> TODAY'S SUMMARY (14 articles)
Today's cybersecurity news highlights several significant threats and trends. A major cyberattack on French bank Crédit Mutuel Arkéa resulted in fraudulent transactions totaling $133 million, emphasizing the risks associated with third-party service providers. Scammers are increasingly impersonating trusted brands in fake gift card schemes, collecting personal information from unsuspecting consumers. The rise of IoT vulnerabilities is underscored by recent hacks affecting critical infrastructure, such as blood labs and grocery stores. Additionally, vulnerabilities in SonicWall's SonicOS have been exploited, prompting CISA to add these to its Known Exploited Vulnerabilities catalog. Developers are also reminded of security best practices, as sensitive credentials were found exposed in public GitHub repositories.
|
// AI-powered summary generated at 20:00
The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways.
"The cam...
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions.
The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including...
GitHub Copilot CLI can be made to read sensitive files from a developer’s machine and send their contents to an attacker from a single web page.
Security researchers at Adversa AI said the new attack technique, dubbed Cryptographic Context Injection (CCI), hides malicious i...
If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, validates, and exploits attack paths autonomously, the way a real attacker would.
That promise is worth taking seriously. It’s also worth press...
SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. [...]
Aprés sa disparition, le pirate FLOCKER recherche des affiliés via son outil revendiqué pour Windows, Linux et macOS.
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by other large organizations, Google disclosed on Tuesday. Attackers compromised the third-party operators of the .gh (Ghana), .sl...
Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone.
Other industry solutions require a photographer or...
BlueKit puts account-hijacking tools in more criminals’ hands, making it easier to target you with convincing fake login pages and scam messages.
Tens of thousands more victims and more ransomware groups getting in on the act
Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track.
The post Chrome 155 Update Patches 247 Vulnerabilities appeared first on SecurityWeek.
ASOS confirms data breach after “HACKED” in-app notifications UK fashion retailer ASOS confirmed a data breach on Tuesday after attackers abused a third-party customer communications platform to push an unauthorized “ASOS HACKED” alert to mobile app users around 5:00 a.m. ET, claiming they had fully...
Shared passwords create security gaps that grow with your team. Learn why a business password manager is essential to safeguard your business.
SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and reach internal functionality and perform un...
A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. [...]
Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. [...]
Google has released a new update for the Chrome browser and ChromeOS. There are a lot of security fixes in them so don't delay.
Microsoft has made remote PC connections generally available in Windows App on Windows. Users can access physical or virtual Windows PCs alongside Windows 365, Azure Virtual Desktop, and Microsoft Dev Box resources. Windows App brings remote Windows devices and applications into a single interface....
A Yubico survey identified a significant gap between awareness and adoption of secure methods of authentication in enterprises
Convention de Budapest : 25 ans de coopération face au cybercrime, aux preuves électroniques et à l’IA.