> TODAY'S SUMMARY (21 articles)
Today's cyber news highlights several significant threats and trends. Microsoft 365 is experiencing a widespread outage affecting services like Outlook and Teams, causing operational disruptions. In vulnerability news, the PHP2Shell exploit was leveraged in attacks against Check Point Gateways, while a new zero-day vulnerability in N-central named 4EverAble2Shell was exploited shortly after its proof of concept was published. Additionally, North Korean hackers have reportedly stole over $400 million in cryptocurrency through sophisticated social engineering tactics involving fake video calls. The FBI has seized $1.2 billion in cryptocurrency linked to these North Korean operations. On the patching front, Ubuntu has released updates to address various vulnerabilities, including server impersonation and server-side request forgery.
|
// AI-powered summary generated at 08:00
Authorities fight ransomware and crypto fraud, SleepyDuck exploits Ethereum for malware, and Iran-linked actors target U.S. policy experts.
Announcing a new self-serve API for Bring Your Own IP (BYOIP), giving customers unprecedented control and flexibility to onboard, manage, and use their own IP prefixes with Cloudflare's services.
Learn why Google expects AI to transform cyber defense and offense next year, and explore MITRE's major update to the ATT&CK knowledge base. We also cover a new McKinsey playbook for agentic AI security, along with the latest on Microsoft Exchange protection and the CIS Benchmarks.
Key takeawa...
The most important story in cybersecurity today is not about the next breach, but how organizations respond and evolve in light of accountability.
The post The quiet revolution: How regulation is forcing cybersecurity accountability appeared first on CyberScoop.
Former colleagues and friends remember the cybersecurity researcher, author, and mentor whose work bridged the human and technical sides of security
The vulnerability is tracked as CVE-2025-12058 and it can be exploited for arbitrary file loading and conducting SSRF attacks.
The post Data Exposure Vulnerability Found in Deep Learning Tool Keras appeared first on SecurityWeek.
ClickFix prompts typically contain instructions for Windows users, but now they are tailored for macOS and they are getting increasingly convincing.
The post ClickFix Attacks Against macOS Users Evolving appeared first on SecurityWeek.
Google is planning to ship two new models. One is Gemini 3, which is optimised for coding and regular use, and the second is Nano Banano 2 for generating realistic images. [...]
Anchore Enterprise 5.23 adds CycloneDX VEX and VDR support, completing our vulnerability communication capabilities for software publishers who need to share accurate vulnerability context with customers. With OpenVEX support shipped in 5.22 and CycloneDX added now, teams can choose the format that...
Learn how Nevada refused to pay ransom after a 2025 cyberattack, restoring systems in 28 days—and what this reveals about ransomware readiness and policy.
The post Doubling Down in Vegas: The High-Stakes Question of Whether to Pay appeared first on Security Boulevard.
Discover what’s new on Forensic Focus – explore how lived experience should shape national well-being policy in DFIR, gain insights from Carol Brooks on the realities of covert cyber investigator roles, examine the next era of digital investigations, and more.
Several security issues were fixed in the Linux kernel.
Jean-Claude Graf, Sandro RĂĽegge, Ali Hajiabadi, and Kaveh Razavi discovered
that the Linux kernel contained insufficient branch predictor isolation
between a guest and a userspace hypervisor for certain processors. This
flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this
to e...
ESET Chief Security Evangelist Tony Anscombe highlights some of the key findings from the latest issue of the ESET APT Activity Report
Under shadow of US CLOUD Act, Redmond releases raft of services to calm customers in the EU Microsoft is again banging the data sovereignty drum in Europe, months after admitting in a French court it couldn't guarantee that data will not be transmitted to the US government when it is legally require...
Sandworm deployed data wipers against Ukrainian governmental entities and companies in the energy, logistics and grain sectors
For years, organizations have relied on passwords and multi-factor authentication (MFA) based on shared secrets like SMS codes and one-time passwords (OTPs) as the foundation of identity security. The rise of computer-using agents (CUAs) will accelerate attackers’ ability to a...
Over the past few decades, it’s become easier and easier to create fake receipts. Decades ago, it required special paper and printers—I remember a company in the UK advertising its services to people trying to cover up their affairs. Then, receipts became computerized, and faking them required some...
A set of nine malicious NuGet packages has been identified as capable of dropping time-delayed payloads to sabotage database operations and corrupt industrial control systems.
According to software supply chain security company Socket, the packages were published in 2023 and 2024 by a user named "sh...
This kind of material economic impact from online crooks thought to be a UK-first The Bank of England (BoE) has cited the cyberattack on Jaguar Land Rover (JLR) as one of the reasons for the country's slower-than-expected GDP growth in its latest rates decision.…