> TODAY'S SUMMARY (82 articles)
Today's cybersecurity landscape features several critical incidents and emerging threats. Notably, Binance has fallen victim to a record-breaking $6.3 billion hack, attributed to North Korean hackers who compromised a DevOps engineer's laptop. Meanwhile, a malicious version of the Claude Code extension was distributed, potentially exposing 5,000 developers to SSH backdoors. Additionally, Drupal has reported a critical vulnerability in its Commerce Core module being actively exploited, urging immediate patching. California officials are investigating alleged election fraud, raising concerns about federal intrusion in state elections. Lastly, the ongoing PHP2Shell attacks target numerous systems, including Palo Alto firewalls, emphasizing the need for heightened vigilance against evolving cyber threats.
|
// AI-powered summary generated at 16:00
Cisco Talos is actively tracking the exploitation of two vulnerabilities in Cisco’s Secure Firewall Management Center (FMC) Software.
Attention à BigBear 2.0, un service de phishing AiTM qui a volé 5 137 identifiants Microsoft 365 malgré le MFA. La France est le 2e pays le plus touché.
Le post Phishing Microsoft 365 : BigBear 2.0 a contourné le MFA de 258 entreprises a été publié sur IT-Connect.
A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail.
EFF is pleased to announce that Access Now, 7amleh – The Arab Center for the Advancement of Social Media, DeFlock, and New Media Rights have received 2026 EFF Awards for their vital work in ensuring that technology supports freedom, justice, and innovation for all people.Â
The EFF Awards recognize s...
The first public cybersecurity strategy issued by the FBI "directs our teams, our field offices, our global presence" to align their efforts on countering malicious hackers and cybercrime groups, senior official Brett Leatherman says.
Healthcare technology company Veradigm disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients' personal data. [...]
Brett Leatherman said that industry has the wrong idea about what the FBI does with the data it collects during incidents, which is used to help victims and investigations alike.
The post FBI cyber chief worries private sector not sharing enough cyber threat information appeared first on CyberScoop.
Anthropic researcher Jacob Coxon resigned over AI extinction fears, calling for pacing agreements between labs.
DoppelCart’s fake stores copy real retailers and steal shoppers’ card details and one-time bank confirmation codes.
The hacking tool, built using a combination of AI models, is effective against Android and iOS devices
Smartphone professionnel perdu ou volé : le MDM aide à protéger les données, les accès et la flotte mobile.
The critical, unauthenticated bugs allow attackers to bypass authentication and proxy a user’s browser traffic.
The post Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension appeared first on SecurityWeek.
Gigabud clones banking apps into a work profile to break the link between malware alerts and fraud
Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to tools from model providers like Google, Anthropic, and others.Â
Information stealers like Lumma Stealer or Vidar are equipped to harvest a wide r...
USN-8675-1 fixed vulnerabilities in Perl. This update provides the
corresponding fix for Perl on Ubuntu 26.04 LTS.
Original advisory details:
It was discovered that Perl incorrectly handled short source addresses
in the Socket module. An attacker could possibly use this issue to
trigger an out-...
MFA makes account takeover harder, but attackers are increasingly targeting the recovery processes used to reset passwords and authentication methods. Specops explains why stronger identity verification at the service desk is critical to preventing social engineering attacks from turning account rec...
Après les fuites DGFiP et Éducation nationale, l'ANSSI lance REACTIV et peut imposer des mesures immédiates aux ministères. Voici ce qu'il faut retenir.
Le post REACTIV : l’ANSSI obtient le pouvoir d’imposer des mesures d’urgence aux ministères après les fuites de données a été publié sur IT-Connect...
Akeyless has announced the general availability of Akeyless Agentic Runtime Authority, the real-time identity control layer for AI agent actions. It works on top of Akeyless SecretlessAI, a credential protection layer that keeps credentials out of AI agents and brokers access to enterprise systems....
Google patched 230 Chrome flaws, including an actively exploited V8 bug that could let attackers run arbitrary code through a crafted HTML page. Google released a Chrome update fixing 230 security vulnerabilities, including one already exploited in the wild tracked as CVE-2026-87491 (CVSS score of 8...
ClickFix campaign uses browser-injected JavaScript and Google Sheets to steal cryptocurrency