> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not to hijack AI agents, but to defend against th...
Human did 10% of the job,
AI did 90%
It was discovered that alsa-lib incorrectly handled certain ALSA
configuration text. An attacker could use this issue to cause alsa-lib to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Researchers at Jamf Threat Labs detail CrashStealer, which steals passwords, cryptocurrency wallets and more
Frame est un outil open source qui offre une interface graphique à FFmpeg pour convertir vidéos et audios sans ligne de commande, sur Windows, Linux et macOS.
Le post Frame : une interface graphique open source et moderne pour FFmpeg a été publié sur IT-Connect.
It was discovered that httplib2 performed unbounded decompression of HTTP
response bodies when the server used gzip or deflate Content-Encoding. A
remote attacker could possibly use this issue to cause httplib2 to use
excessive resources, leading to a denial of service.
Researchers at KU Leuven tested 85 of the most popular crypto wallets that run as browser extensions and found that the wallets themselves leak enough to link and track the people using them.
The way these wallets talk to websites and blockchain servers can tie a person's separate addresses togethe...
It was discovered that MariaDB did not properly validate parameters
supplied by a joiner node during a State Snapshot Transfer using the
mariabackup method. An attacker could possibly use this issue to execute
arbitrary shell commands on the donor node. (CVE-2026-44168)
It was discovered that Maria...
SAP has addressed 16 vulnerabilities across multiple products as part of its July 2026 security updates, including three critical flaws in NetWeaver, Commerce Cloud, and AppRouter. [...]
AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and help teams move faster. But most still rely on fragmented risk signals: scanner output, severity scores, threat intelligence, configuration findings, and e...
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry.
The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments, without ever gene...
The flaws could allow attackers to access and modify data, and cause system unavailability and request-response desynchronization.
The post SAP Patches Critical Vulnerabilities in NetWeaver, Approuter, Commerce Cloud appeared first on SecurityWeek.
Cybercriminals are combining social engineering through apps like FaceTime with unpatched devices to steal credentials and drain bank accounts.
FIFA’s network was vulnerable to anyone with even minimal access.
Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks.
The post US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers appeared first on SecurityWeek.
Microsoft is now testing a cleaner and faster version of Windows Search that should prioritize relevant results over ads and promotional content. [...]
Every day, defenders make high-consequence decisions with incomplete information. Learn how Cisco Talos Intelligence Integrations help reduce uncertainty by turning the latest threat intelligence into proactive protections across Cisco technologies.
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days CISA added two maximum-severity flaws affecting the iCagenda and Balbooa Forms extensions for Joomla to its Known Exploited Vulnerabilities catalog after reports of zero-day exploitation in the wild. Both bugs, rated 10.0 on t...
Google has started rolling out FIDO2-compliant physical security key support as a second factor for authentication in Google Credential Provider for Windows (GCPW) to all Google Workspace customers. GCPW is a free tool that lets users sign in to Windows computers with their Google Workspace account...