> TODAY'S SUMMARY (7 articles)
Today's cybersecurity news highlights several key trends and threats. Microsoft has made Windows Subsystem for Linux (WSL) containers generally available, allowing administrators to manage their use effectively. A Cisco survey indicates that most organizations require over six months to implement new security controls, with only 8% demonstrating strong defenses against evolving AI threats. Cloudflare is set to introduce post-quantum website certificates by early 2027, signaling a move towards enhancing encryption standards in anticipation of quantum computing risks. Additionally, a critical vulnerability has been identified in the Perl DBI module on Ubuntu 26.04 LTS, which could allow for denial of service or code execution attacks. Lastly, discussions around AI regulation are ongoing, with tech firms agreeing to self-police development practices.
|
// AI-powered summary generated at 04:00
Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA). [...]
Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service starting September 2026. [...]
Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface (UEFI) applications that could be abused to bypass Secure Boot on most systems using the modern firmware standard.
"An attacker exploiting one of these vulnerable applications can execute untru...
Researcher confirms the uploads have stopped, but says xAI's privacy command was not what fixed them
A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not to hijack AI agents, but to defend against th...
Human did 10% of the job,
AI did 90%
It was discovered that alsa-lib incorrectly handled certain ALSA
configuration text. An attacker could use this issue to cause alsa-lib to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Frame est un outil open source qui offre une interface graphique à FFmpeg pour convertir vidéos et audios sans ligne de commande, sur Windows, Linux et macOS.
Le post Frame : une interface graphique open source et moderne pour FFmpeg a été publié sur IT-Connect.
Researchers at Jamf Threat Labs detail CrashStealer, which steals passwords, cryptocurrency wallets and more
It was discovered that httplib2 performed unbounded decompression of HTTP
response bodies when the server used gzip or deflate Content-Encoding. A
remote attacker could possibly use this issue to cause httplib2 to use
excessive resources, leading to a denial of service.
Researchers at KU Leuven tested 85 of the most popular crypto wallets that run as browser extensions and found that the wallets themselves leak enough to link and track the people using them.
The way these wallets talk to websites and blockchain servers can tie a person's separate addresses togethe...
It was discovered that MariaDB did not properly validate parameters
supplied by a joiner node during a State Snapshot Transfer using the
mariabackup method. An attacker could possibly use this issue to execute
arbitrary shell commands on the donor node. (CVE-2026-44168)
It was discovered that Maria...
SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter. [...]
AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and help teams move faster. But most still rely on fragmented risk signals: scanner output, severity scores, threat intelligence, configuration findings, and e...
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry.
The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments, without ever gene...
The flaws could allow attackers to access and modify data, and cause system unavailability and request-response desynchronization.
The post SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud appeared first on SecurityWeek.
Cybercriminals are combining social engineering through apps like FaceTime with unpatched devices to steal credentials and drain bank accounts.
Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
FIFA’s network was vulnerable to anyone with even minimal access.
Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks.
The post US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers appeared first on SecurityWeek.