> TODAY'S SUMMARY (41 articles)
Today's cyber news highlights significant threats, particularly targeting industrial refrigeration systems. The FBI and CISA have issued warnings about attacks that can manipulate temperatures in supermarket refrigeration, posing risks to food safety and supply chains. In the realm of vulnerabilities, a memory safety flaw in CPython could allow AI inference servers to be compromised. Additionally, a critical exploit in OpenSSH may enable unauthorized access to password-disabled accounts on certain Linux systems. Meanwhile, phishing schemes leveraging fake OpenAI events are being reported, aimed at stealing Microsoft and Google accounts. The ongoing escalation of AI-driven attacks is also notable, with incidents targeting fintech firms during off-hours.
|
// AI-powered summary generated at 12:00
This week on the Lock and Code podcast, we discuss just exactly why it is that hackers and scammers want your data—and how you're at risk.
Zhihan Zheng discovered that FreeIPMI had several buffer overflow
vulnerabilities in ipmi-oem response message handling. A local attacker
with control a malicious IPMI device or simulator could possibly cause
FreeIPMI to crash, resulting in a denial of service. (CVE-2026-33554,
CVE-2026-50031)
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days.
The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek.
Monday starts with the usual promise that everything is under control. Then the logs wake up.
This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped.
Th...
Shadow AI agents are rapidly spreading across enterprise platforms, often without IT or security visibility. Nudge Security explains how organizations can discover, assess, and govern AI agents before unmanaged permissions and autonomous actions create security risks. [...]
Dynatrace has announced major advancements to Dynatrace Intelligence that help automatically resolve incidents, prevent disruptions, and accelerate operations while maintaining the human oversight and governance enterprises require. Building on the introduction of Dynatrace Intelligence earlier this...
One bug disabled the security service on restart, another blocked installation on hardened RHEL systems
Zenity has announced a major expansion of its platform, making it the AI security platform for autonomous AI built around a new security architecture designed to govern AI decisions before they become enterprise actions, including those made by long-horizon agents operating autonomously across exten...
JetStream Security has announced the release of an AI Kill Switch that allows organizations to shut down compromised AI agents on-demand without impacting other AI operations. This new control plane for AI agents solves the inability to stop a single agent that falters, begins overspending, or needs...
The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication.
The post PTC Windchill Vulnerability Exploited in Ransomware Campaign appeared first on SecurityWeek.
7AI has announced two major platform capabilities: 7AI Federated SIEM, which lets security teams query, investigate, and act on data wherever it lives, including within 7AI, and 7AI Build, which lets enterprises and partners define agentic workflows, skills, and AI-native security services on top of...
C1 has launched shadow AI discovery to eliminate the massive security blind spots created by unauthorized AI agents, tools, and credentials. By automatically discovering and folding every AI-adjacent identity into C1’s existing identity governance platform, organizations can finally ensure that the...
Ubuntu has addressed multiple vulnerabilities in the GNU C Library affecting versions 22.04, 24.04, and 26.04 LTS, which could lead to denial of service or code execution.
A vulnerability in Roc Toolkit allows potential crashes or arbitrary code execution through malformed WAV files, affecting Ubuntu 26.04 LTS users; an update is recommended.
Google Threat Intelligence Group (GTIG) has started using a new naming system for the threat actors it tracks. The change comes after Mandiant and Google’s Threat Analysis Group (TAG) merged into one unit, leaving the company with two separate naming schemes built up over years. Previously, Mandiant...
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass.
The affecte...
DentaQuest disclosed a data breach that may have exposed the personal and dental health information of more than 23 million people. DentaQuest is notifying more than 23 million people of a data breach after hackers accessed its network in May 2026. The incident may have exposed customers’ personal i...
The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems.
The post MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection appeared first on SecurityWeek.
pvcli is a curl-like tool designed to simplify the testing of complex privacy protocols like OHTTP.
In a letter first reported by CyberScoop, Ron Wyden, D-Ore., said ‘devastating’ attacks on the federal government have accumulated due to the tech.
The post Sen. Wyden urges feds to discard older, insecure, public-facing VPNs appeared first on CyberScoop.