> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights critical threats in the software supply chain and the rising risks associated with AI technologies. Attackers have exploited OpsShield's trusted update channel, demonstrating vulnerabilities in software supply chains that could compromise user security. Meanwhile, financial institutions, such as Bank of America, are warning customers against sharing sensitive banking information with AI assistants, emphasizing the potential for significant financial risks. These developments underline the urgent need for enhanced security measures in both software development and user interactions with AI.
|
// AI-powered summary generated at 04:00
Several security issues were fixed in OpenSSL.
A nonprofit in California is doing what Hugging Face has not—attempting to hold OpenAI legally accountable for the actions of its agents.
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]
It was discovered that OpenSSL incorrectly handled certain certificate
revocation list distribution point names. An attacker could possibly use
this issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. (CVE-2026-35189)
It was discovered that OpenSSL incorrectly hand...
Wordfence's Q2 2026 threat intelligence report covers 2,073 published WordPress vulnerabilities, 182 high threat vulnerabilities, 10.4 billion blocked WAF attacks, 18.2 billion blocked brute force attacks, and 573K infected sites, plus trends in vulnerability classes, attacker activity, and malware....
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. [...]
Le Président de l'autorité polonaise de protection des données (UODO) a sollicité l'intervention du Procureur Général pour la reprise d'une enquête sur une fuite de données provenant de la plateforme de vente chinoise pandabuy.com, après le classement de l'affaire par le parquet.L'affaire a débuté l...
Le président de l'autorité polonaise de protection des données (UODO) est intervenu à plusieurs reprises pour dénoncer les pouvoirs d'accès aux informations bancaires des citoyens accordés à l'Administration Nationale Fiscale (KAS), jugés disproportionnés et non conformes au RGPD.Un projet de loi pa...
Learn how hacker tools such as malicious USB cables, keyloggers, and RFID readers can target systems and what you can do to stay safe.
c-ares could be made to crash or run programs if it received specially crafted network traffic.
Two questions remain: who is abusing the CVEs? And why did Citrix take so long to disclose?
An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July.
Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the agenc...
Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. [...]
Dutch police said the hacker, arrested for being part of the ShinyHunters cybercriminal gang, had plans to organize the murder of two people on his laptop.
The AIxCC competition winner will analyze messaging app code and compiled binaries for vulnerabilities, with technology that could also help commercial customers secure their software.
The post DARPA Selects Xint to Use AI in Securing Military Messaging Apps appeared first on SecurityWeek.
Russian state hackers known as Star Blizzard have been using fake event invitations to trick people into installing a backdoor on their Windows computers, according to Microsoft.
The campaigns, aimed at people and organizations tied to Ukraine, have affected more than 100 organizations since Januar...
A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time (JIT) engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors.
The new Spectre-v2 varia...
A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. [...]
Branch Target Reuse (BTR) is a new Spectre v2 attack targeting JIT compilers in web browsers, language runtimes, and the operating system kernel
The post New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks appeared first on SecurityWeek.
Yuqi Qiu and Xiang Li discovered that libheif incorrectly handled certain
compressed metadata. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 26.04 LTS. (CVE-2026-84384)
Yuqi Qiu and Xiang Li discovered that libheif...