> TODAY'S SUMMARY (68 articles)
Today's cybersecurity landscape highlights several significant threats and trends. Northflank has experienced a security breach, prompting customers to rotate their API keys due to unauthorized access. A new Android exploit, the "SMS of Death," has surfaced, allowing attackers to remotely crash unpatched devices. Chainalysis disclosed a breach involving customer data exposure, while a critical vulnerability in Drupal Commerce is being actively exploited. The number of DDoS attacks has surged, with Cloudflare reporting an increase of 38% in Q3. Meanwhile, malicious extensions and AI-driven infostealers like VOLTA are emerging as advanced threats, leveraging AI for victim profiling and data theft.
|
// AI-powered summary generated at 20:00
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et un déni de service.
Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC). Pour les versions de PHP 5.x, 6.x, 7.x, 8.0.x et 8.1.x , dont l'éditeur n'assure...
Meishi-KY (Meishi Daren Co., Ltd.) a annoncé que certains de ses systèmes d'information ont été victimes d'une cyberattaque. La société a immédiatement activé son mécanisme de réponse aux incidents de sécurité et fait appel à des experts externes pour l'enquête et la réparation. Selon l'évaluation p...
Robert Wayne Boling Jr. was the mastermind of an identity theft conspiracy that victimized thousands of military members and veterans. He faces up to 40 years in prison.
The post Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers appeared first on...
Massive clean-up job under way because this mess makes it possible to impersonate any website or service
The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. PHP is the programming language WordPress is bui...
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.
IQ.Lvbs implies that rival Comma.ai isn't playing fair
In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violat...
Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based virtua...
USN-8944-1 updated ca-certificates. This update provides the corresponding
changes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS by removing the "emSign ECC Root CA - G3" and "Comodo AAA
Services root" CA certificates.
Original advisory details:
This update remove...
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. For the stable distribution (trixie), this problem has been fixed in
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
One of eMudhra's certificate authority private keys is the number 4.Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from
Chukwuemeka Victor Amachukwu hacked tax preparation businesses, filed false tax returns and enticed victims to send him money for investment schemes.
The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop.
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
XZ Utils could be made to crash or run programs if it processed specially crafted compressed files under certain conditions.