> TODAY'S SUMMARY (108 articles)
Today's cybersecurity news highlights several critical incidents and trends. A global outage of Microsoft 365 services, affecting Outlook and Teams, is raising concerns about potential exploitation by cybercriminals during the disruption. In data breach news, Uber confirmed the theft of thousands of drivers' licenses due to a security incident at a cloud service provider, while TSMC reported a data breach linked to a cloud vendor, emphasizing the risks associated with third-party services. Additionally, the FBI has attributed over $400 million in cryptocurrency theft to North Korean hackers using deepfake video calls. On the malware front, the international law enforcement operation "Endgame" successfully disrupted Gootloader and CastleRAT infrastructures, while new vulnerabilities in Check Point gateways have been exploited for destructive attacks. Phishing attacks are surging, particularly in Europe, with notable increases in detection rates.
|
// AI-powered summary generated at 16:00
It was discovered that insecure path handling in the Python interface to the Internet Archive/archive.org could result in overwriting a user's files. For the oldstable distribution (bookworm), this problem has been fixed in version 3.3.0-2~deb12u1.
Authors, Creators & Presenters: PAPERS Vision: Retiring Scenarios -- Enabling Ecologically Valid Measurement in Phishing Detection Research with PhishyMailbox Oliver D. Reithmaier (Leibniz University Hannover), Thorsten Thiel (Atmina Solutions), Anne Vonderheide (Leibniz University Hannover), Ma...
Damien Tournoud, Patrick Dawkins, Vince Parker, and Jules Duvivier
discovered that Go Cryptography incorrectly handled public keys during SSH
operations. An attacker could possibly use this issue to bypass
authorization mechanisms.
fetchmail could be made to crash if it received specially crafted network traffic.
Changpeng Zhao had been unfairly targeted in the Biden administration's investigations of the cryptocurrency industry, the White House said in confirming that President Donald Trump had pardoned the former Binance CEO.
North Korean Lazarus hackers targeted 3 European defense firms via Operation DreamJob, using fake recruitment lures to hit UAV tech staff. North Korea-linked Lazarus APT group (aka Hidden Cobra) launched Operation DreamJob, compromising three European defense companies. Threat actors used fake recru...
AttackIQ has enhanced and expanded two AWS security assessments, by introducing nine new scenarios that emulate real-world techniques and tactics that could be used by threat actors to compromise AWS cloud environments. These updates are designed to provide a more comprehensive evaluation of your A...
The post One Policy for Every File appeared first on Votiro.
The post One Policy for Every File appeared first on Security Boulevard.
Brandon Da Costa and Mahdi Asfhar discovered a cross-site scripting vulnerability in the web client of the Tryton application platform. For the oldstable distribution (bookworm), this problem has been fixed in version 6.0.28+ds1-2+deb12u1. For the stable distribution (trixie), this problem has been...
Several vulnerabilities were discovered in BIND, a DNS server implementation, which may result in cache poisoning or denial of service. For the oldstable distribution (bookworm), these problems have been fixed in version 1:9.18.41-1~deb12u1. For the stable distribution (trixie), these problems have...
Every network engineer knows the refrain: “It’s always DNS.” When websites won’t load, applications fail to connect, or mysterious outages emerge, the Domain Name System—the internet’s essential address book—is usually involved. For years, this made DNS a source of troubleshooting frustration. But...
In this week’s newsletter, Bill explores how open communication about your skills and experience can help your security team uncover hidden gaps, strengthen your defenses, and better prepare for ever-present threats.
Alan sits down with Himanshu Kathpal to discuss how modern cybersecurity teams are evolving from reactive defense to proactive exposure management. They explore why traditional approaches to risk reduction—built around scanning, alerting, and periodic assessment—are no longer enough in a world of c...
Today, Microsoft introduced Mico, a new and more personal avatar for the AI-powered Copilot digital assistant, which the company describes as human-centered. [...]
Both Google and Apple are cramming new AI features into their phones and other devices, and neither company has offered clear ways to control which apps those AI systems can access. Recent issues around WhatsApp on both Android and iPhone demonstrate how these interactions can go sideways, risking r...
Alan catches up with Eran Livne, senior director of endpoint remediation at Qualys, to discuss how organizations are evolving from vulnerability detection to true automated remediation. Livne, who helped build Qualys’ remediation platform from the ground up, reflects on how the industry’s approach...
A Magento bug called SessionReaper is doing the rounds, and researchers warn it’s letting attackers hijack real shopping sessions.
Low Earth Pork: Pig-butchering scammers in Myanmar lose use of 2,500 Starlink terminals.
The post Elon Musk’s SpaceX ‘is Facilitating’ Scams via Starlink appeared first on Security Boulevard.
The New York Department of Financial Services has clarified rules for financial institutions, highlighting AI oversight and lessons from recent cloud outages.
The post New York updates third-party risk guidance, adds AI provisions appeared first on CyberScoop.
The Department of Justice filed charges against Peter Williams, an Australian national who served as general manager of Trenchant, a specialized cybersecurity division within L3Harris.
The post Ex-L3Harris executive accused of selling trade secrets to Russia appeared first on CyberScoop.