> TODAY'S SUMMARY (11 articles)
Today's cybersecurity landscape reveals several critical threats and trends. A memory corruption flaw in Google's Brotli decoder affects multiple widely used applications, including Node.js, Python, and Envoy, posing risks of remote code execution. LiteLLM reported a serious incident where a leaked master key allowed attackers to hijack its GitHub release pipeline. In data breach news, Capcom suffered a breach exposing 11.7 million email addresses, while patient data was stolen in an attack on Point Vision. Additionally, the U.S. CISA highlighted actively exploited vulnerabilities in Collabora Online and Arista VeloCloud, urging immediate attention. Lastly, a new tool called Pulse has been released to help users interpret Windows event logs more clearly.
|
// AI-powered summary generated at 12:01
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to th...
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.
TL;DR
During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own.
One login reques...
GitLab a corrigé la CVE-2026-97229, une faille critique qui permet d'exécuter du code sans authentification via une regex piégée dans une configuration CI/CD.
Le post GitLab corrige une faille critique qui permet d’exécuter du code sans authentification (CVE-2026-97229) a été publié sur IT-Connect.
Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.
The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek.
People who have shopped with Phase Eight, Hobbs or Whistles will have to wait to find out whether their personal information was exposed in a cyberattack on the company behind the three UK fashion brands. TFG London, the UK business of South African retail group The Foschini Group (TFG), detected th...
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...]
Anthropic’s Claude submitted a made-up tip about an unsolved murder during testing.
More internet-connected refrigerators have joined the official list of those affected by a cyberattack that ruined stocks of chilled food at hundreds of French supermarkets over the weekend.
The French Computer Emergency Response Team (CERT-FR) advised supermarkets to disco...
Radware has announced Radware Model Context Protocol (MCP) Server Protection, a purpose-built solution designed to help organizations more securely adopt MCP as AI agents gain greater access to enterprise applications, data and business workflows. The solution is intended to give organizations visib...
SolarWinds has announced the launch of Avior, a standalone, goal-oriented agentic AI system purpose-built for mission-critical IT environments. Built on the SolarWinds Platform, Avior will help IT teams securely define goals, coordinate specialized agents, and track progress toward measurable outcom...
Dashlane data finds that passkey adoption is growing but not quickly enough
Chainguard has announced Chainguard Harness, a new cyber harness that uses frontier AI models like Anthropic’s Claude Mythos 5.1 to find and fix exploitable vulnerabilities in an organization’s application code. Harness builds an application from an organization’s source code in an isolated microVM,...
Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance...
Scytale has announced the launch of Scytale MCP, a Model Context Protocol server that connects a customer’s AI tools directly to their compliance program. With Scytale MCP, tools such as Claude and ChatGPT can query live compliance data and complete routine work through plain language instead of scr...
FBI alleges covert recorder was plugged into a TV, with a second device later discovered in the employee's bag
At least two French supermarkets using temperature regulation devices from Dixell Electronics also experienced food stock disruptions
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and model serving costs by more than 98% compared with its previous large language model (LLM) pipeline. GitHub’s secret scanning c...
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It&
Over the last year or so, multiple engineers at Aisle have spent a lot of time and energy while pointing their AI powered tooling at the curl source code. This has resulted in no less than thirty-five published curl vulnerabilities and CVE Ids. Today, we make Aisle’s audit report available on the cu...
Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe