> TODAY'S SUMMARY (87 articles)
Today's cybersecurity landscape highlights several critical threats and trends. A major data breach in Denmark has compromised the personal information of approximately 8.8 million individuals, raising concerns over third-party access to sensitive government databases. In the U.S., a ransomware attack on the University of Illinois Chicago's medical school has resulted in the theft of information from its servers. Additionally, Citrix is facing serious challenges as attackers exploit a newly discovered zero-day vulnerability in its NetScaler products, prompting CISA to issue warnings about potential system outages. On the software front, Debian's latest kernel security update reveals over a thousand vulnerabilities, urging users to patch their systems promptly. Meanwhile, Google has suspended its open-source bug bounty program due to an influx of AI-generated vulnerability reports, reflecting ongoing challenges in managing AI's impact on cybersecurity.
|
// AI-powered summary generated at 16:00
Deepfakes, voice cloning, and other AI-powered scams cost Americans nearly $900 million in 2025, says the 2025 FBI Internet Crime Report.
North Korean actor UNK_DeadDrop targeted developers with fake coding tasks to steal crypto
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:
For the latest discoveries in cyber research for the week of 1st June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES DentaQuest, a U.S. dental benefits administrator owned by Sun Life, has suffered a data breach after threat group ShinyHunters leaked exfiltrated data. An...
Ali Norouzi discovered that Kea DHCP did not properly handle maliciously
crafted messages over configured API sockets and HA listeners. A remote
attacker could possibly use this issue to cause Kea DHCP to crash,
resulting in a denial of service.
Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol.
The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of a logic flow weakne...
Hackers exploit CVE-2026-3300 in Everest Forms Pro to inject PHP via form fields, creating rogue admin accounts. 29,300 attempts blocked. Researcher h0xilo submitted a flaw in Everest Forms Pro for WordPress, tracked as CVE-2026-3300, to Wordfence’s bug bounty program and earned $325 for it. WPEvere...
New regulations published by Russia's Ministry of Digital Development at the end of May updated the technical standards governing SORM, formally known as the System for Operative Investigative Activities.
Security teams are increasingly overwhelmed by alert fatigue, infrastructure maintenance, and complex hybrid environments. This article explores how Wazuh Cloud helps simplify SIEM/XDR operations through managed infrastructure, automated scaling, and AI-driven security analysis. [...]
Updated an acknowledgement. This is an informational change only.
We’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful. It's MIT-licensed, pure-PHP, and available on Packagist now!What is DBSC?If you'd like to know more
OpenAI brings Lockdown Mode and Active Sessions to ChatGPT to curb prompt injection data theft
Miasma worm shapeshifts, but cloud secret-scouting remains the goal
Meta has revealed that attackers hijacked 20,225 Instagram accounts by exploiting a flaw in the company’s AI-assisted account recovery system. According to the company, a vulnerability in High Touch Support (HTS) allowed unauthorized parties to perform password resets on Instagram accounts. HTS is a...
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare — Security researchers at Calif have disclosed a novel denial-of-service technique, dubbed the HTTP/2 Bomb, that weaponizes two well-known mechanisms — HPACK header compression and Slowloris-style connectio...
It was discovered that Netty's HTTP proxy handler did not properly
validate headers when constructing CONNECT requests. An
attacker could possibly use this issue to inject arbitrary HTTP
headers into CONNECT requests. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubu...
New Relic has announced AI Coding Observability, an open-source tool for monitoring AI-assisted software development workflows. As organizations adopt AI coding assistants, these tools often operate outside existing observability systems, limiting visibility into their use. AI Coding Observability e...
The bill is expected to blanket ban companies and startups from selling people's precise location data across the state.
The Meta-owned communications app is filing a federal court contempt order against NSO.
The post WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order appeared first on SecurityWeek.
Monday again. The weekend was meant to be quiet. It wasn't. Last week had poisoned packages, a broken AI helper, and a worm tearing through repos. The ugly part: basic tricks still worked.
A chatbot got fooled. A bot token got leaked inside the malware. The same old mistakes showed up again. And wh...