> TODAY'S SUMMARY (17 articles)
Today's cybersecurity news highlights several critical threats and trends:
1. The upcoming November 2026 Patch Tuesday is expected to address numerous CVEs, indicating ongoing vulnerabilities in older software systems.
2. A significant backdoor was discovered in Control Web Panel, enabling unauthorized command execution without logging, underscoring the risks in web server management tools.
3. Barracuda's Email Security Gateway was found to have exploitable flaws allowing root access without authentication, posing a major risk to email security.
4. New AI-driven scams have emerged, including a scheme where individuals impersonated CEOs to defraud companies of $129 million.
5. CERT-IN reported a rise in AI-powered attacks specifically targeting Indian fintechs during weekends, indicating a strategic shift by threat actors.
6. The FBI and CISA issued warnings about cyberattacks on industrial refrigeration systems, raising alarms about potential food safety and operational hazards.
|
// AI-powered summary generated at 08:00
BigDiskBuster, la nouvelle faille zero-day de Nightmare Eclipse, sature le disque pour empĂŞcher Microsoft Defender de se mettre Ă jour sur Windows.
Le post BigDiskBuster : cette nouvelle zero-day empêche Microsoft Defender de se mettre à jour a été publié sur IT-Connect.
Information published.
The EvilTokens phishing service, which compromised more than 12,000 inboxes at over 10,000 organizations, has been disrupted by a coalition of law enforcement and private-sector partners led by Microsoft. With authorization from the US District Court for the Eastern District of Virginia, Microsoft a...
Remote attackers could trigger the critical-severity flaw to access privileged internal functionality.
The post Arista Urges Immediate Patching of Exploited VCO Zero-Day appeared first on SecurityWeek.
The EU Court of Auditors has criticized EU shortcomings in responding to major cyber incidents
Claude Opus 5.5 is available across Anthropic’s platforms, Amazon Web Services, Google Cloud and Microsoft Azure. Developers can access it through the Claude Platform using the model name claude-opus-5-5. It includes watermarking measures designed to comply with the EU AI Act. Built for long and com...
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites.
The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CV...
Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says.
The flaw, CVE-2026-94127, affects only systems in which APM serves as an OAuth authorization server, issuing access tokens to applications. F5 di...
Concerns over agentic risks are rising, and identity and access management (IAM) giant Okta believes it’s making the moves of a would-be leader in this emerging cyber market.
“Identity is the primary control plane for securing AI,” said Okta CEO and co-founder Todd McKinnon...
Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer. Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that...
An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in Ryuk ransomware attacks. [...]
SPONSORED EXPLAINER: Merging security into the network makes enterprise protection more agile
WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution. WordPress 7.1.2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9.2), which stems of how the C...
Unauthenticated attackers could send malicious traffic to BIG-IP to achieve remote code execution.
The post Critical F5 BIG-IP Vulnerability Exploited as Zero-Day appeared first on SecurityWeek.
F5 has released security updates to address a critical BIG-IP APM zero-day vulnerability being exploited in remote code execution attacks. [...]
The cybercrime group is unhappy with its description in an FBI report and threatens to leak stolen information.Â
The post ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report appeared first on SecurityWeek.
A new security vulnerability in Next.js could allow attackers to run code on a server via ImageResponse, the feature that generates Open Graph and other social preview images, Vercel said.
The risk applies when an app puts values an attacker controls, such as text read from the request URL, into th...
32 GW en service et 70,6 GW en construction ou en projet : la capacité américaine écrase le reste du monde. Et la France, où en est-elle ? Les chiffres.
Le post Data centers : les États-Unis pèsent plus lourd que 14 pays réunis a été publié sur IT-Connect.
The critical-severity flaw could allow unauthenticated attackers to upload and execute arbitrary scripts.
The post Check Point Patches Exploited Management Server Zero-Day appeared first on SecurityWeek.
ShinyHunters affirme avoir volé 2 à 3 To de données au FBI via une faille zero-day dans Oracle PeopleSoft. En échange, il exige le retrait d'un rapport.
Le post Le FBI piraté ? ShinyHunters ne veut pas d’argent, mais le retrait d’un rapport a été publié sur IT-Connect.