> TODAY'S SUMMARY (12 articles)
Today's cybersecurity landscape reveals several significant threats and trends. The newly identified "sshole" vulnerability (CVE-2026-123158) is leading to an uptick in exploitation attempts, particularly observed through honeypot data. Additionally, a major data breach at Japanese manufacturer Iris Ohyama has compromised the personal information of approximately 7.7 million customers. On the malware front, an unknown advanced persistent threat (APT) is utilizing NetamLoader to target Windows 10 systems. In a notable incident, attackers exploited a third-party service provider to steal up to $133 million from French Bank Crédit Mutuel Arkéa. Meanwhile, law enforcement has arrested three suspects linked to the DataSuckers hacking group, which previously targeted Dodo Pizza. The evolving role of AI in cybersecurity continues to be highlighted as companies seek to bolster defenses against these increasing threats.
|
// AI-powered summary generated at 16:00
Debian Security Advisory DSA-6400-1 addressed two vulnerabilities in Exim that could lead to privilege escalation for local attackers, recommending an upgrade to version 4.98.2-1+deb13u4.
Lower catch this year.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
The administration set a target date of September for CISA to finalize the rule, but where the agency is headed remains a mystery to some.
The post Industry’s message on CIRCIA: Please ask us fewer questions about cyberattacks appeared first on CyberScoop.
EU fined Google €890M under the DMA for favoring its own services and restricting Play Store competition, with AI search features also under scrutiny. The European Commission hit Google with two fines totalling €890 million on Thursday for violating the Digital Markets Act, one for giving its own se...
Stop the spread (of online recruiting and propaganda)
OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers. [...]
When an administrator introduces a rule change in AWS Network Firewall and network connectivity is disrupted, pinpointing the cause requires inspecting multiple points in the traffic path. The firewall gives you stateless and stateful rule engines, domain rules, and routing to the firewall endpoint...
Roughly 1 in 4 of those compromised IPs are based in the United States, Lumen’s Black Lotus Labs said. Botnets like IPIDEA have also rebounded quickly, surpassing their pre-disruption footprint.
The post Despite multiple takedowns, botnets continue to grow appeared first on CyberScoop.
Certighost (CVE-2026-54121) : cette faille dans AD CS permet à un utilisateur standard de compromettre un domaine Active Directory. Protégez-vous.
Le post Certighost (CVE-2026-54121) : un compte AD standard suffit pour usurper un contrôleur de domaine a été publié sur IT-Connect.
Summary The EU’s 21st Russia sanctions package introduces a transaction ban on 14 crypto-related service platforms across six jurisdictions: Georgia,…
The post The EU’s 21st Russia Sanctions Package Targets Crypto Platforms for Sanctions Evasion, Introduces Third-Country Ban Mechanism appeared first...
A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [...]
L'envoi de mots de passe en clair par courriel, y compris dans le message de bienvenue, constitue une violation de l'obligation de sécurité de l'article 32 du RGPD, et ce, même si les mots de passe sont chiffrés dans le système d'information du responsable de traitement.Faits et contexteL'autorité e...
L'autorité espagnole sanctionne une société pour défaut de coopération, rappelant que l'absence de réponse à une demande d'information constitue une obstruction à ses pouvoirs d'enquête et une violation du RGPD.Faits et contexteL'autorité espagnole de protection des données (AEPD) a aujourd'hui publ...
For years, John Deere had actively made repairing their tractors near-impossible for anyone but itself and the few "authorized" repair shops—regardless of the ability of its customers to actually visit such shops. Now, in a major win for farmers and right to repair advocates, John Deere must soon pr...
L'Agence Espagnole de Protection des Données (AEPD) a aujourd'hui publié une décision de sanction à l'encontre de l'Union Temporaire d'Entreprises GRÚAS SEVILLA, comprenant le prononcé d'une amende de 10 000 €, pour des manquements en lien avec son obligation de coopération avec l'autorité de contrô...
La Commission européenne a maintenu sa décision d'adéquation concernant le niveau de protection des données personnelles de la Corée du Sud, suite à sa première révision périodique.La Commission de protection des informations personnelles (PIPC) sud-coréenne a indiqué que la Commission européenne a...
A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constitutional rights at the U.S. border.
L'autorité espagnole de protection des données sanctionne une société pour ne pas avoir répondu à une demande d'exercice du droit d'accès, suite à une plainte transfrontalière initiée en Italie.Faits et contexteL'autorité espagnole de protection des données (AEPD) a aujourd'hui publié une décision d...
Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. [...]
By doing in-depth testing, we found nearly 70% of BGP paths experience ORIGIN attribute rewrites by transit providers seeking traffic advantages. We examine the global impact of this practice and argue for deprecating ORIGIN in route selection.