> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights significant threats, including a major breach at French Bank Crédit Mutuel Arkéa, where attackers exploited vulnerabilities in a third-party service provider to steal up to $133 million. This incident underscores the ongoing risk associated with third-party integrations. Additionally, refrigeration cyberattacks continue to target European retailers, raising concerns about supply chain security. As organizations face these evolving threats, proactive measures and timely patching, especially in light of upcoming Patch Tuesday, are crucial for mitigating risks. Overall, the focus remains on enhancing security protocols to safeguard against sophisticated cyber threats.
|
// AI-powered summary generated at 12:00
Researchers linked the latest malicious activity to a Chinese company, after one of the spyware's operators placed an order with KFC using their real name and office address.
A scan of internet-connected industrial equipment found 4,400 exposed PLCs, including 22 in cities recently targeted by water system attacks.
The post Despite federal warnings, thousands of U.S. industrial controllers used in water systems remain exposed online appeared first on CyberScoop.
Left alone, autonomous fixes often fail to fully remediate flaws
Oracle Linux has released RPM updates for version 10, resolving CVE-2026-55827 by adding codecID checks and fixing boundary checks in gdi_Bitmap_Decompress.
Oracle Linux has released security updates for kernel 6.12.0-211.34.1, addressing multiple vulnerabilities and enhancing driver signing, with various RPM packages available for x86_64 and aarch64 architectures.
Security teams investigating AI-related incidents need guardrail intervention data alongside their existing security telemetry. Routing Amazon Bedrock Guardrails violations to Amazon Security Lake makes this possible. With this integration, you can query guardrail events alongside identity, network,...
Oracle Linux 9 has received an update with kernel and related RPMs addressing security issues, including CVE-2025-68214, and introduces changes to UKI signing and trusted keys.
Oracle has released updated RPMs for Oracle Linux 9 addressing several CVEs, including significant enhancements in osbuild-composer and its components for both x86_64 and aarch64 architectures.
For decades, Network Address Translation (NAT) has been the default way IP addresses are provided inside larger networks, as a means to deal with the challenges of IPv4 address availability.
The basic premise behind NAT is that private addresses stay private, but that assum...
Oracle Linux has released an update for GIMP addressing multiple CVEs, available for both x86_64 and aarch64 architectures, as part of their security advisory ELSA-2026-50817.
Switzerland's federal IT office says hackers exploited vulnerabilities to breach its Microsoft SharePoint servers and compromised approximately 200 accounts. [...]
Maksim Silnikau participated in cybercrime since at least 2005. He ran Ransom Cartel from 2021 until his arrest in 2023.
The post Ransom Cartel creator sentenced to 16 years in prison appeared first on CyberScoop.
Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. [...]
In this week's newsletter, Martin looks at how the metaphors we use to describe AI "escaping" its sandbox can completely change how we react to the threat.
Debian has addressed multiple vulnerabilities in the Linux kernel, which could cause privilege escalation, denial of service, or information leaks, advising users to upgrade their packages.
Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests.
The flaw is tracked as CVE-2026-64561 ...
Round two from Black Hat USA 2026. This set covers the parts of the show floor that did not make the first gallery. Scroll through below. Featured vendors: BlackCloak, Teleport, GitGuardian, Oak, Hexnode, Picus Security, Featured speaker: Kate Silverstein (Mozilla) discussing crowd-sourcing protecti...
North Carolina Ports is recovering from a cyberattack after its IT system was “hacked by an outside actor or group,” requiring a switch to manual processing of operations.
Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review.
The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Softw...
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontar...