> TODAY'S SUMMARY (41 articles)
Today's cyber news highlights significant threats, particularly targeting industrial refrigeration systems. The FBI and CISA have issued warnings about attacks that can manipulate temperatures in supermarket refrigeration, posing risks to food safety and supply chains. In the realm of vulnerabilities, a memory safety flaw in CPython could allow AI inference servers to be compromised. Additionally, a critical exploit in OpenSSH may enable unauthorized access to password-disabled accounts on certain Linux systems. Meanwhile, phishing schemes leveraging fake OpenAI events are being reported, aimed at stealing Microsoft and Google accounts. The ongoing escalation of AI-driven attacks is also notable, with incidents targeting fintech firms during off-hours.
|
// AI-powered summary generated at 12:00
The company provides a standard for AI systems, testing them against risks such as jailbreaks, prompt injections, and unauthorized actions.
The post AIUC Raises $40 Million to Certify Enterprise AI Agents appeared first on SecurityWeek.
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.
Before the repository spread, the assistant recommended software that the attacker had poisoned, and the rec...
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week.
The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is...
Delivering her annual State of the Union address in Strasbourg, Ursula von der Leyen said threats were âmounting on our soil,â pointing to recent incidents in Denmark, Lithuania and Poland and an attempted drone attack in Leipzig.
Google announced patches for the exploited privilege escalation vulnerability (CVE-2026-58704) on September 15.
The post Pixel Modem Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek.
A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers. The Revolut data exposure may be part of a much broader cyber incident involving compromised Italian government infr...
Ukraineâs parliament has approved tougher criminal penalties for involvement in fraudulent call centers and the theft of personal data, following a corruption scandal in which prosecutors were accused of taking bribes to protect scam operations.
A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed âParaShells,â can allow any local user on a Mac to gain root privileges on the host system. ParaShells PoC in action (Source: JFrog) The danger is highest on developer laptops, where a single poisoned Homebrew...
OpenSSH could be made to overwrite files as the administrator.
Several security issues were fixed in AOM.
Microsoft says it's still investigating a known issue that causes the Copilot and Copilot Chat buttons in Classic Outlook to disappear for some Windows users. [...]
The first hours after discovering a Google Workspace breach can determine how an incident unfolds. This webinar examines real-world breaches to show which early response decisions can limit the impact and which can make matters worse. [...]
US, UK, and Dutch government agencies published a report detailing the malware, and the FBI described the abuse of Telegram for C&C.
The post US, UK, Dutch Agencies Expose Iranian âChosen Brickâ Surveillance Malware appeared first on SecurityWeek.
N0va is targeting organizations across North America and Europe with phishing campaigns that impersonate trusted services and abuse legitimate authentication flows. Successful attacks can give threat actors access to valid accounts without relying on obvious malware activity.
From there, a single c...
Data protection chiefs call for 'immediate review' of data protection models
It was discovered that GNU Guix incorrectly made build outputs accessible
to local users before their file metadata was finalized. A local attacker
could possibly use this issue to gain elevated privileges.
Vulnerabilities in The Events Calendar can provide attackers with remote code execution capabilities.
The post Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover appeared first on SecurityWeek.
European Commission President Ursula von der Leyen wants frontier AI development slowed, and said on Wednesday that she will invite the leading AI labs to discuss how the EU can support their own efforts to do that. In her State of the Union address to the European Parliament in Strasbourg, she also...
New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
A leaked credential shows up in a criminal marketplace, or a vulnerability gets a disclosure advisory, and either one can be weaponized against a real target before most security teams have triaged the alert. Attackers are combining that kind of intelligence with AI-assisted exploitation to accelera...