> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
If you have a Chick-fil-A One account, now is a good time to change your password—and make sure it's one you don't use anywhere else.
It was discovered that GIFLIB incorrectly handled certain GIF image files.
If a user or automated system were tricked into opening a specially crafted
GIF file, a remote attacker could use this issue to cause GIFLIB to crash,
resulting in a denial of service, or possibly execute arbitrary code.
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.
The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/...
Find out how to disable location history on Android, iOS, Mac, Windows, and browsers. Why? Google alone paid $1.5B+ in lawsuits over this.
OpenAI announced that its models were behind a breach of the AI platform Hugging Face, which had earlier detected an attack carried out by "by an autonomous AI agent."
No organisation can navigate the migration alone; key takeaways from our first PQC migration workshop.
Security leaders who build fast, visible paths to AI adoption are becoming the most valued partners in their organizations. AI governance done right gives security teams the visibility they need, employees the tools they want, and CISOs the strategic influence they have earned.
According to McKinse...
Some never saw their files again either, infosec biz Proofpoint finds
‘Unprecedented’: OpenAI Says AI Models Autonomously Hacked Another Company OpenAI disclosed that an autonomous AI agent built on its models — the newly released GPT-5.6 Sol and an unreleased, more capable model — broke out of a controlled test environment and hacked into Hugging Face’s servers usin...
Attackers are exploiting a critical SharePoint remote code execution (RCE) vulnerability (CVE-2026-50522) to extract the servers’ IIS machine keys. “WatchTowr is observing active exploitation of CVE-2026-50522 against on-premise Microsoft SharePoint deployments following the release of public exploi...
The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents. [...]
Hugging Face recently disclosed a security breach. OpenAI has now said that it was its AI models which broke containment and hacked Hugging Face themselves
A reported breach at microtask platform Paidwork exposed personal and financial data of more than 23 million users. Here's how to check if you're affected.
CVE-2026-50522 is being exploited by threat actors to steal machine keys and retain long-term access.
The post Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks appeared first on SecurityWeek.
Oracle Linux has released updates for .NET SDK and Runtime to address multiple CVEs, enhance support for Oracle Linux, and reduce build hang detection time.
Oracle Linux has released security updates for Dovecot in version 2.3.21 to address CVE-2026-42006, with packages available for both x86_64 and aarch64 architectures.
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely.
The CrowdStrike Glob...
Oracle Linux 10 has received updated RPM packages addressing security vulnerabilities related to sudo LDAP provider and GPO cache path traversal, along with other enhancements.
Oracle Linux 10 has released updated rpms to address CVE-2026-14544 and previous vulnerabilities related to hplip, including multiple code execution and privilege escalation fixes.
Glow has emerged from stealth with $180 million in funding at a $1.2 billion valuation to advance a prevention-first approach to endpoint security. The funding round was led by Sequoia, Cyberstarts, Greenoaks, and Redpoint Ventures, with participation from Index Ventures, Swish Ventures, Lux Capital...