> TODAY'S SUMMARY (152 articles)
Today's cybersecurity news highlights a range of significant threats and trends:
1. The City of Osaka has reported a data breach affecting 1 million residents, urging caution against phishing attempts disguised as government communications.
2. Trezor confirmed that malicious implants in hardware wallets sold by a reseller can steal sensitive recovery phrases, emphasizing risks in the cryptocurrency market.
3. Microsoft is grappling with a global outage of its 365 services, attributed to a bad update, raising concerns over the potential exploitation of this chaos by cybercriminals.
4. Security vulnerabilities in Check Point gateways have been exploited to deploy destructive malware, highlighting critical risks in security infrastructure.
5. New insights indicate that AI is influencing the evolution of ransomware tactics, suggesting that attackers may soon leverage AI for more sophisticated operations.
6. The FBI has linked North Korean hackers to significant cryptocurrency thefts, further stressing the ongoing threat posed by state-sponsored cybercrime.
7. Phishing incidents have surged in Europe, outpacing global trends, underscoring the need for enhanced vigilance and protection mechanisms against social engineering attacks.
|
// AI-powered summary generated at 20:01
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR may allow an attacker who has already obtained a non-login low privileged shell access to perform a local privilege escalation via crafted commands. Revised on 2025-10-14...
A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in FortiAnalyzer may allow an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests. Revised on 2025-10-14 00:00:...
Malfunctioning equipment and manual processing cause 90-minute waits The European Union's new biometric Exit/Entry System (EES) got off to a chaotic start at Prague's international airport, with travelers facing lengthy queues and malfunctioning equipment forcing border staff to process arrivals man...
An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS may allow a local authenticated attacker to execute system commands via crafted CLI commands. Revised on 2025-10-14 00:00:00
A stack-based buffer overflow vulnerability [CWE-121] in FortiOS and FortiProxy may allow an authenticated attacker to achieve arbitrary code execution via certain CLI commands. Revised on 2025-10-14 00:00:00
Cybersecurity researchers have shed light on a previously undocumented threat actor called TA585 that has been observed delivering an off-the-shelf malware called MonsterV2 via phishing campaigns.
The Proofpoint Threat Research Team described the threat activity cluster as sophisticated, leveraging...
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSIEM may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack via crafted HTTP requests. Revised on 2025-10-14 00:00:00
A Weak authentication vulnerability [CWE 1390] in FortiPAM and FortiSwitch Manager WAD/GUI may allow an attacker to bypass the authentication process via a brute-force attack. Revised on 2025-10-14 00:00:00
An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiOS and FortiProxy ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy Revised on 2025-10-14 00:00:00
This vulnerability allows remote attackers to relay NTLM credentials on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The foll...
With just $800 in basic equipment, researchers found a stunning variety of data—including thousands of T-Mobile users’ calls and texts and even US military communications—sent by satellites unencrypted.
Une vulnérabilité a été découverte dans Elastic Cloud Enterprise. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Ellafi Federal Credit Union experienced a network disruption on October 14, 2025, which may have involved unauthorized access to personal information. An investigation revealed that certain files may have been accessed and/or acquired without authorization. The affected data included names, Social S...
Une vulnérabilité a été découverte dans Siemens SIMATIC. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans les produits Veeam. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.
The maker of ChatGPT released a toolkit to help protect its AI from attack earlier this month. Almost immediately, someone broke it.
Une vulnérabilité a été découverte dans Microsoft Azure. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.