> TODAY'S SUMMARY (108 articles)
Today's cybersecurity news highlights several critical incidents and trends. A global outage of Microsoft 365 services, affecting Outlook and Teams, is raising concerns about potential exploitation by cybercriminals during the disruption. In data breach news, Uber confirmed the theft of thousands of drivers' licenses due to a security incident at a cloud service provider, while TSMC reported a data breach linked to a cloud vendor, emphasizing the risks associated with third-party services. Additionally, the FBI has attributed over $400 million in cryptocurrency theft to North Korean hackers using deepfake video calls. On the malware front, the international law enforcement operation "Endgame" successfully disrupted Gootloader and CastleRAT infrastructures, while new vulnerabilities in Check Point gateways have been exploited for destructive attacks. Phishing attacks are surging, particularly in Europe, with notable increases in detection rates.
|
// AI-powered summary generated at 16:00
Today, EFF joined a coalition of civil society organizations in urging UN Member States not to sign the UN Convention Against Cybercrime. For those that move forward despite these warnings, we urge them to take immediate and concrete steps to limit the human rights harms this Convention will unleash...
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in incorrect string equality checks, XML XXE/XEE attacks or incorrect certificate validation. For the stable distribution (trixie), these problems have been fixed in version 21.0.9+10-1~deb13u1.
After years of negotiations, officials from around the world will convene in Hanoi this weekend for the signing of the landmark UN cybercrime convention.
Detailing an improved Cache Smuggling technique to turn 3rd party software into passive malware downloader.
A widespread exploitation campaign is targeting WordPress websites with GutenKit and Hunk Companion plugins vulnerable to critical-severity, old security issues that can be used to achieve remote code execution (RCE). [...]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft WSUS, and Adobe Commerce and Magento Open Source flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Microsoft WSUS, and Adobe Commerce and Magento Ope...
SESSION Session 1A: WiFi and Bluetooth Security
PAPER Off-Path TCP Hijacking in Wi-Fi Networks: A Packet-Size Side Channel Attack
In this paper, we unveil a fundamental side channel in Wi-Fi networks, specifically the observable frame size, which can be exploited by attackers to conduct TCP hijackin...
Redmond says it's fixed this particular indirect prompt injection vuln Microsoft fixed a security hole in Microsoft 365 Copilot that allowed attackers to trick the AI assistant into stealing sensitive tenant data – like emails – via indirect prompt injection attacks.…
The threat actors behind a large-scale, ongoing smishing campaign have been attributed to more than 194,000 malicious domains since January 1, 2024, targeting a broad range of services across the world, according to new findings from Palo Alto Networks Unit 42.
"Although these domains are registered...
House Oversight Committee Chairman James Comer wants the developer of the controversial dating-safety app TeaOnHer to explain if its privacy and content moderation practices adhere to federal law.
The Middle East is undergoing one of the fastest digital transformations in the world. National initiatives such as Saudi Vision 2030, Kuwait Vision 2035, and the UAE Digital Government Strategy are fueling large-scale modernization across every sector. However, as this progress accelerates, the reg...
A recent npm supply chain attack compromised 18 popular packages. This post explains how Cloudflare’s graph-based machine learning model, which analyzes 3.5 billion scripts daily, was built to detect and block exactly this kind of threat automatically.
via the comic artistry and dry wit of Randall Munroe, creator of XKCD
Permalink
The post Randall Munroe’s XKCD ‘’Ping” appeared first on Security Boulevard.
The percentage of companies choosing to pay ransoms dropped significantly,
while threat actors shift their tactics in response to decreasing profits.
The post Insider Threats Loom while Ransom Payment Rates Plummet appeared first on Security Boulevard.
Microsoft on Thursday released out-of-band security updates to patch a critical-severity Windows Server Update Service (WSUS) vulnerability with a proof-of-concept (Poc) exploit publicly available and has come under active exploitation in the wild.
The vulnerability in question is CVE-2025-59287 (CV...
Attackers are now exploiting a critical-severity Windows Server Update Service (WSUS) vulnerability, which already has publicly available proof-of-concept exploit code. [...]
Sean Cairncross, in remarks at a summit, also said the United States needs to send a stronger message that Chinese cyberattacks are unwelcome.
The post National cyber director says U.S. needs to counter Chinese surveillance, push American tech appeared first on CyberScoop.
Comparing WhatsApp, Discord, Snapchat, Facebook Messenger, and Telegram, based on their privacy settings and the amount of data they collect.
Europol disrupts SIM-box fraudsters, Jingle Thief exploits cloud identities for gift card theft, and PhantomCaptcha targets Ukrainian NGOs.
Cybersecurity researchers could face criminal charges for performing their legitimate work if the United Nations Convention against Cybercrime is ratified in a process beginning in Hanoi, Vietnam, this weekend, critics say.
Tech industry group Cybersecurity Tech Accord said...