> TODAY'S SUMMARY (10 articles)
Key cybersecurity updates today include the sentencing of Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad cyberattacks, highlighting ongoing threats from state-sponsored hacking. A critical vulnerability in Drupal Commerce Core is being actively exploited, urging affected online stores to patch immediately. In another alarming trend, researchers have identified a malicious ChatGPT link that can execute code in users' sessions, potentially compromising private conversations. Additionally, Cloudflare reported a significant increase in DDoS attacks, with 18.2 million recorded in Q3, reflecting a 38% rise. On the software front, major releases of Wireshark and YARA-X have been announced, addressing various bug fixes and improvements.
|
// AI-powered summary generated at 12:00
Depuis le 1er octobre, EWS est bloqué sur Exchange Online. Voici comment le réactiver, via le centre d'admin ou PowerShell, jusqu'en avril 2027.
Le post Exchange Online : vos applications EWS ne fonctionnent plus ? Voici comment les débloquer a été publié sur IT-Connect.
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that hand...
FFTir : la Fédération confirme une cyberattaque, le vol de 64 000 photos et de milliers de documents personnels.
Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record.
Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate autho...
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
Alerte ZATAZ : deux faux mails bancaires, des milliers d'euros en jeu et une fraude téléphonique décryptée.
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.
A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.
The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separa...
Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm
Discover whatâs new on Forensic Focus: explore WMI permanent event subscription persistence with Vitalii, see how MD-RED v4 handles AI-powered mobile forensic analysis, hear how user feedback shapes new features in Amped FIVE, and more.
Players who signed up for Capcomâs online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the companyâs web s...
When Anthropic introduced Claude Mythos Preview, the cybersecurity debate quickly turned to what AI could do: uncover decades-old vulnerabilities, develop working exploits and accelerate tasks that once required specialist expertise. Anthropic noted that Mythos discovered soft...
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.
The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The ri...
The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts.
The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.
The businesspeople adopting AI notetakers are not being reckless. They are responding to a real business need. Our teams are in meetings all day with companies we support, and the idea that we could read a clean summary of every one of them at the end of the day makes us bette...