> TODAY'S SUMMARY (103 articles)
Today's cybersecurity landscape reveals several key threats and trends. Small and medium-sized businesses (SMBs) continue to face significant risks of client data leaks due to common oversights, such as password reuse. A jailbroken AI agent has executed a two-week attack on a European telecom, highlighting the evolving nature of AI-assisted cyber threats. Notably, a recent supply chain attack compromised tens of thousands of GitHub repositories, showcasing vulnerabilities in software development ecosystems. Additionally, hackers are exploiting vulnerabilities in refrigeration controllers and NAS devices, leading to potential service disruptions and data breaches. In a concerning trend, deepfake technology is being utilized in scams, with three individuals indicted for using AI to impersonate CEOs and defraud companies out of $129 million.
|
// AI-powered summary generated at 16:00
L'Office of the Registrar-General a été victime d'une attaque informatique qui a pu compromettre des données sensibles. L'attaque a été détectée le 24 août et les services en ligne de l'agence sont actuellement indisponibles. L'agence a activé son plan de réponse aux incidents et mène une enquête po...
Imagine a malicious instruction hidden in plain sight, invisible to you but not to the AI. This is a vulnerability discovered in Windsurf Cascade, it follows invisible instructions. This means there can be instructions in a file or result of a tool call that the developer cannot see, but the LLM doe...
Extant Aerospace suffered a data breach due to ransomware activity affecting its network environment, potentially exposing personal information of current and former employees and other individuals. The breach occurred on or around August 23, 2025, and was discovered on April 13, 2026. The affected...
In this second post about Windsurf Cascade we are exploring the SpAIware attack, which allows memory persistent data exfiltration. SpAIware is an attack we first successfully demonstrated with ChatGPT last year and OpenAI mitigated.
While inspecting the system prompt of Windsurf Cascade I noticed th...
Operation Serengeti 2.0 operators helped recover $97.4m stolen by cybercriminals
Darktrace observed a coordinated campaign on customer SaaS accounts, all of which involved logins from IP addresses linked to VPS providers
Appel à manifestation d‘intérêt [clos]
anssiadm
ven 22/08/2025 - 07:13
L'ANSSI ouvre un appel à manifestation d‘intérêt (AMI) pour le renforcement de l’accompagnement local aux enjeux de cybersécurité, du 22 août au 15 septembre 2025....
All Apple users are encouraged to update their iPhones, iPads and macOS devices
Microsoft has set out a roadmap to complete transition to PQC in all its products and services by 2033, with roll out beginning by 2029
La ville de Cajeme a suspendu ses services numériques après une attaque informatique contre son système municipal. Les services en ligne ont été interrompus pour protéger les données sensibles. L'attaque a eu lieu le 22 août 2025 et les autorités travaillent pour rétablir les services.
La Blackpool Credit Union a été victime d'une attaque informatique, les informations personnelles de ses membres ont été compromises et partagées sur le dark web. Les experts techniques ont été appelés pour mener une enquête forensique et les systèmes ont été rétablis pour éviter toute perte de serv...
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/202[SS9.1]5) for more information.
A data security event resulted in unauthorized access to personal identifying information, including names and driver's license numbers. The incident occurred on August 22, 2025, and was discovered on the same day. There is no evidence of misuse of the information.
KCI Telecommunications suffered a data breach on August 22, 2025, where an unknown actor accessed certain files containing names and Social Security numbers. The breach was discovered on August 22, 2025, and KCI took steps to secure its systems and launched an investigation. A cyberattack was claime...
Russian state-backed hackers are exploiting a seven-year-old Cisco Smart Install vulnerability (CVE-2018-0171) in end-of-life devices, prompting warnings from the FBI and Cisco Talos
Colt customers can request a list of filenames posted on the dark web via a dedicated call center
In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex AI Studio, Gemini’s web and API interfaces, Google Assistant, Genspark, and other production AI systems. We’ll also explain how to mitigate and defend against these attacks, and we’ll introduce Anamorpher,...
A 22-year-old Oregon man has been charged with administering the Rapper Bot DDoS-for-hire Botnet
Noah Urban, linked with the Scattered Spider cybercriminal gang, will also pay $13m in restitution to victims
This is the first post in a series exploring security vulnerabilities in Windsurf. If you are unfamiliar with Windsurf, it is a fork of VS Code and the coding agent is called Windsurf Cascade.
The attack vectors we will explore today allow an adversary during an indirect prompt injection to exfiltra...