> TODAY'S SUMMARY (4 articles)
Today’s cybersecurity landscape highlights several critical threats. Researchers from Param have identified a vulnerability in ChatGPT where a malicious share link can execute code in a user's session, potentially exposing private chats. Meanwhile, Cloudflare reported a staggering 18.2 million network-layer DDoS attacks in Q3, an increase of 38%, averaging over 8,200 attacks per hour. Additionally, Microsoft has issued warnings regarding a malicious extension mimicking Claude Code, which establishes a persistent SSH backdoor for attackers. Organizations need to be vigilant in improving their defenses against these escalating threats.
|
// AI-powered summary generated at 08:00
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
PHP says the flaw can be reached through the cURL extension when th...
Zheng Zhao and his co-conspirators allegedly deceived 174 U.S. residents into sending funds to a globally coordinated fake investment operation with ties to Cambodia.
The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.
Serbian strongman leader Aleksandar Vučić on Sunday admitted defeat in his race for prime minister, a loss that follows a series of incidents of digital repression that galvanized the opposition.
Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly c...
Brotli could be made to crash or run programs if it received specially crafted input.
Several security issues were fixed in nginx.
The vast amount of information on the open web requires researchers and journalists to adapt with new tools to make sense of it all. Checking facts, gauging public opinion, and other lines of inquiry depend on being able to analyze the overwhelming amount of material posted online every day. Unfortu...
Cellebrite’s Autumn 2026 Release introduces enhanced agentic AI-powered investigations with Genesis, expanded device access and new capabilities to help teams uncover critical evidence faster.
Ukrainian Defense Minister Yevhen Khmara said Saturday that Starlink and Starshield connectivity had been restored.
44-year-old Zheng Zhao was allegedly a key money-launderer working with a group of scammers who called U.S.-based victims and urged them to invest in fictitious businesses.
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]
Google’s privacy policy now lets connected Gmail and Photos data shape Search ads. Here’s how to disconnect Personal Intelligence — and why that’s still not enough.
Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malwa...
WPAD est activé par défaut sous Windows et peut servir de vecteur d'attaque. Comprenez le protocole, ses risques réels en 2026 et désactivez-le par GPO.
Le post WPAD sous Windows : comprendre le protocole, ses risques de sécurité et le désactiver par GPO a été publié sur IT-Connect.
CISA’s new strategy, CISA 2030, will focus on rapid detection and response and resiliency of critical services ahead of “passive defense”
It was discovered that Brotli incorrectly handled certain compressed
streams. A remote attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.
"A consistent pattern of attacker be...
Claude maker reveals financials and warns investors its AI models could blackmail humans, resist shutdown, or go rogue
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]