> TODAY'S SUMMARY (21 articles)
Today's cyber news highlights several significant threats and trends. Microsoft 365 is experiencing a widespread outage affecting services like Outlook and Teams, causing operational disruptions. In vulnerability news, the PHP2Shell exploit was leveraged in attacks against Check Point Gateways, while a new zero-day vulnerability in N-central named 4EverAble2Shell was exploited shortly after its proof of concept was published. Additionally, North Korean hackers have reportedly stole over $400 million in cryptocurrency through sophisticated social engineering tactics involving fake video calls. The FBI has seized $1.2 billion in cryptocurrency linked to these North Korean operations. On the patching front, Ubuntu has released updates to address various vulnerabilities, including server impersonation and server-side request forgery.
|
// AI-powered summary generated at 08:00
For the latest discoveries in cyber research for the week of 10th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Congressional Budget Office (CBO) has confirmed a cyber attack that resulted in a suspected foreign threat actor breaching its network and pot...
Government surveillance vendors want us to believe their spyware products are only used in limited and targeted operations against terrorists and serious criminals. That claim is increasingly difficult to justify, given the broad range of victims — journalists, activists, and now political consultan...
Fantasy Hub RAT-for-rent hides in fake Android apps, stealing logins, PINs, and messages—all with a single SMS permission.
OWASP has added two new categories to the revised version of its Top 10 list of the most critical risks to web applications.
The post Two New Web Application Risk Categories Added to OWASP Top 10 appeared first on SecurityWeek.
My readers will know by now that I am addicted to PACER - the Public Access to Court Electronic Records. When I see headlines like this one, I am compelled to dive in and read every publicly released document related to the case. Â
USAO Central California
The headline last month was that...
Cyber threats didn’t slow down last week—and attackers are getting smarter. We’re seeing malware hidden in virtual machines, side-channel leaks exposing AI chats, and spyware quietly targeting Android devices in the wild.
But that’s just the surface. From sleeper logic bombs to a fresh alliance betw...
Three more VS Code extensions were infected last week and the malware has emerged in GitHub repositories as well.
The post GlassWorm Malware Returns to Open VSX, Emerges on GitHub appeared first on SecurityWeek.
The European Commission is preparing sweeping revisions to the General Data Protection Regulation (GDPR) that could redefine how enterprises handle personal data — from cookie tracking to AI model training — in what privacy advocates warn could weaken the EU’s privacy framewor...
The system could be made to expose sensitive information.
The system could be made to expose sensitive information.
With a 4M cybersecurity worker shortage, agentic AI helps SOCs move beyond triage, enabling proactive security once thought impossible. With a deficit of 4 million cybersecurity workers worldwide, it’s no surprise that most SOCs are still stuck in triage mode. That’s why agentic AI is stepping in to...
Several security issues were fixed in the Linux kernel.
The Cybersecurity and Information Sharing Act of 2015 would go from expired to extended through Jan. 30.
The post Cyber information sharing law would get extension under shutdown deal bill appeared first on CyberScoop.
Jean-Claude Graf, Sandro RĂĽegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to e...
Encryption can protect data at rest and data in transit, but does nothing for data in use. What we have are secure enclaves. I’ve written about this before:
Almost all cloud services have to perform some computation on our data. Even the simplest storage provider has code to copy bytes from an inter...
Each day without reauthorization erodes the trust, coordination, and shared visibility that have underpinned the resilience of America’s most critical systems.
The post CISA’s expiration leaves a dangerous void in US cyber collaboration appeared first on CyberScoop.
According to the new Browser Security Report 2025, security leaders are discovering that most identity, SaaS, and AI-related risks converge in a single place, the user’s browser. Yet traditional controls like DLP, EDR, and SSE still operate one layer too low.
What’s emerging isn’t just a blindspot....
To help defend our cultural heritage, Proton Pass Professional password manager plans are free for two years to qualifying organizations. Learn more.
Researchers at Microsoft have revealed a new side channel attack named Whisper Leak that can reveal the topic of encrypted conversations between users and language models, even without access to the underlying text.
The discovery highlights a growing blind spot in AI securi...
The Cl0p website lists major organizations such as Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland.
The post Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site appeared first on SecurityWeek.