> TODAY'S SUMMARY (114 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A red-team report revealed OpenAI's insufficient monitoring during a Hugging Face attack, raising concerns about AI oversight. Microsoft Teams is set to introduce AI-powered phishing detection, enhancing security within its platform. The sophisticated BlackX UEFI bootkit has been identified, specifically targeting diplomatic organizations in Central Asia, demonstrating the increasing sophistication of supply chain attacks. Additionally, the PHP community is grappling with multiple critical remote code execution vulnerabilities, with emergency patches being issued for PHP2Shell as exploitation attempts surge. Meanwhile, Capcom confirmed a data breach affecting 11.7 million accounts, emphasizing the ongoing risks to personal data across industries.
|
// AI-powered summary generated at 20:00
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Learn how to create a security incident log that supports GDPR records, ICO decisions, insurance claims, and credential access reviews.
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository.
OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these comp...
What is vendor risk management? Learn how to assess third-party vendor risk, tier suppliers, and control access, and get our checklist.
What do cyber insurance underwriters check? See which controls you need, the evidence to prepare, and get our cyber insurance checklist.
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.
The post Prolific Chinese espionage group exploits BeyondTrust zero-day appeared first on CyberScoop.
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and ru...
PwnEscape (CVE-2026-99999), faille critique du noyau Linux, fait fuir la mémoire de l'hôte depuis une VM, jusqu'à l'évasion. Voici comment se protéger.
Le post PwnEscape : une faille Linux permet de s’évader d’une VM KVM a été publié sur IT-Connect.
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google accou...
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls.
The post Managing open-weight model risk in enterprise deployments appeared first on Microsoft Security Blog.
Les inscriptions pour l'événement Cloud & Cyber Security Expo Paris 2026 sont désormais ouvertes. Obtenez votre badge gratuitement pour y participer.
Le post Cloud & Cyber Security Expo Paris 2026 : les inscriptions sont ouvertes a été publié sur IT-Connect.
CVE-2026-93953 : une injection SQL dans Backuply, présent sur 600 000 sites WordPress, permet à un simple abonné de devenir administrateur. Mettez à jour.
Le post Backuply : une faille SQL menace 600 000 WordPress, surtout si vous restaurez votre site web a été publié sur IT-Connect.
Legacy protocol is going to be axed, and enforcement by default will highlight how migration is going
A chain of vulnerabilities in Google’s Chrome browser could have enabled researchers to take control of one billion Windows machines worldwide — and it cost them just $40,000 in AI compute time to discover it.
Researchers at Xbow USA worked for six days on developing the ex...
The outage has stopped official bankruptcy notices nationwide since Oct. 9, with no cause or restoration date announced.
The post Cybersecurity incident at BAE Systems disrupts US bankruptcy court system appeared first on CyberScoop.
Cybersecurity giant Proofpoint says it will acquire Miami-based data visibility and security company Varonis in an all-cash transaction worth $6.3 billion.
A researcher found serious flaws in Eiliko’s security, exposing private conversations and allowing remote changes to what the robot says.
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.
The post In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit appeared first on SecurityWeek...
Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October. Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King J...