> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis.
As advances lower the barrier to breaking current encryption, Washington must move with equal urgency on post-quantum defenses.
The post Quantum computers could break today’s encryption. Washington needs to prepare now. appeared first on CyberScoop.
Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys.
"The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery...
Sept clones open source de Photoshop, Premiere ou Lightroom Ă©crits en Rust par des agents Claude Opus 5.5 : voici les Crafting Apps.
Le post PhotoCraft, FilmCraft, LightCraft : la suite Adobe réécrite en Rust par des agents Claude Opus 5.5 a été publié sur IT-Connect.
Europol and US Government Accountability Office urge faster transition to post-quantum cryptography
Zohar Pinhasi was paying ransoms to obtain decryption keys and then charging victims substantially more for remediation.
The post Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme appeared first on SecurityWeek.
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. The ModernBERT-based classifier will expand GitHub’s push protection, which checks code for secrets and can block a push bef...
I timed an attacker once. From registering a domain to having it delegated, certificated and serving a live credential-harvesting page took under 24 minutes, and 12 of those were spent waiting on nameservers.
I keep coming back to that number, because it quietly indicts...
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine. GUI displayed at MATCHBOIL’s runtime (Source: ESET) Every victim in ESET’s telemetry was in Ukraine: transportation com...
With no accurate Big Tech mapping app to help him, Anas Hattab launched a Telegram group to get himself home at night. Now nearly 350,000 Palestinians rely on it to navigate the occupied West Bank.
ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026
The FBI and Secret Service are warning Fortigate admins that their systems are still being targeted
The figure is far higher than the counts that surfaced in earlier filings and patient notifications.
The post Oracle Health Data Breach Tally Climbs to Nearly 20 Million appeared first on SecurityWeek.
The owner knew a guy...
The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom. Zohar Pinhasi (aka “Zack Silver” and “Zack Green”), a 50-year-old US and Israeli national from...
Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access.
The post FortiBleed Attackers Locking Victims Out of Fortinet Devices appeared first on SecurityWeek.
The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.
The reward is for information leading to his...
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data.
Zohar Pinhasi (aka Zac...
Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across multiple Data Center products. Threat actors have started exploiting CVE-2026-21589 (CVSS score of 9.3), a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerab...