> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights critical threats in the software supply chain and the rising risks associated with AI technologies. Attackers have exploited OpsShield's trusted update channel, demonstrating vulnerabilities in software supply chains that could compromise user security. Meanwhile, financial institutions, such as Bank of America, are warning customers against sharing sensitive banking information with AI assistants, emphasizing the potential for significant financial risks. These developments underline the urgent need for enhanced security measures in both software development and user interactions with AI.
|
// AI-powered summary generated at 04:00
Two men who ran BEC and phishing campaigns against US businesses while serving in the Air Force have been sentenced to a combined 189 months in federal prison. According to public documents and evidence presented at sentencing, Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, both from Delawar...
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026...
Researchers find a way to recover stale indirect branch prediction entries
Roughly a dozen vulnerabilities have been patched in each of the open source cryptographic libraries.Â
The post High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL appeared first on SecurityWeek.
Nouvelle variante de Spectre v2, l'attaque BTR vise les moteurs JIT et vole le hash du mot de passe root sous Linux en 3 à 5 minutes. Comment se protéger ?
Le post 5 minutes pour voler le hash du mot de passe root sous Linux avec BTR, une variante de Spectre v2 a été publié sur IT-Connect.
Genea has announced the release of Genea MCP, a Model Context Protocol (MCP) server that connects AI agents directly to the Genea Access Control platform. Onboarding a new hire, setting up a contractor for two weeks, or unlocking the loading dock now takes one sentence instead of a dozen clicks. Gen...
More than 100 security and compliance vendors have integrations with the Claude Compliance API, which lets a company send Claude activity into the monitoring tools it already uses. CrowdStrike, Microsoft Purview, Splunk, Palo Alto Networks, Cloudflare and Zscaler are among them. For a Claude Enterpr...
Apple a corrigé la CVE-2026-86950, une faille zero-day dans CoreGraphics possiblement exploitée contre des iPhone. Voici les mises à jour à installer d'urgence.
Le post Apple a corrigé une faille CoreGraphics exploitée pour cibler des utilisateurs d’iPhone (CVE-2026-86950) a été publié sur IT-Connec...
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit, which could result in denial of service, information disclosure or potentially recovery of private keys. Additional details can be found in the upstream advisories: https://openssl-library.org/news/secadv/20260...
Signal 8.30 apporte les sauvegardes locales chiffrées sur iPhone et ordinateur. Disque externe, NAS : ce qu'il faut savoir à propos de ces évolutions.
Le post Signal : les sauvegardes locales chiffrées, sur disque ou NAS, arrivent sur iPhone, Windows, macOS et Linux a été publié sur IT-Connect.
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bu...
OWASP Noir is an open-source static analysis tool that reads an application’s source code and lists the endpoints it exposes: paths, HTTP methods, parameters, headers, and cookies, each tied to the file and line it came from. Here’s where it gets useful. Shadow APIs, the endpoints that live in the c...
Windows 11 26H2 est disponible via un enablement package : peu de nouveautés, mais un support remis à zéro et des changements par défaut en entreprise.
Le post Windows 11 26H2 est disponible : nouveautés, support et installation a été publié sur IT-Connect.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-18145.
Starting in full force on Dec. 10, 2024, the EU Cyber Resilience Act (CRA) is a regulation (EU 2024/2847) that defines mandatory cybersecurity requirements for all products with digital elements sold in EU markets. Reporting obligations will begin on Sept. 11, 2026, with full enforcement kicking in...
BH Consulting, the Irish cybersecurity and data protection consultancy, has launched BH Haven, an ongoing service that gives Irish small and medium-sized enterprises (SMEs) access to its specialist consultants, supported by a proprietary AI tool for analysis, evidence review, regulatory mapping and...
Detectify analyzed exposure data from 1,293 of its customers in the US, the UK and the Nordics and found that most serious flaws still open on their internet-facing systems are months old. Of the critical and high-severity vulnerabilities open at the time of the snapshot, 97% in the Nordics had been...
Microsoft made WSL containers generally available and shipped the feature with controls that let administrators switch it off or limit where it pulls images from. WSL containers run Linux containers on Windows through the Windows Subsystem for Linux. They install with wsl --update or from Microsoft’...