> TODAY'S SUMMARY (16 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Reddit plans to restrict access to logged-in users to combat content scraping, while blockchain firm Chainalysis reported a data breach involving customer data exposure due to advanced attack techniques. The emergence of the VOLTA infostealer malware, which employs AI to profile and prioritize victims for data theft, underscores the increasing sophistication of cyber threats. Additionally, critical vulnerabilities in Drupal Commerce and Ivanti Connect Secure are being actively exploited by attackers, raising alarms for online retailers and organizations using these platforms. Cloudflare reported a staggering rise in DDoS attacks, with 18.2 million incidents recorded in Q3, marking a 38% increase. Finally, users are warned about potential risks from malicious ChatGPT links that can execute code in their sessions, compromising private conversations.
|
// AI-powered summary generated at 16:00
July’s intrusions reached water controllers that sat on a cellular link no city network scan would find. Naming an owner and paying for the fix are decisions a utility can make this fiscal year, out of money it already applies for.
The post In most cities, nobody owns the whole network appeared firs...
Attackers are exploiting critical RouterOS flaws to take control of routers with SSH exposed to the internet.
CloudSEK has uncovered BigBear 2.0, a new phishing-as-a-service operation targeting Microsoft 365
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.
The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which d...
North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally. North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software r...
Crypto wallet-maker Trezor says a data breach at supplier ShipMonk is far worse than originally thought
Cross-government plan combines civil ambitions with an increasingly military view of orbit
A malicious dataset exploits code-execution paths in a remote-code dataset loader and a dataset configuration before compromising access credentials to move laterally through the target network. A frontier AI model publishes a malicious Python package to a public PyPI registry...
Mathspace has confirmed that attackers broke into its internal reporting system through an unpatched Metabase vulnerability and stole data belonging to more than a million students, parents, and school staff. The Sydney-based maths education company wrote in a blog post that the vulnerability, in it...
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams.
The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the I...
Jellyfin shipped version 12.0 of its media server. Several of the security fixes in it block requests built to reach files outside the folders the server is supposed to hand out. The rest of the security work touches first-run setup, plugin installs, parental controls, and the web interface. On a mi...
Enterprises increasingly give AI agents the credentials, tools, and network access of privileged employees, but security experts warn that existing security controls designed to govern human access are insufficient. An AI agent operates at inhuman speed, can chain allowed action...
Attackers bypass endpoint security by posing as IT staff, stealing Microsoft 365 sessions, draining SaaS data and demanding extortion. Forget installing malware because today’s extortionists just pick up the phone instead of writing code. A widespread threat cluster tracked as PREY-0058 bypasses end...
Exclusive: An exposed Advance Passenger Information System (APIS) database held 220 million passenger and crew records containing names, passport numbers, dates of birth, nationalities, and flight details spanning 2017 to 2026. Researchers accessed the Vietnam-linked system through a cloud-based pat...
Cette faille dans Proxmox VE a été corrigée il y a 3 ans, et pourtant, elle est activement exploitée par les cybercriminels. Méfiez-vous de la CVE-2023-54391.
Le post Cette faille Proxmox corrigée en 2023 est activement exploitée (CVE-2023-54391) a été publié sur IT-Connect.
Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: A...
Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties.
Grindr, which is the largest LGBTQ+ dating app, was sued in April 2024, accusing it of v...
CVSSv3 Score:
7.3
An improper certificate validation vulnerability [CWE-295] in FortiOS and FortiProxy Agentless ZTNA portal may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the ZTNA portal and the backend destinati...
CVSSv3 Score:
4.7
An improper access control vulnerability [CWE-284] in FortiManager may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests.
Revised on 2026-09-08 00:00:00
Asahi Linux prend en charge les Mac M3, M3 Pro et M3 Max. Webcam, Wi-Fi, USB et décodage AV1 fonctionnent, mais pas le GPU et la mise en veille.
Le post Apple : Asahi Linux prend officiellement en charge les Mac M3, mais pas encore le GPU a été publié sur IT-Connect.