> TODAY'S SUMMARY (41 articles)
Today's cyber news highlights significant threats, particularly targeting industrial refrigeration systems. The FBI and CISA have issued warnings about attacks that can manipulate temperatures in supermarket refrigeration, posing risks to food safety and supply chains. In the realm of vulnerabilities, a memory safety flaw in CPython could allow AI inference servers to be compromised. Additionally, a critical exploit in OpenSSH may enable unauthorized access to password-disabled accounts on certain Linux systems. Meanwhile, phishing schemes leveraging fake OpenAI events are being reported, aimed at stealing Microsoft and Google accounts. The ongoing escalation of AI-driven attacks is also notable, with incidents targeting fintech firms during off-hours.
|
// AI-powered summary generated at 12:00
The post We know how to protect our troops from telecom attacks. We’re just not doing it. appeared first on CyberScoop.
Ubuntu announced a security vulnerability in ruby-sinatra affecting multiple LTS versions, which could lead to a denial of service via crafted network traffic, advising updates to resolve it.
American semiconductor company Analog Devices announced that an unauthorized party accessed some of its systems and exfiltrated certain files. [...]
Novee announced the expansion of its AI penetration testing platform to mobile applications. With this addition, Novee becomes the industry’s first complete AI pentesting platform across the modern application attack surface, providing continuous, autonomous coverage. The platform tests web apps and...
A libinput vulnerability allows local attackers to potentially execute arbitrary code with root privileges. Users of Ubuntu 20.04 and 22.04 LTS should update their packages to mitigate this risk.
This week, we launched Burp AT in public beta for Burp Suite Professional users. Next week at Black Hat, PortSwigger Research will reveal more of the work that helped shape our direction. Burp AT is o
Cybersecurity experts told TechCrunch that one of the biggest lessons to be taken from the OpenAI hack against Hugging Face has nothing to do with AI, but traditional cybersecurity defense.
Derrick Van Yeboah impersonated fake romantic partners and directly interacted with victims for more than nine years.
The post Ghanaian national sentenced to 7 years in prison for stealing $10M from romance scam victims appeared first on CyberScoop.
Cryptomining crew abandoned root to impersonate low-privileged Linux users and evade SOC alerts
Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector organizations via email. The warning comes from...
Attackers rarely stop after gaining initial access. Huntress analyzes a real-world intrusion to show how threat actors establish persistence, disable defenses, and reshape compromised systems, and why defenders must investigate the original entry point rather than simply remove the malware. [...]
Cyberattack tools and infrastructure used by North Korea’s Lazarus Group appear to have been shared with ransomware criminals targeting South Korean organizations — further evidence of deepening entanglement between Pyongyang-backed hackers and the ransomware ecosystem.
The company will accelerate investments in R&D and product innovation to expand its agentic data control plane.
The post DataBahn Raises $40 Million for Agentic Data Pipeline Management appeared first on SecurityWeek.
AiTM phishing is now the top entry point into law firms, with identity behind 56% of threats
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
Ubuntu Security Notice USN-8614-1 addresses vulnerabilities in Python 2.7 and 3.5 affecting Ubuntu 16.04 LTS, allowing potential denial of service attacks through specific user-controlled inputs.
The FTC has sued telehealth provider Hims & Hers, alleging it shared customers' sensitive health information with advertisers.
It was discovered that OpenSSL incorrectly allocated memory buffers in the
SSL/TLS state machine when receiving handshake data. A remote attacker
could possibly use this issue to cause OpenSSL to consume excessive memory,
leading to a denial of service. This issue is known as the "HollowByte"
denial...
A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz.
Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted...
The U.S. federal consumer watchdog said Hims & Hers, which prescribes for sexual wellness and mental health conditions, used website trackers to share customers' information with advertisers.