> TODAY'S SUMMARY (18 articles)
Today's cybersecurity news highlights various significant threats and trends:
1. **AI-Generated Code Concerns**: Proton's CEO downplays security testing for AI-written code, raising concerns about potential vulnerabilities in software development.
2. **Data Breach at DHS**: A hacker leaked personal data of over 40,000 Department of Homeland Security employees, underscoring the ongoing risks of data breaches in government sectors.
3. **Fake IT Scams**: Attackers impersonating IT support managed to manipulate employees into granting remote access, revealing the effectiveness of social engineering tactics.
4. **Cryptocurrency Exchange Breach**: Binance experienced a significant security incident affecting $6.3 billion in assets, highlighting vulnerabilities in cryptocurrency platforms amid increasing cyber threats.
5. **Scammers Adapt Quickly**: Fraudulent online shopping sites are being rapidly re-established after takedowns, indicating persistent challenges in combating e-commerce scams.
6. **IoT Device Risks**: A recent report identifies smart TVs as major targets for cyber vulnerabilities, emphasizing the need for security measures in household IoT devices.
|
// AI-powered summary generated at 08:00
La Commission de protection des informations personnelles (PIPC) sud-coréenne a initié une enquête sur Google concernant une potentielle fuite de données de victimes de crimes sexuels numériques.L'enquête fait suite à des rapports médiatiques indiquant que des demandes de suppression de contenus, so...
Microsoft is changing the destination address of two of its most popular services: starting this month, it will redirect M365 and Teams web users to copilot.cloud.microsoft and teams.cloud.microsoft, respectively.
The Teams move is already under way, and Microsoft has now a...
Amazon recently debuted a new feature for its Ring cameras that the company is calling Throw Away the Key Encryption (TAKE). The idea is to cut back on the amount of video content available to the company, and thus potentially available to law enforcement. But while it might technically add a speed...
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.
The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits AP...
Threat actors are exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. [...]
ConnectWise has issued a security update for ScreenConnect, five days after warning customers the product could allow files to be transferred and executed through active remote sessions without authorization or confirmation.
The company warned customers on Sept. 3 of the pr...
Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax.
Knowledge distillation by itself is a legitimate training method. It refers to a...
The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server.
The post GitLab Vulnerability Exploited One Day After Disclosure appeared first on SecurityWeek.
A website linked to India’s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors’ clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging...
A breach at email marketing company Brevo exposed Trezor, CoinTracking, and BitBox customers to phishing emails, but others may also be at risk.
I identified an attacker using a semi-autonomous coding agent to run an offensive operation: finding poorly secured LLM resale gateways, acquiring API access through ordinary web flaws and account farming, validating the resulting inference capacity, and aggregating it behind a single gateway of the...
Microsoft prépare une fonction native de sauvegarde et de restauration des équipes et canaux Teams, avec une disponibilité prévue en décembre 2026.
Le post Microsoft Teams : une fonction de sauvegarde et de restauration des équipes et des canaux arrive en décembre a été publié sur IT-Connect.
Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026.
The threat actors, which the artificial intelligence (AI) company has branded Generative...
Noteworthy stories that might have slipped under the radar: Invisible Unicode slips past phishing filters, US puts $10 million bounty on Iranian cyber official, military ties of Chinese hacking group QTFY.
The post In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review ap...
Anthropic has owned up to a fourth security incident involving its AI model, Claude, escaping onto the open internet and attacking other organizations during a test of cybersecurity abilities on what was believed to be a closed system.
The company revealed three such incide...
Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve.
The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands...
Threat actors are abusing trusted AI platforms to host malicious content, poison search results, and trick users into installing malware. Huntress examines campaigns targeting AI users through weaponized Claude Artifacts, shared AI conversations, sponsored search results, and ClickFix-style lures. [...
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
This is the second data breach affecting a company that hardware crypto wallet maker Trezor relies on.