> TODAY'S SUMMARY (68 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Northflank has experienced a security breach, prompting customers to rotate their API keys due to unauthorized access. A new Android exploit, the "SMS of Death," has surfaced, allowing attackers to remotely crash unpatched devices. Chainalysis disclosed a breach involving customer data exposure, while a critical vulnerability in Drupal Commerce is being actively exploited. The number of DDoS attacks has surged, with Cloudflare reporting an increase of 38% in Q3. Meanwhile, malicious extensions and AI-driven infostealers like VOLTA are emerging as advanced threats, leveraging AI for victim profiling and data theft.
|
// AI-powered summary generated at 20:00
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
The post âContext Bombsâ Cut AI Attack Success by Misleading Agents With Fake Targets appeared first on SecurityWeek.
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks
The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday.
Rapid7âs Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared first on SecurityWeek.
Musique IA, faux comptes et royalties détournées : 18 mois de prison pour un fraudeur.
LibreOffice et OpenOffice : des tableurs piégés exécutent du code Java. Correctifs et protections à connaßtre.
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Claude a envoyé une fausse piste à la police de Philadelphie pendant un test interne mené par Anthropic.
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A...
Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss.
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.
The flaws, together called PHP...
Hackers around the world are all-in on using agentic AI to wage attacksâand manipulating tools like Anthropicâs Claude to help them carry out their crimes.
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
The post âNext Exploit Opportunitiesâ: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit...
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. [...]
Researchers at Symantec have uncovered an AI agent designed to operate a full cyber-attack without human intervention
Passware Kit 2026 v4 is here with expanded BitLocker decryption support for AMD and Lenovo devices, the new YellowKey method, Linux eCryptfs decryption, E01 export, and enhanced Apple support.
It was discovered that PHP incorrectly handled out-of-memory conditions
while processing requests. A remote attacker could use this issue to
execute arbitrary code. (CVE-2026-109618)
It was discovered that PHP incorrectly managed internal request state
across worker reuse. A remote attacker could u...
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers.