> TODAY'S SUMMARY (45 articles)
Recent cyber threats show a significant rise in supply chain attacks, with attackers exploiting GitHub issues to compromise 61 public repositories in under an hour. Impersonation tactics are increasingly used to extract sensitive credentials from organizations, targeting major AI firms like OpenAI and Meta. Cisco is facing challenges with multiple zero-day vulnerabilities in its firewall software, leading to remote crashes and exploitation for malware deployment. Online scams have surged, overtaking phishing attempts, while significant data breaches, including the theft of 2.6 million records from Sony’s ISP, highlight the ongoing risks to personal information. Additionally, hacktivist groups are leaking sensitive government employee data, emphasizing the need for robust data protection measures.
|
// AI-powered summary generated at 12:01
Les écoles publiques de Burnaby ont subi une panne de services (internet et lignes téléphoniques) depuis lundi, suite à ce que le district scolaire qualifie d'« incident cybernétique ».
Les écoles publiques de Spokane (Spokane Public Schools) ont signalé un incident de sécurité réseau survenu pendant la nuit. Par mesure de précaution, plusieurs de leurs systèmes ont été mis hors ligne, entraînant des perturbations de service pour les familles.
A year ago, I wrote about the road to quantum-safe cryptography in Red Hat OpenShift. At the time, much of that road was forward-looking: TLS 1.3 was not yet the default, Go did not support post-quantum algorithms, and the first NIST post-quantum cryptography (PQC) standards had only just been final...
Fresenius Medical Care a fait état d'un incident de cybersécurité impliquant un accès non autorisé à un nombre limité de systèmes internes. L'entreprise a indiqué que les soins aux patients, les opérations de fabrication et la continuité des activités n'ont pas été affectés. L'incident a été contenu...
In a post-Mythos world, IT teams face a mounting crisis. Many are doing more with the same staff, and security work hasn’t gotten simpler. Alerts still land without context. Compliance still means chasing down answers across tools. A single incident can consume an afternoon before anyone knows the r...
Updated OSINT Scripts
De multiples vulnérabilités ont été découvertes dans les produits Mattermost. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans Synology DSM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Le marché boursier du Népal a été brusquement fermé le lundi suite à une cyberattaque par ransomware ciblant l'infrastructure de Data Hub Pvt. Ltd., qui héberge les serveurs du Système de Gestion des Transactions (TMS) de 72 sociétés de courtage. L'attaque a été détectée vers 5h30 du matin. Les auto...
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer une élévation de privilèges et un problème de sécurité non spécifié par l'éditeur.
Ce bulletin d'actualité du CERT-FR revient sur les vulnérabilités significatives de la semaine passée pour souligner leurs criticités. Il ne remplace pas l'analyse de l'ensemble des avis et alertes publiés par le CERT-FR dans le cadre d'une analyse de risques pour prioriser l'application des...
Claims by officials of cyberattacks against election infrastructure could not be independently verified. Russian officials provided little technical evidence about the attacks or who it claimed who was behind them.
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed PSD, light effects filter, ICO, PIX or PCX files are opened. For the stable distribution (trixie), these problems h...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below...
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts. [...]
An AI-generated intelligence report falsely identified weapons on a Chinese ship, nearly triggering a US military operation during the Iran war. According to CNN, four sources familiar with the episode say an intelligence report circulated through the military claiming a Chinese vessel in the Middle...
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Gray Rabbits and the Tale of a One-Click Backdoor  Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit Malic...
Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both. [...]
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: What we know about the Revolut data breach so far Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank co...
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Google Gemini also Broke Out of Its Test Environment...