IT-Sentinel

> TODAY'S SUMMARY (16 articles)

Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.

// AI-powered summary generated at 20:00

> CVE-2026-3842 Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-07-21 08:42]

Information published.

> CVE-2026-38755 A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-07-21 08:42]

Information published.

> Exploitation of ServiceNow Vulnerability Seen Days After Disclosure

[SOURCE] SecurityWeek [LANGUAGE: EN] [DATE: 2026-07-21 08:41]

The ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution. The post Exploitation of ServiceNow Vulnerability Seen Days After Disclosure appeared first on SecurityWeek.

> CVE-2026-38754 A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-07-21 08:41]

Information published.

> Fuite revendiquée au Rassemblement national ?

[SOURCE] ZATAZ [LANGUAGE: FR] [DATE: 2026-07-21 08:39]

Un pirate affirme vendre des données présumés volés au Rassemblement national qui révélerait des données internes, sans preuve publique permettant d’authentifier la fuite à ce stade.

> Open-source maintainers still work underfunded as sponsorship crosses $100 million

[SOURCE] Help Net Security [LANGUAGE: EN] [DATE: 2026-07-21 08:37]

A maintainer patches a library late at night that ships inside thousands of products, and no invoice follows. Sebastián Ramírez and Caleb Porzio spent years in that position. Ramírez, known as tiangolo, builds tools that other Python projects depend on. Porzio built Livewire and Alpine.js, tools tho...

> Hugging Face frappé par un agent cyber autonome

[SOURCE] ZATAZ [LANGUAGE: FR] [DATE: 2026-07-21 08:21]

Une attaque autonome contre Hugging Face révèle les risques cyber des pipelines de données et des agents IA.

> Zimbra Update Patches Critical Vulnerabilities

[SOURCE] SecurityWeek [LANGUAGE: EN] [DATE: 2026-07-21 08:20]

The latest Zimbra refresh resolves command injection, XSS, restriction bypass, and SSRF security defects. The post Zimbra Update Patches Critical Vulnerabilities appeared first on SecurityWeek.

> Windows LegacyHive zero-day flaw gets free, unofficial patches

[SOURCE] BleepingComputer [LANGUAGE: EN] [DATE: 2026-07-21 08:06]

Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems. [...]

> CVE-2026-64146 erofs: fix metabuf leak in inode xattr initialization