> TODAY'S SUMMARY (83 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Notably, the FBI and CISA issued warnings regarding cyberattacks targeting industrial refrigeration systems, which could lead to severe consequences for food and medical supplies. OpenSSH has revealed a significant flaw that allows remote attackers to bypass authentication on certain Linux systems, while a breach at Chainalysis exposed sensitive credentials for all its customers. Additionally, CEO impersonation scams utilizing AI have resulted in over $100 million in losses, emphasizing the growing sophistication of cybercriminal tactics. In response to these threats, organizations are urged to enhance their security measures, particularly around password management and vulnerability patching.
|
// AI-powered summary generated at 16:00
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Two new high severity WordPress vulnerabilities, patch immediately! The 7.0.2 WordPress security release addresses one critical and one high severity security issue. Cynative: Open-source deep research...
Public exploits are now available for two critical WordPress flaws that attackers can chain to gain remote code execution without authentication. Public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core. The flaws, tracked as CVE-2026-6303...
L'IJsstadion Thialf, un important stade de patinage et lieu d'événements situé à Heerenveen, a récemment été la cible d'une cyberattaque par ransomware. L'attaque a été attribuée au groupe malveillant « The Gentlemen ». Les attaquants ont exigé le paiement d’une rançon en échange de la non-publicati...
Get Nice Holdings, une société de services financiers cotée à Hong Kong, a été victime d'une cyberattaque le 19 juillet. L'incident a temporairement affecté ses systèmes de trading électronique et d'autres services, y compris les retraits d'actions. Bien que l'unité de titres ait repris ses opératio...
7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files. [...]
La CCDR Algarve a été victime d'une cyberattaque durant le week-end (nuit de samedi à dimanche). Suite à la détection d'un accès externe non autorisé, l'organisation a activé ses protocoles internes. Certains services, notamment les communications et l'accès au courrier électronique institutionnel,...
La société de technologie de la santé britannique, Craneware, a confirmé avoir été victime d'une cyberattaque ayant entraîné le vol de données de clients et d'employés. Basée à Édimbourg, l'entreprise fournit des logiciels au secteur de la santé américain. Bien qu'un volume important de noms de fich...
Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory and trigger denial-of-service attacks. Okta’s Red Team disclosed a denial-of-service vulnerability in OpenSSL they named HollowByte, and the attack payload is exactly 11 bytes. A remote, unauthenticat...
Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core, making it imperative that administrators patch their sites immediately. [...]
The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-60137 – A REST API batch-rou...
Microsoft has observed a surge in attacks using the ACR Stealer malware to steal browser-stored passwords, authentication tokens, and sensitive documents from its enterprise customers. [...]
Researchers found China’s Daxin rootkit and a new Stupig backdoor on a Taiwan firm’s network, suggesting a stealthy intrusion dating back to 2013. Symantec’s Threat Hunter Team found Daxin running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in 2026. D...
As age verification laws expand worldwide, organizations face growing pressure to protect users' privacy while meeting regulatory requirements. Incode explains how on-device age estimation verifies age without transmitting or storing facial images, reducing biometric privacy risks while supporting c...
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)Â added Fortinet FortiSandbox and Microsoft SharePoint flaws to its Kn...
Seize organisations françaises citées par six groupes pirates entre le 1er et le 16 juillet 2026.
Bonjour à toutes et tous Cette semaine, les fuites de données dominent l’actualité avec NEBBIA, Croqvacances, seize millions de CV exposés et le piratage de l’opérateur Odido. LeakBase voit aussi réapparaître dix téraoctets de données volées.La menace prorusse reste active : NoName057(16) revendique...
Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.
La base volée d’Action populaire ressurgit, exposant militants et organisation aux risques cyber et politiques.
LeakBase fermé, une archive de 10 To de données volées réapparaît via des stockages publics russes.
“Context bombing” tricks malicious AI agents into shutting down before they can do harm.