> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
Information published.
Information published.
When a company falls victim to a ransomware attack, it is not uncommon for it to turn to experts for help.
Specialist ransomware negotiation firms handle communications with criminal gangs on a victim's behalf.
What victims don't expect is that their trusted negotiator might be separately sha...
Information published.
New macOS infostealer CrashStealer uses a signed app to bypass Gatekeeper, steals credentials and wallets, then AES-encrypts stolen data. Jamf Threat Labs first spotted CrashStealer in early May 2026 as a suspicious macOS sample uploaded to VirusTotal. By early July, in-the-wild detections confirmed...
Depuis le 14 juillet 2026, la CNIL exige le consentement pour les pixels de suivi dans les e-mails. On vous explique la règle et comment couper le pistage.
Le post Pixels de suivi dans les e-mails : ce que change la CNIL et comment bloquer le pistage a été publié sur IT-Connect.
A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog.
The packages did not go after the developers who might install them. The operators used the regis...
Enterprises have worked for years to improve detection and response times in the face of increasingly sophisticated attacks that relied on manual hacking and living-of-the-land techniques. AI is now threatening to undo those efforts.
An increasing number of threat actors ar...
CVSSv3 Score:
4.1
A buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.
Revised on 2026-07-14 00:00:00
CVSSv3 Score:
5.3
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability [CWE-80] in FortiSIEM may allow a privileged administrator to execute unauthorized commands via crafted requests.
Revised on 2026-07-14 00:00:00
A new CMMC review and reform task force will conduct a comprehensive review of the program.
The post Pentagon Suspends CMMC Phase 2 as It Rethinks Contractor Cybersecurity Rules appeared first on SecurityWeek.
CVSSv3 Score:
3.4
An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicki...
CVSSv3 Score:
7.7
An Exposure of Resource to Wrong Sphere vulnerability [CWE-668] in FortiSanbox may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.
Revised on 2026-07-14 00:00:00
Underground hacking forums are producing more original tutorials again, with growing attention on financial fraud, particularly the theft and fraudulent use of payment card data, known as carding, and cash-out techniques. New tutorials per month versus reposts (Source: Radware) Fraud tutorials gain...
CVSSv3 Score:
6.9
An Improper Restriction of Communication Channel to Intended Endpoints [CWE-923] vulnerability in FortiSIEM Windows Agent may allow an unauthorized attacker on the same local network to execute arbitrary code via spoofing the supervisors hostname when the Windows device...
CVSSv3 Score:
5.9
A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiOS, FortiProxy and FortiPAM may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.
Revised on 2026-07-14 0...
Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform.
The way in has been the trust the organization had already extended, usually through the OAuth connect...
CVSSv3 Score:
6.1
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS, FortiProxy, FortiPAM and FortiSwitch-Manager Agentless SSL-VPN may allow an authenticated remote user to execute code or commands via crafted reques...
CVSSv3 Score:
5.0
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in FortiOS, FortiPAM, FortiProxy and FortiSwitch Manager may allow a privileged authenticated attacker with physical access to the device to delete the file system vi...
Analysts across the security industry now run generative AI through their daily work, from log triage to incident write-ups. Active use in cybersecurity strategy reached 78% of practitioners in 2026, up from half the field a year earlier. The 2026 SANS AI Survey, drawn from 536 IT and security profe...