> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Wget could be made to connect to unintended network resources.
Several security issues were fixed in Apache HTTP Server.
Cosmetics giant Estée Lauder is notifying customers of a data breach after hackers exploited a flaw in Oracle E-Business Suite that the company used for human resources (HR) operations. [...]
It was discovered that ImageMagick did not limit mutual references between
MVG files. An attacker could possibly use this issue to cause a stack
overflow, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu
22.04 L...
Avec 1Password for Claude, l'IA se connecte Ă vos comptes dans le navigateur, sans jamais voir vos mots de passe ni vos codes (MFA).
Le post 1Password laisse Claude se connecter à vos comptes, sans jamais lui confier vos mots de passe a été publié sur IT-Connect.
Two recently disclosed SonicWall SMA1000 vulnerabilities were exploited in zero-day attacks for weeks, allowing threat actors to install custom malware on vulnerable VPN appliances. [...]
The Ostium trading platform announced that an attacker stole $23.75 million from its liquidity provider vault last week, after compromising off-chain infrastructure used to feed prices into the protocol. [...]
The new Amazon GuardDuty investigation agent (now in public preview) investigates security findings across your Amazon Web Services (AWS) environment, reducing investigation time from hours to minutes. GuardDuty is our managed threat detection service that continuously monitors your AWS accounts and...
Plus dozens of PoCs in the public domain
Are you a California resident? Then we've got exciting news for you: there's a tool just for you that lets you take a single, relatively easy step to protect your privacy.Â
It's called a DROP request. (That's Delete Request and Opt-out Platform, if you're fancy). This one bit of paperwork lets you t...
wp2shell is a critical unauthenticated RCE chain in WordPress Core, patched July 17, 2026. See who's affected, the exploitation timeline, and what to do now.
The post wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decade appeared first on Wordfence.
USN-8563-1 introduced a regression in nginx
USN-8563-1 fixed vulnerabilities in nginx. One of the fixes introduced ABI
changes that could cause issues with external modules. This update reverts
the fix for CVE-2026-42533 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that ng...
Researchers escaped the sandboxes in Cursor, Codex, Gemini CLI and Antigravity by having the AI agent write files that trusted host tools later run. Multiple CVEs, patches, and Google downgrading two Antigravity findings. [...]
The JadePuffer autonomous AI agent has upgraded with custom malware called EncForge that focuses on encrypting AI assets, such as training datasets, vector databases, and model checkpoints. [...]
Cloudflare Internal DNS brings authoritative and recursive DNS for private networks to the same global network and control plane that runs Cloudflare's Zero Trust, networking, and public DNS.
Find out how to disable OneDrive, uninstall it, and more ways to stop Microsoft’s cloud storage if you don’t like how it handles your data.
A sandbox security hole that could lead to remote code execution (RCE), patched last week by ServiceNow, is being actively exploited in the wild, according to a report from threat intel firm Defused.Â
The report, posted on X, said the firm is “observing in-the-wild exploita...
IC3 says any account claiming to represent it is fake
"Community consultation" is one of the reasons automated license plate reader (ALPR) company Flock Safety cited in its decision to drop voice-oriented tech from a gunshot detection system.