> TODAY'S SUMMARY (8 articles)
Today's cyber news highlights significant threats and vulnerabilities. The FBI has seized $1.2 billion in cryptocurrency linked to North Korean hackers, who are also implicated in a $400 million social engineering scheme. This operation involved using video call deception to trick victims. In software security, several vulnerabilities in Ubuntu products have been addressed, including fixes for x11vnc's insecure shared memory permissions, TigerVNC's server impersonation risks, and the signing-party's potential for executing malicious commands via crafted OpenPGP keys. Additionally, updates for SA-Exim and Ruby OpenID have been released to mitigate risks of unsafe rule evaluations and server-side request forgery, respectively.
|
// AI-powered summary generated at 04:01
TL;DR OFAC, in coordination with the U.K. and Australia, designated Russian bulletproof hosting provider Media Land, LLC and its network…
The post U.S., U.K., and Australia Target Russian Cybercrime Infrastructure Supporting Global Ransomware Operations; U.S. Targets Crypto Laundering of Global Drug...
Jean-Claude Graf, Sandro RĂĽegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to e...
Jean-Claude Graf, Sandro RĂĽegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to e...
L'Agence Espagnole de Protection des Données (AEPD) a publié une décision de sanction à l'encontre de la Mairie de Riba-Roja de Túria pour des manquements en lien avec la sécurité des données personnelles traitées via un logiciel de billetterie et l'absence de contrat de sous-traitance.Cette affaire...
La Commission européenne présente un nouveau paquet législatif numérique visant à simplifier la réglementation et à introduire des portefeuilles numériques pour les entreprises.L'objectif de ce nouveau paquet numérique est de réduire le temps consacré par les entreprises, des usines aux jeunes pouss...
Google's Gemini 3 is finally here, and we're impressed with the results, but it still does not adhere to my requests as well as Claude Code. [...]
Nov 19, 2025 - Alan Fagan - Although microservices are widespread, they are often misunderstood by business leaders. While they present substantial benefits, they also have the potential to introduce new risks into the API environment. Understanding the benefits and risks of microservice utilization...
AWS Network Firewall now supports managed rules curated by AWS Partners—giving you pre-built threat intelligence and security controls that reduce the need to create and maintain your own rule sets. This new capability helps organizations strengthen their network security posture with continuously u...
Nov 19, 2025 - Alan Fagan - 1. Â Validating User Input
One of the cornerstones of API security is to validate user input. Failing to do so accurately can lead to a security issues such as injection attacks and Cross-Site Scripting. When users send data to your API, no matter the type, it should be v...
-----------
SESSION
Session 3C: Mobile Security
-----------
-----------
Authors, Creators & Presenters: Yuqing Yang (The Ohio State University), Yue Zhang (Drexel University), Zhiqiang Lin (The Ohio State University)
-----------
PAPER
Understanding Miniapp Malware: Identification, Dissection, an...
Thirty investigators from 15 countries took part in the five-day crackdown earlier this month targeting 69 digital piracy sites, including 25 illegal streaming services whose information was referred to cryptocurrency platforms for disruption.
In a move that could redefine the web, Google is testing AI-powered, UI-based answers for its AI mode. [...]
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. Google is aware that an exploit for CVE-2025-13223 exists in the wild. For the oldstable distribution (bookworm), these problems have been fixed
A remote code execution vulnerability, tracked as CVE-2025-11001, in the 7-Zip software is under active exploitation. A new 7-Zip flaw tracked as CVE-2025-11001 (CVSS score of 7.0) is now being actively exploited in the wild, NHS England warns. Remote attackers can trigger the vulnerability to execu...
The U.S. Patent and Trademark Office (USPTO) has proposed new rules that would effectively end the public’s ability to challenge improperly granted patents at their source—the Patent Office itself. If these rules take effect, they will hand patent trolls exactly what they’ve been chasing for years:...
L'Agence Espagnole de Protection des Données (AEPD) a aujourd'hui publié une décision de sanction à l'encontre de SENDING TRANSPORTE Y COMUNICACIÓN, S.A. (comprenant le prononcé d'une amende de 80 000 €) pour des manquements en lien avec ses obligations en tant que sous-traitant.Cette affaire débute...
Operation WrtHug hijacks tens of thousands of outdated ASUS routers worldwide, mainly in Taiwan, the U.S., and Russia, forming a large botnet. A new campaign called Operation WrtHug has compromised tens of thousands of outdated or end-of-life ASUS routers worldwide, mainly in Taiwan, the U.S., and R...
La Commission Nationale de l'Informatique et des Libertés (CNIL) a lancé une consultation publique sur des projets de fiches et de référentiels destinés à guider les organismes du secteur du logement social dans leur mise en conformité.Cette initiative vise à actualiser le "pack logement social" de...
L'Autorité nationale de surveillance du traitement des données à caractère personnel (ANSPDCP) roumaine a publié une décision de sanction à l'encontre de Greencorp S.R.L., comprenant une amende de 15 258 lei (3 000 €) pour des manquements en lien avec la sécurité du traitement.Cette affaire débute p...
And companies are getting caught in the crossfire interview Warfare has become a joint cyber-kinetic endeavor, with nations using cyber operations to scope out targets before launching missiles. And private companies, including shipping, transportation, and electronics manufacturers, are getting ca...