> TODAY'S SUMMARY (16 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Reddit plans to restrict access to logged-in users to combat content scraping, while blockchain firm Chainalysis reported a data breach involving customer data exposure due to advanced attack techniques. The emergence of the VOLTA infostealer malware, which employs AI to profile and prioritize victims for data theft, underscores the increasing sophistication of cyber threats. Additionally, critical vulnerabilities in Drupal Commerce and Ivanti Connect Secure are being actively exploited by attackers, raising alarms for online retailers and organizations using these platforms. Cloudflare reported a staggering rise in DDoS attacks, with 18.2 million incidents recorded in Q3, marking a 38% increase. Finally, users are warned about potential risks from malicious ChatGPT links that can execute code in their sessions, compromising private conversations.
|
// AI-powered summary generated at 16:00
L'université de Teramo a été sanctionnée pour la communication interne et la diffusion publique de données personnelles d'un employé relatives à un contentieux prud'homal, suite à une erreur humaine dans la gestion de l'ordre du jour de son conseil d'administration.Faits et contexteL'autorité italie...
L'Autorité suédoise de protection des données (IMY) a annoncé la préparation d'une nouvelle orientation destinée à encadrer l'utilisation des services d'informatique en nuage par le secteur public.Dans le cadre de l'élaboration de cette orientation, l'autorité a initié une consultation auprès de 19...
Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and A...
Careful what you say after goodbye, or better yet, update your messaging app
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.
The post Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections appeared first on SecurityWeek.
It was discovered that poppler incorrectly handled the password length
limit when decrypting certain encrypted PDF files. An attacker could
possibly use this issue to cause a denial of service.
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek.
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We recommend making sure every site you manage is running a patched version of PHP as soon as possible....
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks.
The AI company said the incident took place on October 3 and 6, 2026, for Sol and As...
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. [...]
Guide Includes Easy, Quick Ways To Identify and Protect Against Online Threats SAN FRANCISCO – The Electronic Frontier Foundation (EFF) has published “Online Privacy for Parents and Youth,” a new guide to help families protect themselves online.Â
"Parents don’t need to be technology experts to help...
Websites are temporarily going offline as admins address two critical PHP flaws that could let attackers run malicious code on their servers.
Several security issues were fixed in U-Boot.
Two critical vulnerabilities in PHP allow remote code execution on the server without authentication. We explain who’s at risk, and how to update.
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the
corresponding fix for U-Boot on Ubuntu 26.10.
Original advisory details:
Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot
incorrectly handled certain NFS READ and NFS READLINK responses. An
attacker could poss...
PHP 8.5.12, 8.4.27, 8.3.36 et 8.2.35 corrigent PHP2Shell, deux failles RCE exploitables sans authentification. À traiter en urgence pour protéger votre serveur.
Le post PHP2Shell : les correctifs de sécurité sont là , les attaques aussi ! a été publié sur IT-Connect.
The Perl XS::Parse::Keyword module could be made to crash if it received specially crafted input.
Several security issues were fixed in PyJWT.
Rick de Jager discovered that Ghostscript incorrectly handled memory
under certain circumstances when processing PostScript documents. If a
user or automated system were tricked into processing a specially crafted
document, an attacker could possibly use this issue to bypass the sandbox
and execute...