> TODAY'S SUMMARY (150 articles)
Today’s cybersecurity news highlights significant vulnerabilities and trends. Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 flaws, including three zero-day vulnerabilities, emphasizing the critical need for timely updates. Ivanti Connect Secure is under scrutiny for zero-day vulnerabilities that allow attackers to gain root access, with the U.S. CISA listing it as a known exploited vulnerability. Meanwhile, small AI models are raising alarms for their potential to self-replicate across IoT devices, posing new security risks. In retail, Ahold Delhaize is investigating a cyberattack that forced the company to disconnect systems, while recent attacks have also disrupted refrigeration systems in French supermarkets, leading to significant food waste. Additionally, vulnerabilities in Docker Hub and GitLab highlight ongoing risks in software supply chains, underscoring the importance of robust security measures across platforms.
|
// AI-powered summary generated at 20:00
Stuxnet is often cited as history’s first true cyber weapon. By common consensus it was developed and used by the US and Israel to successfully disrupt Iran’s nuclear program – but a new report questions its success.
CISOs are often the first victim following a major security breach. Given the prevalence of such breaches, the average tenure of a CISO is now just 18 months; and this is likely to worsen if corporate security doesn’t improve.
In the second part of our three-part series, we investigate the tools provided by the Elderwood kit for developing exploits from discovered vulnerabilities. Elderwood and the Department of Labor Hack Writing Exploits with the Elderwood Kit (Part 1) Writing Exploits with the Elderwood Kit (Part 2) Se...
Pushdo, one of the more enduring and resilient botnets, has already survived four takedowns in five years. Now a new variant with new evasion techniques has been detected.
The Twitter product security team are improving the security of their code by adopting more security automation.
Recently, the Department of Labor (DoL) and several other websites were compromised to host a new zero-day exploit in Internet Explorer 8 (CVE-2013-1347). Researchers noted similarities between this attack and earlier ones attributed to Elderwood, a distinct set of tools used to develop several past...
Four LulzSec members who claim to be "latter-day pirates" have plead guilty to hacking charges and compromising millions of people's information.
Android malware authors have officially turned the complexity corner, according to an analysis of mobile malware for the first quarter of 2013. The size and scope of the Android threatscape is evolving, adding new tactics and advanced approaches that extend beyond malicious applications.
Plusieurs rendez-vous français habituels sont consacrés cette année à la cybersécurité industrielle.
Comme pour faire écho à mon précédent article concernant la publication en 2013 de plusieurs normes par l’ISA (International Society of Automation), l’antenne française de [...] Lire la suite
Heise Security published a suggestion that Microsoft is reading users’ Skype messages, but Microsoft maintains automated scanning is used to identify suspected spam and phishing links.
Infosecurity Europe has released basic figures on last month’s eighteenth annual exhibition and conference: pre-ABC audit figures show a 6% increase in visitors over 2012 to 13,200, with more than 70 new exhibitors.
DDoS services for hire – so-called “booters” that can be hired to knock, or boot, a website offline – are making their way out of the dark shadow-world of hacker message boards and forums, instead taking payments via PayPal and advertising in mainstream venues like YouTube with handy videos featuri...
At the Security Development Conference in San Francisco, Howard Schmidt, executive director, SAFECode, announced that the non-for-profit organization is tackling software development and engineering security with a set of free online training courses, available via on-demand webcasts and covering a...
The US government and MIT/JSTOR had agreed that documents concerning the prosecution of Aaron Swartz could, in part, be made public. The Swartz estate asked for the documents in full. The court has denied the estate and allowed the government and MIT/JSTOR to redact certain information.
A new crop of Mideast-originated cyberattacks are targeting the American energy sector, with the intent of sabotage, not just espionage.
A witness statement filed in the high court London claims that Gamma International’s FinFisher (FinSpy) covert surveillance software targeted the computer of a leading Bahraini activist who holds dual British and Bahraini citizenship.
Fraud is big business in China. Last year there were more than 170,000 cases causing losses of more than $12.5 billion. New evidence suggests this might be getting worse with increasingly sophisticated cyber fraud.
Snapchat doesn’t delete expired photos on Android phones – it merely tells the operating system to ignore them. That means they are still available for retrieval with the right forensic software.
A global gang of hackers managed to siphon off $45 million from ATMs thanks to outdated US credit card technology.
Security shouldn’t get in the way of doing business and closing sales, but many organizations are wrestling with data protection strategies that block employees' ability to get the information they need to do their jobs. Almost half of all employees in a recent survey admitted to bypassing security...