> TODAY'S SUMMARY (4 articles)
Today’s cybersecurity landscape highlights several critical threats. Researchers from Param have identified a vulnerability in ChatGPT where a malicious share link can execute code in a user's session, potentially exposing private chats. Meanwhile, Cloudflare reported a staggering 18.2 million network-layer DDoS attacks in Q3, an increase of 38%, averaging over 8,200 attacks per hour. Additionally, Microsoft has issued warnings regarding a malicious extension mimicking Claude Code, which establishes a persistent SSH backdoor for attackers. Organizations need to be vigilant in improving their defenses against these escalating threats.
|
// AI-powered summary generated at 08:00
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services.
"You may choose to allow certain Google services, i...
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and gam...
Cyberattaque chez Point Vision : données de patients volées, exposition possible des motifs de rendez-vous.
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.
The updater belongs to Time4Popcorn, an abandoned copy o...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)Â added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.
The critical-...
Pulse est un outil gratuit et open source qui traduit les journaux d'événements de Windows 10 et 11 en langage clair, avec une IA locale (Ollama, LM Studio).
Le post Pulse : les journaux d’événements de Windows facilement lisibles, avec de l’IA locale a été publié sur IT-Connect.
Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. A use-after-free and double-free affe...
It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulner...
If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yo...
A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could result in denial of service, or potentially the execution of arbitrary code. For the stable distribution (trixie), this problem has been fixed in version 1.1.0-2+deb13u1.
This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
Bad things (and software bugs?) come in threes
Monitoring was only partial and was easily bypassed
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a...
Naive byte-range caching can waste gigabytes of origin bandwidth on small requests. We rebuilt our cache architecture in Pingora to coordinate partial fetches automatically, cutting R2 p99 latency in half.
Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws...