> TODAY'S SUMMARY (41 articles)
Today's cyber news highlights significant threats, particularly targeting industrial refrigeration systems. The FBI and CISA have issued warnings about attacks that can manipulate temperatures in supermarket refrigeration, posing risks to food safety and supply chains. In the realm of vulnerabilities, a memory safety flaw in CPython could allow AI inference servers to be compromised. Additionally, a critical exploit in OpenSSH may enable unauthorized access to password-disabled accounts on certain Linux systems. Meanwhile, phishing schemes leveraging fake OpenAI events are being reported, aimed at stealing Microsoft and Google accounts. The ongoing escalation of AI-driven attacks is also notable, with incidents targeting fintech firms during off-hours.
|
// AI-powered summary generated at 12:00
Proton has partnered with the team behind Apertus, adding their sovereign AI model to its privacy-first AI chatbot Lumo.
A new CVE drops. Your scanner finds it. The severity score looks ugly.
But that still does not answer the question that matters: Can it actually be exploited in your environment?
Mythos-class AI is compressing the time between disclosure and working exploitation, while many security programs still...
Our latest research found that 87% of Canada’s largest companies and 100% of government domains rely on US-owned email infrastructure.
It was discovered that GStreamer Good Plugins did not limit the size of
reassembly buffers when processing fragmented RTP packets. A remote
attacker could possibly use this issue to cause GStreamer Good Plugins to
use excessive resources, leading to a denial of service.
The FBI has seized the domains behind NightmareStresser, a DDoS-for-hire service officials call one of the longest running “booter” operations in existence. The domain seizure notice (Source: US Department of Justice) “Booter services such as those named in this action allegedly facilitate attacks o...
It was discovered that GNU Bison incorrectly handled grammar-defined
configuration variables when generating HTML reports. An attacker could
possibly use this issue to execute arbitrary code.
The DOJ seized domains behind NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks since 2022, as part of Operation PowerOFF. Renting a DDoS attack used to be as easy as renting a movie. Pick a target, pay a few dollars, watch the site go dark. The Justice Department j...
The U.S. Federal Bureau of Investigation (FBI) seized the domains used by NightmareStresser, one of the world's longest-running distributed denial-of-service (DDoS) platforms. [...]
Even a temporary staging server needs to be locked down.
The largest known celebrity deepfake seizure has taken 12 websites offline, disrupting access to videos depicting some 1,200 people.
Cisco urged ISE customers to apply a software update, as well as check for signs of exploitation
Spain Gets Its First Taste of AI-Aided Cyber Attack Spain’s data protection agency, the AEPD, has logged the country’s first personal data breach attributed to an autonomous AI agent, with the agency’s president confirming an individual deployed an agent built on a known large language model to car...
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian.
There are plenty of signs that AI will make all of our experiences of the US midterm elections worse. Voters have anxiety about AI’s impacts on the country. Politicos are using AI deepfakes to spread lies. The Wh...
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what security leaders must demand before pointing one...
A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links.
Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). About CVE-2026-76460 Cisco ISE is an identity-based network access c...
AI appears to be helping scammers with little web development skill build convincing fake antivirus-renewal pages, Malwarebytes found. The researchers came across a scam page impersonating Avast, aimed at users in Belgium, that was more polished than most sites of its kind. The page told visitors th...
Platforms comply just enough to avoid being blocked, leaving the regulator chasing debt
SQLite could be made to crash if it opened a specially crafted file.
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025.
"SparroWocky is a modular, C++ backdoor," ESET security research...