarket refrigeration systems to Iranian operatives, signaling geopolitical tensions in cyberspace. Meanwhile, CISA has warned of active exploitation of multiple security flaws in key software, including OpenSSH and IBM products. Additionally, N-able has taken its N-central Cloud offline after the disclosure of 33 zero-day vulnerabilities. On the consumer side, a data breach at Iris Ohyama may expose personal information of 7.7 million individuals. Lastly, Google has issued a security update for Chrome, addressing the eighth actively exploited zero-day this year.
|
// AI-powered summary generated at 08:00
Hanno Böck discovered that Raptor incorrectly handled memory operations
when processing certain input files. An attacker could use this issue to
cause Raptor to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2017-18926)
Hanno Böck discovered that Raptor incorrectl...
Our customers are proving what exposure management can do. Thank you for trusting us to be part of your mission.
Key takeaways
Tenable believes our evolution of exposure management and our strong, mature partner ecosystem contributed to our position as a Leader in the 2025 Gartner® Magic Quadrant...
Several security issues were fixed in sudo-rs.
California’s legislature also has enacted an algorithmic pricing law, but it has not yet taken effect, making New York the first state in the country to regulate the practice.
Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox file-sharing and remote access platform.
The critical vulnerability, tracked as CVE-2025-12480 (CVSS score: 9.1), allows an attacker to bypass authentication and acce...
The North Korea-affiliated threat actor known as Konni (aka Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has been attributed to a new set of attacks targeting both Android and Windows devices for data theft and remote control.
"Attackers impersonated psychological counselors and North Korean h...
Barak Gross discovered that some Intel® Xeon® processors with SGX enabled
did not properly handle buffer restrictions. A local authenticated user
could potentially use this issue to escalate their privileges.
(CVE-2025-20053)
Avinash Maddy discovered that some Intel® processors did not properly
iso...
GlassWorm malware resurfaces in Open VSX and GitHub, infecting VS Code extensions weeks after its removal from the official marketplace. GlassWorm malware has resurfaced on the Open VSX registry and newly appeared in GitHub repositories, infecting three more VS Code extensions just weeks after its r...
CISA ordered U.S. federal agencies today to patch a critical Samsung vulnerability that has been exploited in zero-day attacks to deploy LandFall spyware on devices running WhatsApp. [...]
It was discovered that Incus, a system container and virtual machine manager, is prone to a local privilege escalation vulnerability unprivileged users are allowed access to Incus through incus-user.
California's influential privacy agency sent the state legislature three proposals, including a measure to create anti-retaliation safeguards and financial rewards for insiders who make regulators aware of corporate practices that violate state privacy law.
A Russian national will plead guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks that targeted at least eight U.S. companies between July 2021 and November 2022. [...]
A Russian national will plead guilty to acting as an initial access broker (IAB) for Yanluowang ransomware attacks that targeted at least eight U.S. companies between July 2021 and November 2022. [...]
Resolution acquiesced to by 8 Dems includes CISA Act funding, layoff reversals, and could be easily undone The US Senate voted on Sunday to advance a short-term funding bill for the federal government, moving the country closer to ending its longest-ever shutdown. Part of the spending bill also rest...
It was discovered that sudo-rs incorrectly handled passwords when timeouts
occurred and the pwfeedback default was not set. This could result in a
partially typed password being output to standard input, contrary to
expectations.
It was discovered that sudo-rs incorrectly handled the targetpw and r...
One company alone was hit with more than 4,200 emails More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign.…
A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. [...]
Amazon Web Services (AWS) is excited to announce that the latest version of Information Security Registered Assessors Program (IRAP) report (2025 H1) is now available through AWS Artifact. An independent Australian Signals Directorate (ASD) certified IRAP assessor completed the IRAP assessment of AW...
NSO Group announced Friedman’s appointment on Sunday, saying that NSO’s three founders no longer have any stake in the firm.
Ce tutoriel explique comment créer un réseau privé NAT sur un serveur Proxmox VE, avec la configuration d'une règle de port forwarding.
The post Proxmox VE : découvrez comment créer un réseau privé avec NAT first appeared on IT-Connect.