> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems.
Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in nat...
Legal intern Suzanne Castillo co-authored this post.
Playstation’s decision to kill physical game discs is the latest attack on our diminishing rights to access and engage with culture digitally. Rent-seeking corporations and negligent lawmakers share the blame–and they can do better.Â
We’ve seen th...
Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across Chrome and Edge, after researchers found a hidden browsing-history collector built into its official store version.
The collector was dormant. An empty allow-list kept it switched...
Following the breach of several of her Telegram channels, controversial Russian journalist Ksenia Sobchak claimed published screenshots of her correspondence with political figures were fake.
Microsoft Entra ID makes passkeys the default sign-in experience and introduces a new model for SMS and voice authentication. Read about how to prepare.
The post Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID appeared first on Microsoft Security Blog.
German discount supermarket chain Lidl has notified customers in Germany, Belgium, and the Netherlands that customer data was stolen after attackers breached one of its IT service providers. In notices published on its support websites in Belgium and the Netherlands, Lidl said it was informed of the...
The EU, its members and the U.K. took action against Russian government officials and others while attributing the winter cyberattacks against Poland’s energy grid to the FSB.
The post Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ appeared first on CyberScoop.
It was discovered that PipeWire accepted unbounded Content-Length values
in its RAOP module. A remote attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-14324)
It was discovered that PipeWire performed multiple unbounded stack
a...
Sweeping sanctions and condemnation follow op that could have left half a million without power in the depths of winter
Misconfigured server exposed three phishing operators running Evilginx forks to bypass MFA
State-sponsored attackers are targeting critical infrastructure networks in defense, communications, energy, finance, government and health care.
The post Officials once again warn defenders that Russian hackers are targeting network devices appeared first on CyberScoop.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. [...]
Somewhere right now, a security tool is quietly finding bugs faster than any human can fix them. That's supposed to be the good news. The catch is that the attackers have the same tools, pointed the other way, and they don't file tickets.
That's the shape of this week. Trusted code turns on the peo...
It was discovered that LibreOffice incorrectly handled importing DXF
drawings. An attacker could use this issue to cause LibreOffice to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2026-6039)
It was discovered that LibreOffice incorrectly handled certain ODF num...
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Exper...
The EU and the UK jointly sanctioned dozens of Russian individuals and entities, accusing Moscow of coordinating a malicious cyber ecosystem targeting Europe, its member states, and international partners. The UK sanctioned 24 individuals and entities, while the EU imposed restrictive measures on ni...
Chinese and Indian spies converged on the same Balochistan police force, SentinelLabs found
This week on the Lock and Code podcast, we speak with Anna Brading about what actually works in keeping her kids safe online.
Once a notorious blackhat hacker, McGraw shares his journey from high school hacking and prison to redemption as a cybersecurity advocate.
The post Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption appeared first on SecurityWeek.
German discount supermarket chain Lidl notified customers in Germany, Belgium, and the Netherlands that attackers stole their personal information in a breach at a service provider. [...]