> TODAY'S SUMMARY (83 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Notably, the FBI and CISA issued warnings regarding cyberattacks targeting industrial refrigeration systems, which could lead to severe consequences for food and medical supplies. OpenSSH has revealed a significant flaw that allows remote attackers to bypass authentication on certain Linux systems, while a breach at Chainalysis exposed sensitive credentials for all its customers. Additionally, CEO impersonation scams utilizing AI have resulted in over $100 million in losses, emphasizing the growing sophistication of cybercriminal tactics. In response to these threats, organizations are urged to enhance their security measures, particularly around password management and vulnerability patching.
|
// AI-powered summary generated at 16:00
The Anubis ransomware-as-a-service (RaaS) operation has hit some healthcare organisations hard - but they are not the only ones at risk.
Read more in my article on the Fortra blog.
Democratic Sen. Ron Wyden says the Trump administration should pressure Canada not to enact a proposal that would "weaponize American technology infrastructure" for surveillance purposes.
La Cour administrative suprême autrichienne a confirmé la sanction de l'autorité de protection des données pour le traitement illicite de données relatives aux "affinités politiques" de 2,2 millions de personnes, qualifiées de catégories particulières de données, et a fixé l'amende finale à 13 milli...
L'autorité norvégienne de protection des données (Datatilsynet) a commenté un projet de loi visant à encadrer la lutte contre le dopage et la manipulation des compétitions sportives.L'autorité accueille favorablement la codification légale des activités antidopage, destinée à remplacer les autorisat...
Models demand trust without offering verification
L'autorité espagnole sanctionne une entreprise américaine pour des mesures de sécurité insuffisantes face à une attaque par bourrage d'identifiants et pour une notification tardive de la violation de données qui en a résulté.Faits et contexteL'autorité espagnole de protection des données (AEPD) a au...
L'autorité grecque de protection des données a sanctionné un fournisseur d'énergie et ses quatre centres d'appels sous-traitants pour avoir mené des campagnes de prospection téléphonique sous le prétexte d'appels d'information ou d'enquêtes de satisfaction, révélant des défaillances systémiques dans...
USN-8477-1 fixed a vulnerability in tar. The update introduced a regression
that could cause tar to fail to extract certain valid files.
This update fixes the problem.
Original advisory details:
It was discovered that tar incorrectly handled certain crafted archive files.
An attacker could possi...
See also: day one, day two. There is only one thing that is better than two days of HTTP workshop, and that is of course three days of HTTP workshop. The final day of this edition of the series started out with us again shuffling around where we parked ourselves around the big table. Except … Contin...
Several security issues were fixed in Authlib.
A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude's access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce. [...]
The number of people who got approval to be in the Federal Rotational Cyber Workforce program was in the single digits, GAO found.
The post Program to rotate cyber personnel through federal agencies saw little use appeared first on CyberScoop.
A new malicious framework called OkoBot is delivering more than 20 payloads in attacks focused on stealing cryptocurrency wallet seed phrases, credentials, and other sensitive data. [...]
Long foretold, the Great Patching has begun and it’s a doozy. Buckle in as Joe takes you through the story.
Jay Neiva and Mauro Carrillo discovered that Authlib did not properly
validate cryptographic keys embedded in JWT headers. An attacker could
possibly use this issue to forge trusted tokens, resulting in
authentication and authorization bypass. (CVE-2026-27962)
Jay Neiva and Mauro Carrillo discovere...
Two members of the Scattered Spider cybercrime group received jail sentences in the UK for the 2024 cyberattack on Transport for London. A UK court sentenced two Scattered Spider members, Thalha Jubair (20) and Owen Flowers (18), for their role in the 2024 cyberattack on Transport for London (TfL)....
Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”
The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active user...
Officials accused three Russian nationals, Media Land and ML.Cloud of supporting cyberattacks spanning 21 U.S. states and other countries, resulting in losses surpassing $62 million.
The post Russian trio indicted for allegedly running bulletproof hosting providers that spurred cybercrime appeared f...
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London.
The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office...
“Age checks are a cornerstone of the UK’s online safety laws,” said Ofcom’s Chief Executive, Melanie Dawes. “Too many services have no or inadequate age checks in place, which is not good enough.”