> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights significant threats, including a major breach at French Bank Crédit Mutuel Arkéa, where attackers exploited vulnerabilities in a third-party service provider to steal up to $133 million. This incident underscores the ongoing risk associated with third-party integrations. Additionally, refrigeration cyberattacks continue to target European retailers, raising concerns about supply chain security. As organizations face these evolving threats, proactive measures and timely patching, especially in light of upcoming Patch Tuesday, are crucial for mitigating risks. Overall, the focus remains on enhancing security protocols to safeguard against sophisticated cyber threats.
|
// AI-powered summary generated at 12:00
Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a zero-day vulnerability in the Metabase business intelligence service. According to the notification sent to affected Framework customers, the at...
A seller claims to offer Israel’s 2026 population registry, but checks show the 9.2 million records are authentic data dating back to 2005. A vendor on a well-known leak forum claims to have breached Israel’s Population and Immigration Authority and is selling the entire national registry, 9.2 milli...
Crims talked their way onto three employee PCs before trousering corporate data
Pub chain says turn off the cameras, reminds punters not to blare sound from phone vids either
Microsoft is changing how Entra ID handles MFA for people who sign in with Windows Hello for Business (WHfB) or macOS Platform Single Sign-On (PSSO). The rollout reaches worldwide and GCC tenants starting early October 2026, with completion expected by late November. Microsoft says the change “helps...
North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence (AI) offline on its own servers, connecting document-search tools to files in its possession, and collecting the software parts...
A China-linked threat actor is believed to be exploiting a critical vulnerability affecting cybersecurity software from the company N-able.
Cloudflare for Government achieves FedRAMP Class D (High) Certified status. We also announce our commitment to pursue DoD IL4 authorization. Cloudflare brings world-class security, performance, and developer products to the public sector.
An AI agent executes instructions that an attacker has planted in the log or alert that records a blocked request word for word.
The post ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad appeared first on SecurityWeek.
A member of "The Com," a loose-knit online cybercrime collective that targets children and teenagers, has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. [...]
Microsoft is retiring Manifest V2, the technology behind older Edge extensions. Some popular privacy tools will lose features or stop working.
New Zealand announced new sanctions on Russian hackers, technology companies and Kremlin-linked organizations over their roles in supporting Moscow’s war against Ukraine.
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on.
Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abus...
No, no nasties to see here, guv...
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline as part of its response to unusual activity on servers hosted and managed by an unnamed third-party vendor. [...]
OpenAI said its upcoming model Astra is showing cybersecurity capabilities that could reach its highest risk category, where a system can autonomously find and exploit vulnerabilities or carry out end-to-end cyberattacks against hardened targets.
The company disclosed the a...
Atlassian’s enterprise AI assistant Rovo, which is usually connected across sensitive work environments like Slack, Microsoft 365, and Google Workspace, was found vulnerable to data leaks through malicious instructions.
At DEF CON 34, researchers from Varonis demonstrated a...
AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize fixes, and control risk at human speed.
When software output jumps 10 to 50 times, the problem is no longer just finding vulnerabilities. It is...
Multiple vulnerabilities in the Icinga 2 monitoring system could lead to denial of service, information disclosure, privilege escalation, or the compromise of a monitoring node, requiring urgent upgrades.
Video game publisher and digital distribution giant Valve is notifying Steam hardware customers in Europe that hackers stole their data after hacking its shipping partner, CEVA Logistics. [...]