> TODAY'S SUMMARY (82 articles)
Today's cybersecurity landscape features several critical incidents and emerging threats. Notably, Binance has fallen victim to a record-breaking $6.3 billion hack, attributed to North Korean hackers who compromised a DevOps engineer's laptop. Meanwhile, a malicious version of the Claude Code extension was distributed, potentially exposing 5,000 developers to SSH backdoors. Additionally, Drupal has reported a critical vulnerability in its Commerce Core module being actively exploited, urging immediate patching. California officials are investigating alleged election fraud, raising concerns about federal intrusion in state elections. Lastly, the ongoing PHP2Shell attacks target numerous systems, including Palo Alto firewalls, emphasizing the need for heightened vigilance against evolving cyber threats.
|
// AI-powered summary generated at 16:00
A flaw in DeepSeek Harness, DeepSeek's open-source tool for running AI coding agents on a developer's machine, let a sandboxed agent turn off its own sandbox with a single command.
The tool runs an agent's commands inside an operating-system sandbox, so that an agent working on untrusted files cann...
Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes.
This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing.
A rootkit found on hacked F5 BIG-IP APM devices skips the usual step of writing a web shell to disk, hiding it in memory instead, according to Sophos. F5 BIG-IP APM provides access policy enforcement to secure access to apps, APIs, and data. It’s primarily used by enterprises, financial institutions...
Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (...
AVEVA and Rockwell Automation also released patches for vulnerabilities affecting industrial control system products.
The post ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws appeared first on SecurityWeek.
Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet.
Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own comp...
Six critical vulnerabilities in Neurons for ITSM could enable remote code execution, while Sentry and EPMM received patches for authentication bypass flaws.
The post Ivanti Patches Critical Flaws Across Enterprise Security Products appeared first on SecurityWeek.
Over 36,000 Plex Media servers exposed online remain unpatched against multiple security vulnerabilities and are vulnerable to attacks. [...]
Zscaler has announced Zscaler Agentic SOC, a new approach to security operations built to proactively reduce exposures, scale human expertise and stop AI-driven attacks at machine speed. Simply layering in AI capabilities onto the existing security stack will not provide the protection needed. Zscal...
Atola Technology introduces Atola Boot Image, a free bootable environment designed for forensic acquisition when removing a drive from the host computer is difficult, risky or impossible.
Microsoft’s September 2026 Patch Tuesday fixes a record 964 vulnerabilities, including two actively exploited zero-days.
Generative AI has moved well beyond the stand-alone chatbot. It now drafts code, searches internal knowledge, reviews contracts, opens support cases and, in some deployments, takes action through connected tools. That broader role changes the security question. A tester is no...
An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks.
The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42.
Attackers are using trusted Microsoft services and blob URLs to generate stealthy phishing pages that leave defenders with no static website to detect or block.
The post New Phishing Attack Creates Malicious Pages Inside the Victim’s Browser appeared first on SecurityWeek.
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default.
The post This Key Will Self-Destruct: An Open Standard for Revocable API Keys appeared first on SecurityWeek.
China-based AI companies are using large-scale knowledge distillation campaigns to copy capabilities from leading U.S. AI models, according to a joint cybersecurity advisory from the CISA, NSA, and FBI. Knowledge distillation is a standard AI training technique that uses outputs from a more capable...
Securin has announced the general availability of the Securin Platform, an AI-native Preemptive Exposure Management platform designed to answer three questions security teams struggle with every day: What can attackers actually exploit? What should we fix first? And did the fix actually work? The pl...
InfoSec News Nuggets – 09/08/2026  Adobe Fixes Critical Magento Zero-Day Exploited to Backdoor Servers Adobe released an emergency out-of-cycle patch for CVE-2026-75650, a maximum-severity zero-day dubbed StyleSmuggler affecting Magento Open Source and Adobe Commerce, after e-commerce security fi...
Apprenez à analyser le journal USN de NTFS pour retrouver les fichiers créés, renommés, déplacés ou supprimés, même s'ils n'existent plus sur le disque.
Le post Forensic Windows – Partie 10 : analyser le journal USN (NTFS) a été publié sur IT-Connect.
The Chrome update includes 230 security fixes, and users are advised to update their browsers as soon as possible.
The post Chrome 153 Patches Seventh Zero-Day of 2026 appeared first on SecurityWeek.