> TODAY'S SUMMARY (18 articles)
Today's cybersecurity news highlights various significant threats and trends:
1. **AI-Generated Code Concerns**: Proton's CEO downplays security testing for AI-written code, raising concerns about potential vulnerabilities in software development.
2. **Data Breach at DHS**: A hacker leaked personal data of over 40,000 Department of Homeland Security employees, underscoring the ongoing risks of data breaches in government sectors.
3. **Fake IT Scams**: Attackers impersonating IT support managed to manipulate employees into granting remote access, revealing the effectiveness of social engineering tactics.
4. **Cryptocurrency Exchange Breach**: Binance experienced a significant security incident affecting $6.3 billion in assets, highlighting vulnerabilities in cryptocurrency platforms amid increasing cyber threats.
5. **Scammers Adapt Quickly**: Fraudulent online shopping sites are being rapidly re-established after takedowns, indicating persistent challenges in combating e-commerce scams.
6. **IoT Device Risks**: A recent report identifies smart TVs as major targets for cyber vulnerabilities, emphasizing the need for security measures in household IoT devices.
|
// AI-powered summary generated at 08:00
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
This is the second data breach affecting a company that hardware crypto wallet maker Trezor relies on.
KnowBe4 researchers observed a new phishing campaign leveraging Microsoft 365’s Direct Send to send malicious emails
Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention.
Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.
The post Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack appeared first on SecurityWeek.
Anthropic detected and disrupted a Russia-linked cyber-espionage group that used its AI tool Claude in a hacking campaign targeting more than 20 government, intelligence, diplomatic and defense organizations.
Swapping legal work for malware development ended in extradition and a guilty plea
The Gigabud banking Trojan can clone a banking app into a separate work profile on an Android device to help hide fraudulent transactions.
A Ukrainian national was sentenced to four years in a U.S. prison for his role in the notorious Conti ransomware operation, which targeted more than 1,000 victims worldwide before shutting down in 2022.
Manufacturers must now disclose actively exploited flaws and severe security incidents through ENISA's new reporting platform
Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining which of those vulnerabilities actually create a path to compromise.
A critical vulnerability may look alarming on a scanner report, but if it...
Oleksii Oleksiyovych Lytvynenko has been sentenced to 4 years in prison after he was arrested in Ireland in 2023.
The post Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison appeared first on SecurityWeek.
GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]
Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution.
The post Check Point Patches Critical VPN Vulnerabilities appeared first on SecurityWeek.
In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago.
Great fun.
Financials have not been disclosed, but the estimated cost is in the tens of millions of dollars.
The post Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance appeared first on SecurityWeek.
Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329Â Wiz Research identified active exploitation of three JFrog Artifactory vulnerabilities that attackers are chaining to bypass authentication and gain full administrative control of self-hosted r...
The once stable era of IT service management (ITSM) has entered a period of disruption and uncertainty. At least if you’re an investor or enterprise customer with an interest in ITSM giant ServiceNow, the signals over recent months have been hard to ignore.
Last year, the c...
Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware. Cisco Talos says three separate threat groups are exploiting two recently patched Secure Firewall Management Center (FMC) flaws. The main target is CVE-2026-20079, a critical au...