> TODAY'S SUMMARY (82 articles)
Today's cybersecurity landscape features several critical incidents and emerging threats. Notably, Binance has fallen victim to a record-breaking $6.3 billion hack, attributed to North Korean hackers who compromised a DevOps engineer's laptop. Meanwhile, a malicious version of the Claude Code extension was distributed, potentially exposing 5,000 developers to SSH backdoors. Additionally, Drupal has reported a critical vulnerability in its Commerce Core module being actively exploited, urging immediate patching. California officials are investigating alleged election fraud, raising concerns about federal intrusion in state elections. Lastly, the ongoing PHP2Shell attacks target numerous systems, including Palo Alto firewalls, emphasizing the need for heightened vigilance against evolving cyber threats.
|
// AI-powered summary generated at 16:00
ESET Secure Authentication 4.40.2.0 has been released.
AI scams are now hyper-realistic. But there’s one simple way to see through them.
Quantum computers have advanced significantly in capability and compute power in the last several years and are turning theoretical vulnerabilities in modern cryptography into real-world threats. The shift to post-quantum cryptography (PQC) needs to start now, but several...
Microsoft Teams masquera par défaut les images contenant un code QR envoyées par des expéditeurs externes. Objectif : freiner le quishing dès octobre 2026.
Le post Quishing : Microsoft Teams va masquer les codes QR envoyés par des utilisateurs externes a été publié sur IT-Connect.
PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, dubbed PoisonedRefresh by ESET, they found in compromised F5 BIG-IP Access Policy Manager environme...
An Ohio man was sentenced to 15 years in prison for multiple cybercrimes, including sextortion and cyberstalking of numerous victims using AI-generated sexually explicit content. [...]
Jellyfin 12.0 est disponible : nouvelle numérotation, base de données plus rapide, interface Modern par défaut, FFmpeg 8.1 et correctifs de sécurité.
Le post Jellyfin 12.0 est là : découvrez les nouveautés et ce qu’il faut savoir avant de mettre à jour a été publié sur IT-Connect.
CRPx0 is a cybercrime operation that started off operating a scam before pivoting into a fully-blown ransomware and cryptocurrency business.
Read more in my article on the Fortra blog.
Australia is proposing a law that gives people a choice over what fills their feeds. It may not be long before other countries demand the same.
CISOs already have it tough, but the straw that breaks the back of many IT security executives may be the rapidly advancing capabilities of frontier AI models, enterprise insistence on rapid and widespread AI experimentation, and the compounding risk responsibilities and perso...
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.
cPanel published the ad...
Onapsis urges SAP customers to patch “Overpass” vulnerability, which has a CVSS score of 10.0
KB5124008 et KB5122880 : les mises à jour Windows 11 de septembre 2026 sont là . Barre des tâches déplaçable, bugs d'août corrigés et une zero-day patchée.
Le post Windows 11 KB5124008 : la mise à jour de septembre 2026 améliore la barre des tâches et corrige des bugs a été publié sur IT-Connect.
Exploitée depuis le 4 septembre 2026, la faille StyleSmuggler (CVE-2026-75650) permet de pirater Magento et Adobe Commerce. Un patch est disponible.
Le post Magento : la faille zero-day StyleSmuggler est corrigée, mais des boutiques sont déjà piratées a été publié sur IT-Connect.
The researcher Chaotic Eclipse released ShieldCrash, a PoC exploit for a Microsoft Defender Zero-Day vulnerability. Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Microsoft Defender. The researcher n...
Google has fixed 230 vulnerabilities in Chrome, including a zero-day flaw, CVE-2026-87491, with an in-the-wild exploit. “Google is aware that an exploit for CVE-2026-87491 exists in the wild,” the company said in a Tuesday security advisory. The fix has been shipped in Chrome 153.0.8010.36 and .37 f...
Hors ligne versus hors site : comment composer une stratégie de sauvegarde fiable, conforme ANSSI et adaptée à Proxmox Backup Server ? Voici la réponse.
Le post Proxmox Backup Server : la sauvegarde locale est saine, mais où est la copie hors ligne ? a été publié sur IT-Connect.
Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7.
When Apache loads any of the three appliances' own PHP scripts, the malware adds the web shell to the copy hel...
An anonymous security researcher known as Nightmare Eclipse has released a new Microsoft Defender zero-day exploit named "ShieldCrash" right after Microsoft rolled out its September 2026 Patch Tuesday security updates. [...]
September 2026 Patch Tuesday fixes a record 974 CVEs including 2 exploited zero-days, 20 wormable bugs, and a critical Exchange RCE via Visio email. Microsoft’s September 2026 Patch Tuesday set a new record. Depending on how researchers count external and Chromium bugs, Microsoft fixed between 966 a...