> TODAY'S SUMMARY (150 articles)
Today’s cybersecurity news highlights significant vulnerabilities and trends. Microsoft’s October 2026 Patch Tuesday addressed a record 1,411 flaws, including three zero-day vulnerabilities, emphasizing the critical need for timely updates. Ivanti Connect Secure is under scrutiny for zero-day vulnerabilities that allow attackers to gain root access, with the U.S. CISA listing it as a known exploited vulnerability. Meanwhile, small AI models are raising alarms for their potential to self-replicate across IoT devices, posing new security risks. In retail, Ahold Delhaize is investigating a cyberattack that forced the company to disconnect systems, while recent attacks have also disrupted refrigeration systems in French supermarkets, leading to significant food waste. Additionally, vulnerabilities in Docker Hub and GitLab highlight ongoing risks in software supply chains, underscoring the importance of robust security measures across platforms.
|
// AI-powered summary generated at 20:00
Remember serial ports? Those 9-pin connections used to hook up a mouse or keyboard to a desktop computer? The world may have gone gaga for USB ports, laptops and tablets, but these relics from the pre-portable computing era are still knocking around enterprises.
Google has changed its Play Store policy to make bait and switch malware tactics more difficult – an app that is downloaded via the Google Play mechanism must now also be updated via the Google Play mechanism.
Safari, the world’s fourth most popular browser, contains a universal cross-site scripting bug that could be exploited to steal cookies, passwords or files, perform cross-site request forgeries (CSRF) or install viruses via malicious Javascript.
Tiny Iceland has a history of facing down larger adversaries (in 1976 it ‘won’ the Cod Wars against the UK; in 2011 it sent US agents packing for not obeying protocol). But now it will face renewed scrutiny from two of the world’s most powerful agencies: the FBI and the Rightsholders.
Privileged accounts with insufficient security is a prime vector for targeted cyber-attacks, leading to theft, misuse and exploitation, and their compromise is becoming a key tactic in each phase of an advanced persistent threat (APT) attack cycle.
CISOs need to change their approach if they are to make their voice heard
Large-scale financial cybercrime and state-affiliated espionage dominated the security landscape in 2012, taking top (dis)honors for being behind the most breaches during the year.
Hacktivism and espionage are poised for growth, but cyberthreats will continue to follow the money.
More small firms are the victims of cyber attacks, and the cost of breaches is rising across the board, according to a PwC-BIS survey.
Advanced evasion techniques (AETs) rarely receive the full publicity they deserve – possibly because it is a term originally coined by one manufacturer (Stonesoft) to describe how attackers defeat other security manufacturers.
Chloe Smith, Minister for Political and Constitutional Reform, opens Infosecurity Europe 2013
With 288 million active users, Twitter has proven itself over and over to be a fantastic tool for spreading information and acting as a news source, especially in times of crisis.
Attack on the drones? A dozen organizations in aerospace, defense, telecom and government agencies located in the US and India are the target of an Operation Beebus campaign that goes back to at least as early as December of 2011.
It has to be accepted that in some areas security simply isn’t working – or at least it’s not working well enough. Time and again it’s discovered that a major breach has occurred, followed by a subsequent revelation that the attackers have been on the network for months or even years.
A new mobile malware family, the appropriately named BadNews, has been found in 32 apps across four different developer accounts in Google Play. It masquerades as an advertising network, but in actuality pushes fraud-oriented malware and other “monetization” bugs.
A Baltimore-based security firm has evaluated thirteen mainstream routers used by consumers and small offices to connect to the internet, and found all of them vulnerable – 11 of them remotely.
Cody Kresinger, who pleaded guilty in April 2012 to charges of conspiracy and unauthorized impairment of a protected computer – namely, Sony Pictures Entertainment – was yesterday sentenced to one year in prison and 1000 hours community service, and further ordered to pay $605,663 in restitution.
Hopes that the Gozi trojan had suffered a severe setback with the arrest of three gang leaders appear short-lived; Gozi remains and has been integrated into an MBR bootkit making it more dangerous than ever.
A combination phishing/iframe redirect/RedKit Exploit Kit/botnet attack is exploiting recent tragic events in Boston and Waco, Texas. The campaign infects machines with the Zeus and Kelihos bots, which steal financial and personal information, send unsolicited email or hijack the machine for use in...
ThreatTrack Security, based in Clearwater, Florida, comprises experienced malware fighters and proven technologies for the analysis, detection and remediation of advanced cyber threats, including advanced persistent threats (APTs)