> TODAY'S SUMMARY (2 articles)
Today's cybersecurity news highlights significant threats, including a major breach at French Bank Crédit Mutuel Arkéa, where attackers exploited vulnerabilities in a third-party service provider to steal up to $133 million. This incident underscores the ongoing risk associated with third-party integrations. Additionally, refrigeration cyberattacks continue to target European retailers, raising concerns about supply chain security. As organizations face these evolving threats, proactive measures and timely patching, especially in light of upcoming Patch Tuesday, are crucial for mitigating risks. Overall, the focus remains on enhancing security protocols to safeguard against sophisticated cyber threats.
|
// AI-powered summary generated at 12:00
Le 5 août, la Fondation des mémoriaux du Brandebourg a été victime d'une attaque par ransomware, paralysant l'intégralité de son système informatique. L'incident affecte sept sites, dont les mémoriaux de Sachsenhausen et de Ravensbrück, ainsi que le bureau central. L'organisation redoute une exfiltr...
Les serveurs SharePoint de l'administration cantonale des Grisons ont été victimes d'une cyberattaque. Bien qu'une première analyse n'indique pas de perte de données ou de comptes compromis, l'attaque est probablement due à l'exploitation de vulnérabilités logicielles de Microsoft SharePoint. L'auto...
De multiples vulnérabilités ont été découvertes dans Google Pixel. Elles permettent à un attaquant de provoquer une élévation de privilèges et un problème de sécurité non spécifié par l'éditeur.
La société CEC a publié un rapport final concernant une cyberattaque par rançongiciel survenue dans son centre de données à Tokyo. Après enquête, le conglomérat spécialisé dans la fabrication de composants électroniques, a confirmé qu'aucune fuite de données n'a eu lieu et que les systèmes des clien...
De multiples vulnérabilités ont été découvertes dans HPE Aruba Networking EdgeConnect SD-WAN Orchestrator. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Une vulnérabilité a été découverte dans Mozilla Firefox pour Android. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates. This analysis details the attack chain, affected environments, and practical guidance for detection, hunting, and remediation.
The post Chain...
De multiples vulnérabilités ont été découvertes dans les produits Veeam. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
OpenAI and Anthropic have confirmed that their AI models were involved in separate, newly disclosed third-party cybersecurity testing incidents that resulted in a real website being breached and social engineering attacks against people outside the intended testing boundaries. [...]
Rogue AI agents from OpenAI and Anthropic have again been caught trying to disrupt servers and software—and leaving instructions for future bad behavior.
Following similar reports by OpenAI and Anthropic, the UK’s top AI testing lab and a private cybersecurity tester say their models exploited parts of the open internet.
The post AISI, OpenAI report more ‘unsanctioned’ model hacks appeared first on CyberScoop.
A self-propagating worm-like attack is hitting the npm registry, having infected 444 packages from more than a dozen publishers so far. The impact is massive, with the packages affected amounting to more than 2 billion monthly downloads combined.
The attack began with the c...
The Ninth Circuit Court of Appeals has endorsed a commonsense technical interpretation of the Computer Fraud and Abuse Act (CFAA), a law not usually given to such interpretation. Amazon had sued Perplexity AI to try to shut down its Comet browser, claiming the browser’s optional agentic AI “Assistan...
TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE). [...]
Researchers from multiple security firms observed a variant of Mini Shai-Hulud, self-replicating malware linked to TeamPCP, in all the affected packages.
The post Massive supply-chain attack compromises 440 packages under four hours appeared first on CyberScoop.
The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. [...]
Apple is fighting another attempt by the UK's Home Office to get a backdoor providing access to encrypted iCloud data.
New findings by the Electronic Frontier Foundation aim to warn app developers that some of the third-party code they place in their apps may also collect their users' location data when they grant permission to the app.Â
A tip from WhatsApp led OpenAI to ban multiple accounts associated with investment scams and human trafficking operations based in Cambodian scam centers.
Swiss Federal IT Agency FOITT says attackers exploited SharePoint flaws to compromise about 200 accounts. Servers are being rebuilt as investigations continue. Switzerland’s Federal Office for Information Technology and Communications, known as BIT or FOITT, disclosed that unknown attackers had comp...