> TODAY'S SUMMARY (1 articles)
Today's cybersecurity news highlights a significant vulnerability where attackers are exploiting Check Point firewalls, turning them into gateways for further infiltration into customer networks. This underscores the evolving threat landscape, where traditional security measures are being repurposed against organizations. Additionally, the trend of utilizing legitimate security devices as footholds by attackers indicates a need for enhanced monitoring and response strategies. The incident serves as a reminder that perimeter defenses must be continuously assessed and updated to counter sophisticated attacks. Organizations are urged to reinforce their security protocols and ensure comprehensive visibility across their networks.
|
// AI-powered summary generated at 04:00
The financial sector was the industry most targeted by distributed denial-of-service (DDoS) attacks in 2024, with a peak in October
In October 2023, we audited Silence Laboratories’ DKLs23 threshold signature scheme (TSS) library—one of the first production implementations of this then-novel protocol that uses oblivious transfer (OT) instead of traditional Paillier cryptography. Our review uncovered serious flaws that could enab...
SentinelOne revealed details of two new intrusion attempts by China-nexus actors
UNFI says it is investigating unauthorized network activity, and that some operations are affected
When it comes to open source intelligence (OSINT), LinkedIn is a treasure trove of information. With millions of professionals voluntarily sharing details about their careers, connections, personal achievements, or keeping up to date with what is happening in their professional sphere, the famous ne...
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS and FortiProxy may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component. Revised on 2025-09-15 00:00:00
CVSSv3 Score:
3.9
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.
Revised on 2026-06-15 00:00:00
Le comté d'Albemarle en Virginie a subi une attaque informatique, ce qui a entraîné une perte d'accès à Internet dans ses bâtiments administratifs. Les services de sécurité publique n'ont pas été affectés, mais certains services pourraient être temporairement indisponibles. Une équipe de cybersécuri...
Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés par le CERT-FR dans le cadre d'une analyse de risques pour prioriser l'application des...
The Worcester Regional Retirement System experienced a network disruption on June 10, 2025, which led to a data security incident involving the unauthorized access and acquisition of certain information. The incident affected approximately 150 Maine residents. The system has taken steps to enhance s...
Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about Twitter (uh, X)’s new end-to-end encryption messaging protocol, which is now called XChat. The TL;DR of...
Vulnerability in PayU CommercePro plugin allows account hijacking on thousands of WordPress sites
New PathWiper malware targeted Ukrainian critical infrastructure, using legitimate tools for cyber-attacks
When the Model Context Protocol (MCP) came out it reminded me of the Common Object Model (COM) from Microsoft.
COM has been around for decades and it’s used for programming, scripting, sharing of functionality at a binary/object level across languages and hosts. Via DCOM all of this can even be done...
A new Trump Executive Order limits the use of cybersecurity-related sanctions only against foreign malicious actors
The Justice Department has filed a civil forfeiture complaint alleging North Korean IT workers amassed $7m+
Social recovery sounds like a friendly safety net — until it isn't. In reality, it hands your security over to the very humans crypto was built to eliminate from the trust model. A UX-driven mirage of safety masks the vulnerabilities of guardianship, turning recovery into the ultimate attack vector.
The FBI says mainly Chinese-made IoT devices pose a threat from Badbox 2.0 malware
ERIE a connu une panne de réseau qui affecte ses systèmes, les ressources disponibles travaillent pour rétablir l'accès le plus rapidement possible, les propriétaires de police peuvent contacter leur agent ou l'équipe de première notification de perte d'ERIE, les services en ligne et de gestion de l...
Pour le deuxième jour consécutif, la librairie en ligne YES24 a été victime d'une attaque par ransomware, entraînant des problèmes d'accès à son site web et à son application dès 4 h du matin le 9 juin. L'entreprise a immédiatement lancé des mesures de sécurité, alerté les autorités compétentes, don...