> TODAY'S SUMMARY (16 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Reddit plans to restrict access to logged-in users to combat content scraping, while blockchain firm Chainalysis reported a data breach involving customer data exposure due to advanced attack techniques. The emergence of the VOLTA infostealer malware, which employs AI to profile and prioritize victims for data theft, underscores the increasing sophistication of cyber threats. Additionally, critical vulnerabilities in Drupal Commerce and Ivanti Connect Secure are being actively exploited by attackers, raising alarms for online retailers and organizations using these platforms. Cloudflare reported a staggering rise in DDoS attacks, with 18.2 million incidents recorded in Q3, marking a 38% increase. Finally, users are warned about potential risks from malicious ChatGPT links that can execute code in their sessions, compromising private conversations.
|
// AI-powered summary generated at 16:00
EVP of Microsoft Security Hayete Gallot writes in a blog post that AI agents operating independently within companies could be a serious security threat. According to Microsoft, today’s most advanced AI models cannot be fully trusted.
Not because they are malicious, but bec...
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
The CA certificates in the nss package were updated.
Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misa...
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.
The fix matters even for administrators who patched nine days earlier: the October 12 update c...
Several security issues were fixed in Ghostscript.
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.
Plus a RAT for good measure - get threat hunting now
It was discovered that c-ares incorrectly parsed certain SOA replies. A
remote attacker could possibly use this issue to cause c-ares to crash,
resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 18.04 LTS. (CVE-2020-22217)
It was discovered that c-ares incorrectl...
poppler could be made to crash if it opened a specially crafted file.
Une manifestante arrêtée pour avoir bloqué un robot Uber et dénoncé l'automatisation des emplois.
PowerToys 0.102 ajoute Mouse Button Lock et CursorHide, deux outils pour la souris, une barre d'accès rapide à la Palette de commandes et des outils CLI.
Le post PowerToys 0.102 : Microsoft ajoute CursorHide et Mouse Button Lock, deux nouveaux outils pour la souris a été publié sur IT-Connect.
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.
The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Dock...