> TODAY'S SUMMARY (41 articles)
Today's cyber news highlights significant threats, particularly targeting industrial refrigeration systems. The FBI and CISA have issued warnings about attacks that can manipulate temperatures in supermarket refrigeration, posing risks to food safety and supply chains. In the realm of vulnerabilities, a memory safety flaw in CPython could allow AI inference servers to be compromised. Additionally, a critical exploit in OpenSSH may enable unauthorized access to password-disabled accounts on certain Linux systems. Meanwhile, phishing schemes leveraging fake OpenAI events are being reported, aimed at stealing Microsoft and Google accounts. The ongoing escalation of AI-driven attacks is also notable, with incidents targeting fintech firms during off-hours.
|
// AI-powered summary generated at 12:00
Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $463 million) over its processing of users’ location data and ordered the company to bring that processing into compliance within six months. The inquiry examined Google’s practices from May 25, 2018, to February 4, 2020...
It was discovered that rsyslog incorrectly calculated buffer sizes when
replacing strings. A remote attacker could possibly use this issue to cause
rsyslog to crash, resulting in a denial of service.
It was discovered that strongSwan incorrectly handled PKCS#7 containers
in the openssl plugin. A remote attacker could possibly use this issue
to cause strongSwan to crash, resulting in a denial of service.
(CVE-2026-78123)
It was discovered that strongSwan incorrectly handled memory when
enumerati...
Defenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence.
It was discovered that ClamAV incorrectly handled certain zip archive
files. A remote attacker could possibly use this issue to cause ClamAV
to crash, resulting in a denial of service. (CVE-2026-20337,
CVE-2026-20338)
It was discovered that ClamAV incorrectly handled certain PESpin files.
A remote...
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea.
The post Rust Team Members and Popular Crate Owners Targeted via Video Calls appeared first on SecurityWeek.
Microsoft warned that the built-in File History backup feature in Windows may stop working on some systems after installing the September 2026 security updates. [...]
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT depa...
The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack.
The post CrowdSec Confirms Source Code Stolen in Supply Chain Attack appeared first on SecurityWeek.
Scammers are posing as police officers and federal agents, threatening arrest unless victims pay up, the FBI warns. The FBI’s Internet Crime Complaint Center (IC3) updated an alert it first issued in 2022, citing “losses totaling more than $1.6 billion” between January 2025 and July 2026. According...
Officials discussed setting up a mechanism for the two countries to notify each other of AI incidents which could threaten national security.
Attackers are courting crate owners with plausible company profiles and booby-trapped recruitment calls
Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography. I reached out t...
A BYD Shark 6 was remotely hacked, exposing vehicle controls, location tracking and cabin audio, raising serious connected-car security concerns. A journalist drove a BYD Shark 6 down a country road outside Canberra while a hacker sitting on the shoulder killed the headlights with a keystroke. That’...
Gyazo server flaw exploited to steal 23.6 million user records The cloud-based screenshot platform Gyazo, operated by Helpfeel, confirmed that attackers exploited a server vulnerability on September 11 to access its database and steal roughly 23.6 million user records, including names, emails, passw...
Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.
The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said.Â
The post Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems appeared first on SecurityWeek.
We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies.
The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42.
Siemba has announced automated testing for insecure direct object reference (IDOR) as part of its API Security Testing capability, which tests REST, GraphQL and SOAP APIs for the vulnerability classes most likely to expose customer data. A 200-endpoint API collection can be tested for IDOR in under...
Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory.
The post Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities appeared first on SecurityWeek.