> TODAY'S SUMMARY (133 articles)
Today's cybersecurity landscape reveals significant threats and trends:
1. A Canadian has been extradited to the U.S. for allegedly hacking schools across multiple states and using their systems for illicit cryptomining.
2. DreamHost confirmed a data breach that exposed customer FTP logins and webmail sessions after attackers accessed its File Manager platform for two months.
3. Cyberattacks targeting French blood banks and other refrigeration systems across Europe have disrupted critical operations, highlighting vulnerabilities in essential services.
4. Crédit Mutuel Arkéa reported a cyber heist resulting in the theft of approximately $133 million through compromised supplier accounts.
5. A critical vulnerability in WordPress is actively being exploited, prompting warnings from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
6. The rise of AI has introduced new challenges, with incidents of AI-generated malware and automated attacks linked to AI tools becoming increasingly prevalent.
|
// AI-powered summary generated at 20:00
Apple patched a CoreGraphics zero-day that may have been exploited in targeted attacks. A public PoC for the flaw is now available. Apple patched a zero-day vulnerability, tracked as CVE-2026-86950, in CoreGraphics that attackers may have exploited to target specific individuals. The flaw is an out-...
It was discovered that OpenSSL had an inefficient algorithm in its QUIC
stream reassembly implementation. A remote attacker could possibly use this
issue to cause OpenSSL to use excessive CPU resources, leading to a denial
of service. (CVE-2026-42772)
It was discovered that OpenSSL did not properly...
Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises...
Two-thirds report immediate recovery, although teachers remain divided over whose job security is
The Series B brings the AI-powered offensive security startup’s total funding to roughly $445 million only seven months after its public launch.
The post Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation appeared first on SecurityWeek.
Free Mobile customers received very convincing phishing emails after major data breach.
Free Mobile customers received very convincing phishing emails after major data breach.
It was discovered that OpenStack Designate did not properly validate
overlapping zones under certain circumstances. An authenticated user could
possibly use this issue to redirect DNS traffic to attacker-controlled
systems or cause a denial of service.
Armadin has raised $255.5 million in Series B funding co-led by Andreessen Horowitz (a16z) and Accel that brings the company’s valuation to over $2.5 billion. The round includes participation from new investors Bain Capital Ventures (BCV) and Redpoint. Existing investors 8VC, Ballistic Ventures, Goo...
Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. [...]
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers:
To determine this, CR dug through thousands of pages of automakers’ privacy policies and asked questions of 15 different automakersÂBMW, Ford, General Motors, Honda, H...
The FBI has a very simple message for the ShinyHunters gang: give yourselves up.
On Tuesday, FBI cyber division assistant director Brett Leatherman released a video, thanking the Dutch police for arresting a 24-year-old man they believe to be a member of the group, and and who is separately suspe...
An alleged key figure in the ShinyHunters cybercrime group has been arrested in the Netherlands, and - in a sinister twist - the 24-year-old suspect is also being investigated for attempting to arrange two murders.
Read more in my article on the Hot for Security blog.
Three independent labs, three standout results: a perfect score, top certification, and every threat stopped before it ran.
The US government continues its crackdown on Tren de Aragua over its ATM jackpotting scheme.
The post Treasury Blacklists Most-Wanted ATM Malware Developer and His Network appeared first on SecurityWeek.
It was discovered that KCoreAddons incorrectly handled shell argument
quoting in KShell::quoteArgs. The parsing did not adequately handle shell
metacharacters, which could lead to a shell escape. An attacker could
possibly use this issue to execute arbitrary commands in applications that
relied on t...
Social Security numbers and other personal details of military personnel and their families were exposed in a months-long Pentagon breach.
OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models.
A "core cluster of the activity," going back to the first week of July, has been attributed to individual...
The Information Commission replaces the Information Commissioner, putting statutory powers under collective control
The flaws were chained to hijack sessions, achieve remote code execution, and elevate privileges to root.
The post Zammad Zero-Days Exploited in AI-Powered DIVD Hack appeared first on SecurityWeek.