> TODAY'S SUMMARY (81 articles)
Today's cyber news highlights several critical threats and developments:
1. **PHP Vulnerabilities**: The newly discovered PHP2Shell vulnerabilities have led to millions of attempted exploits, raising concerns about potential mass compromises. PHP's latest updates are crucial for mitigating these threats.
2. **Data Breaches**: Capcom reported a significant breach exposing 11.7 million accounts, while Quest Diagnostics confirmed unauthorized access to sensitive patient data, reflecting ongoing vulnerabilities in the healthcare sector.
3. **Legal Actions**: Meta has been fined $25 billion for violating user data privacy laws, marking a significant legal precedent in data protection enforcement.
4. **Cyberattacks on Infrastructure**: A large-scale attack targeting enterprise firewalls and VPNs has exposed over 70,000 credentials, emphasizing the need for robust security measures on network edge devices.
5. **Nation-State Threats**: Russian and Iranian APTs continue to pose risks, with new tactics emerging, including AI-driven attacks and mesh network backdoors.
Organizations should prioritize patch management, data protection strategies, and vigilance against phishing and social engineering attacks to bolster their cybersecurity posture.
|
// AI-powered summary generated at 16:01
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents.
The post US Agencies Detail Incident Response Practices for Rogue AI Agents appeared first on SecurityWeek.
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that...
sudo-rs could be made to run programs as an administrator.
Several security issues were fixed in Squid.
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set...
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?
The arrests were paired with comments from DOJ and DHS officials, threatening to investigate, arrest or prosecute tens of thousands of California voters if they vote in November.
The post DOJ escalates fight for election supremacy with California raids appeared first on CyberScoop.
Multiple security issues were discovered in .NET and this update includes
new upstream .NET versions to fix these issues.
.NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
.NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS
and Ubuntu 26.10. .NET 11 h...
How AI helps collect data, deanonymize users, and link their accounts — and what to do to protect yourself from doxing and harassment.
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minute...
The EU’s Cyber Resilience Act that took effect last month only requires companies to fix vulnerabilities and issue free updates during a product's support period, which manufacturers define.
It was discovered that Protocol Buffers did not properly handle negative
varint lengths or enforce recursion limits when parsing input in the PHP
library. An attacker could possibly use this issue to cause applications
using Protocol Buffers to crash or consume resources, resulting in a
denial of se...
A new IANS report has found that despite the growth of the head of AI security role, accountability for AI governance in firms remains unsettled
USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the
corresponding fix for Ubuntu 26.10.
Original advisory details:
It was discovered that sudo-rs incorrectly handled time-of-check vs time-
of-use conditions in sudoedit. A local attacker with permission to edit
specific files usi...
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]
Key Findings Introduction Antidetect browsers conceal their users’ digital identities, enabling a single operator or small team to simultaneously run thousands of isolated accounts across multiple platforms such as Facebook, Instagram, TikTok, YouTube, Twitter/X, Discord, LinkedIn, Reddit, and many...
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year. “A fix would s...
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for minutes at a time.
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.
The agents tried more than 1,200 sites and reached websites belon...
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems.