> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape reveals several significant threats and trends. The newly identified "sshole" vulnerability (CVE-2026-123158) is leading to an uptick in exploitation attempts, particularly observed through honeypot data. Additionally, a major data breach at Japanese manufacturer Iris Ohyama has compromised the personal information of approximately 7.7 million customers. On the malware front, an unknown advanced persistent threat (APT) is utilizing NetamLoader to target Windows 10 systems. In a notable incident, attackers exploited a third-party service provider to steal up to $133 million from French Bank Crédit Mutuel Arkéa. Meanwhile, law enforcement has arrested three suspects linked to the DataSuckers hacking group, which previously targeted Dodo Pizza. The evolving role of AI in cybersecurity continues to be highlighted as companies seek to bolster defenses against these increasing threats.
|
// AI-powered summary generated at 16:00
A credential expired. An AI agent kept using it anyway, and a mid-sized companyâs systems went down for a quarterâs worth of trouble before anyone traced the failure back to a non-human account no one had been logging. That agent could reach customer records, source code, and HR files the whole time...
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan (RAT) associated with the DEV#POPPER malware family.
The list of affected packages is as follows -
@joyfill/[email protected]
@joyfill/[email protected]...
Popular telehealth provider Hims & Hers "shared consumersâ sensitive health information with third-party advertising platforms such as Meta and Snap despite promising to protect patient privacy," the federal government alleges.
A phone backup app asks for storage, contacts, SMS, and call logs. A device-management tool asks for more than that. Run either one past a machine learning malware scanner and it comes back flagged. Six Android detectors in wide research use, including Drebin, MalScan, and MaskDroid, produced that r...
Docs point to Chinaâs Unitree as prime example of the foreign clanker threat
Thereâs new benchmark measuring AIâs ability to perform mathematical cryptanalysis. Anthropicâs frontier model actually found new attacks.
The benchmark: âCryptanalysisBench: Can LLMs do Cryptanalysis?â The idea is to benchmark the ability of LLMs to discover new mathematical cryptanalytic attacks a...
New SeaMonkey packages for Slackware 15.0 and -current are available, addressing security issues with version 2.53.24. Users can download the updated packages from designated Slackware repositories.
New Samba packages addressing multiple security vulnerabilities are available for Slackware 15.0 and -current. Users are advised to upgrade and restart the service if running.
Fortinet has expanded its firewall family with new high-speed boxes that, when combined with the vendorâs FortiSASE Outpost software, extend cloud-based SASE (secure access service edge) capabilities and policy enforcement to on-premises environments.
The new midrange Forti...
New libarchive packages for Slackware 15.0 and -current address security issues, providing an upgrade to version 3.8.9 with bug fixes and minor features.
The âno manâs landâ beneath the OS on enterprise servers is becoming the malicious actorsâ next target.
Attackers are gaining a foothold into broader data center environments by exploiting Baseboard Management Controllers (BMCs) that are largely unprotected, still running d...
Security leaders have spent the last decade building controls around people and code. Shift-left practices caught vulnerabilities earlier in the development cycle. Zero trust reduced lateral blast radius. Developer tooling added guardrails at the IDE. The architecture was soun...
In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four âpublicly available servicesâ in its unhinged quest to solve a test.
Arista has patched a VeloCloud Orchestrator (VCO) security hole that has been actively leveraged in the wild, one that the vendor says âmay allow a remote attacker to access privileged internal functionality and impact the VCO host.â
The Arista security advisory added that...
The deal is Cyera's third acquisition this year.
Beacon CRM, une plateforme de gestion de données utilisée par diverses organisations culturelles, a été victime d'une cyberattaque impliquant un accÚs non autorisé temporaire à ses systÚmes. L'incident, découvert le 29 juillet, a entraßné la copie potentielle de sauvegardes de bases de données. Les...
Mistertemp' group, un groupe français de recrutement et de travail temporaire, a confirmé avoir été victime d'un incident de sécurité informatique le 29 juillet 2026. Cet incident a entraßné un accÚs non autorisé à certaines données personnelles, incluant le nom, le prénom, l'adresse e-mail, le numé...
One year on from our last Secure by Design update, weâre changing the format: deeper, per-product updates. First up: the firewall.
Post-quantum cryptography: The emerging threatThe transition to post-quantum cryptography (PQC) is becoming an urgent priority for the global financial sector due to the rapid evolution of quantum computing. Cryptographically relevant quantum computers exist only as research prototypes. However, the...