> TODAY'S SUMMARY (16 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Reddit plans to restrict access to logged-in users to combat content scraping, while blockchain firm Chainalysis reported a data breach involving customer data exposure due to advanced attack techniques. The emergence of the VOLTA infostealer malware, which employs AI to profile and prioritize victims for data theft, underscores the increasing sophistication of cyber threats. Additionally, critical vulnerabilities in Drupal Commerce and Ivanti Connect Secure are being actively exploited by attackers, raising alarms for online retailers and organizations using these platforms. Cloudflare reported a staggering rise in DDoS attacks, with 18.2 million incidents recorded in Q3, marking a 38% increase. Finally, users are warned about potential risks from malicious ChatGPT links that can execute code in their sessions, compromising private conversations.
|
// AI-powered summary generated at 16:00
Quest Diagnostics a signalé un accès non autorisé à son système Quanum-LSM, utilisé pour les commandes de tests et la consultation des résultats. Cette cyberattaque a entraîné l'atteinte de dossiers de patients.
AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed.
On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying...
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out.
Meanwhile, malicious ads are targeting journalists with zero-click attacks.
Plus, Origin’s Spencer Thom...
Several security issues were fixed in libsoup.
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated doesn’t mean it’s impossible. We’ve launched our Online Privacy for Par...
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
New php packages are available for Slackware 15.0 and -current to fix security issues.
An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasing share of this work, giving them a greater ability to stifle challeng...
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While...
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connecti...
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]
The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions, and met with the agency to emphasize crucial guardrails that the enfo...
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.
The post Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group appeared first on CyberSc...
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the
corresponding updates for libsoup3 on Ubuntu 26.10.
Original advisory details:
It was discovered that libsoup incorrectly handled certain HTTP/2
requests.
A remote attacker could possibly use this issue to cause a denial of...
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countri...
Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code e...
Several vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. For the stable distribution (trixie), these problems have been fixed in version 1:9.20.30-1~deb13u1.
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.
PHP has released the following fixed versions:
PH...
Several security issues were fixed in c-ares.