> TODAY'S SUMMARY (97 articles)
Today's cybersecurity landscape reveals a range of significant threats and vulnerabilities. Companies are facing substantial losses, with token thefts related to illicit LLM charges costing over $100,000 daily. CISA has identified two critical vulnerabilities in Ivanti Connect Secure, urging immediate remediation. Google has disrupted the XCPE botnet, which was exploiting Android TV firmware. Meanwhile, a new AI-powered infostealer has emerged, effectively ranking stolen data by potential financial value. European supermarkets are grappling with a second wave of cyberattacks on their refrigeration systems, leading to widespread food spoilage. Additionally, the FBI has attributed the recent $6.3 billion Binance cryptocurrency heist to North Korean hackers, intensifying concerns over crypto security.
|
// AI-powered summary generated at 16:00
The Combating Organized Retail Crime Act has won a big House vote and could be on the fast track in the Senate — and supporters say it could help fight cybercrime.
The post Retail theft bill spurs ‘very large and very dangerous’ surveillance fears appeared first on CyberScoop.
Exploitation of the Zimbra Collaboration vulnerability CVE-2026-73570 has been observed by Poland’s CERT Polska.
The post Hackers Target Zimbra Servers in Active Exploitation Campaign appeared first on SecurityWeek.
OpenAI has strengthened ChatGPT's protections for teens, but some of its strongest parental controls still depend on linked accounts.
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. [...]
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page.
The AI secu...
Multiple security vulnerabilities in libgit2 could lead to arbitrary command execution, credential disclosure, denial of service, or unauthorized directory creation. Users are advised to upgrade to version 1.9.0+ds-2+deb13u1.
Practical digital minimalism tips to reduce screen time on iPhone and Android, plus a guide for kids and how to protect data from Big Tech.
We all know they’re watching us. But we don’t know who they are, nor why nor how they are doing it.
The post Surveillance – Everything You Wanted to Know, But Were Afraid to Ask appeared first on SecurityWeek.
Two Artifactory flaws allowed attackers to poison package metadata across software repositories
Because apparently even ransomware gangs can't trust the people they do business with
Après l'arrêt d'une offre Microsoft 365 gratuite pour les associations, des milliers d'espaces OneDrive ont été effacés des tenants Microsoft. À qui la faute ?
Le post Microsoft 365 : environ 171 000 associations auraient perdu leurs données OneDrive a été publié sur IT-Connect.
AI is making phishing attacks more personalized, convincing, and difficult for traditional email filters to detect. Kaseya explains how MSPs can monitor identity, email, and endpoint activity to detect and contain attacks that make it past the inbox. [...]
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including execu...
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
It was discovered that Netty did not properly handle malformed HTTP/2
control frames. An attacker could use this to cause a denial of service
via resource exhaustion. This issue only affects Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-55163)
It was discover...
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.