> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Former Uber CISO Joe Sullivan says CISOs are thinking about themselves rather than the bigger picture due to the risk of personal liability
Forty-three of the world’s 48 largest energy companies were hit by a third-party data breach over the past year
Exfiltrate data via S3:GetObject and S3 server access logs.
Secret government requests for Android and iOS push notification data should be made public, argues Ron Wyden
Information on cancer and maternity patients was accidentally disclosed by Cambridge University Hospitals NHS Foundation Trust
Australian Financial Service Data Breach, 7 December 2023: Nissan Australian and New Zealand Nissan Corporation and Financial Services discloses cyber incident. Also affecting Nissan Financial Services, Mitsubishi Motors Financial Services, Renault Financial Services, Skyline Car Finance. RAM Truck...
Articles
Endpoint Security exclusions for third-party security products
Manually uninstall TDR Host Sensor
TDR Host Sensor icon in system tray shows yellow exclamation point (!) warning
VLAN or Bridge networks take the lowest available MTU value from their assigned network interfaces
Known Issues...
In our previous blog post, we have introduced our latest research into full chain baseband exploits. We have showcased new research tools (our nanoMIPS decompiler, debugger, and emulator for Mediatek basebands) and explored the interconnected components across the Cellular Processor and the Applicat...
Additional posts in this series:
Part 1 Part 3 If you’ve watched my Basebanheimer talk, you will have noticed that concrete ideas for exploiting CVE-2022-21744, a heap buffer overflow in Mediatek baseband, were omitted from the talk for brevity.
This heap overflow vulnerability has an important limi...
L'entreprise de distribution d'eau et d'électricité Aqualectra à Curaçao a subi une cyberattaque qui l'a contrainte à déconnecter temporairement toutes ses connexions en ligne, affectant ses systèmes internes et son service client. Aqualectra a agi rapidement pour contrer l'attaque et a effectué des...
Additional posts in this series:
Part 1 Part 2 In my Basebanheimer talk at Hardwear.io, I explained a method for exploiting the Mediatek Baseband Pivot vulnerability CVE-2022-21765 for arbitrary code execution in the Linux kernel on Mediatek’s older (“Helio”) chipsets, which use 32-bit kernels.
I al...
Le district scolaire de Hinsdale a été touché par une attaque de ransomware jeudi matin. Les responsables sont en train d'évaluer la situation avec l'aide de professionnels en cybersécurité et d'assurance cybernétique, et communiqueront davantage d'informations ultérieurement. Tous les ordinateurs p...
La mairie de Poços de Caldas, dans l'état de Minas Gerais au Brésil, a annoncé la remise en service progressive de ses systèmes après un possible cyberattaque. Les services publics tels que le journal officiel, les consultations publiques et les documents sont désormais accessibles aux citoyens, bie...
The Cycode report draws from a survey of 500 US CISOs, AppSec Directors and DevSecOps team members
L'Université de Wollongong a été victime d'une cyberattaque détectée jeudi, qui a compromis des données. Il est fortement recommandé aux personnes affiliées à l'université de changer immédiatement leurs mots de passe.
Kaspersky found multiple variants, but none are being marked as malicious by anti-malware vendors
We are publishing a set of custom CodeQL queries for Go and C. We have used them to find critical issues that the standard CodeQL queries would have missed. This new release of a continuously updated repository of CodeQL queries joins our public Semgrep rules and Automated Testing Handbook in an eff...
The strain was responsible for over a quarter of global ransomware attacks between January 2022 and September 2023
Legal experts claim that landmark ECJ ruling will make it easier for authorities to sanction organizations infringing the GDPR
L'Université de Sherbrooke a été ciblée par une cyberattaque qui a affecté deux de ses laboratoires de recherche, entraînant la compromission de certaines données. La situation a été suffisamment maîtrisée pour que les étudiants et les employés puissent continuer à accéder à leurs plateformes numéri...