> TODAY'S SUMMARY (4 articles)
Today’s cybersecurity landscape highlights several critical threats. Researchers from Param have identified a vulnerability in ChatGPT where a malicious share link can execute code in a user's session, potentially exposing private chats. Meanwhile, Cloudflare reported a staggering 18.2 million network-layer DDoS attacks in Q3, an increase of 38%, averaging over 8,200 attacks per hour. Additionally, Microsoft has issued warnings regarding a malicious extension mimicking Claude Code, which establishes a persistent SSH backdoor for attackers. Organizations need to be vigilant in improving their defenses against these escalating threats.
|
// AI-powered summary generated at 08:00
Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques...
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs An automated campaign that Wiz has tracked since September 15 and named Gheist is using stolen GitHub tokens to plant workflows on new “ci-sync-” branches that print every secret a repository can read into its GitH...
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution.
The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.
Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry
Avec Tailworm, Erica Windisch a publié 11 failles non corrigées dans Tailscale et Headscale, dont un accès root via Tailscale SSH. Voici comment vous protéger.
Le post Tailworm : 11 failles non corrigées dans Tailscale, dont un accès root via Tailscale SSH a été publié sur IT-Connect.
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP...
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the...
[This is a Guest Diary by Jeffray Spence, an ISC intern as part of the SANS.edu BACS program]
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
The post Mythos 5 Ignored Real-World Harm in July Attack appeared first on SecurityWeek.
Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization o...
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Huntress, which observed the activity between J...
The number of cybersecurity startups attempting to cash in on the AI boom is staggering. But an analysis of the cybersecurity marketplace indicates that the incumbents, rather than resting on their laurels and opening themselves up for disruption, are quickly adapting to the n...
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary...
PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium
Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and memory-safety bugs in security-critical code without a running application. In its first open source research run, it found High or Critical issues in 45...
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an an...
Vous utilisez le DNS 9.9.9.9 ? Le 24 novembre 2026, Quad9 cessera de servir la France plutĂ´t que d'appliquer un blocage judiciaire. Voici ce que l'on sait.
Le post Quad9 quitte la France : le DNS 9.9.9.9 sera coupé le 24 novembre 2026 a été publié sur IT-Connect.