> TODAY'S SUMMARY (14 articles)
Today's cybersecurity news highlights several significant threats and trends. A major cyberattack on French bank Crédit Mutuel Arkéa resulted in fraudulent transactions totaling $133 million, emphasizing the risks associated with third-party service providers. Scammers are increasingly impersonating trusted brands in fake gift card schemes, collecting personal information from unsuspecting consumers. The rise of IoT vulnerabilities is underscored by recent hacks affecting critical infrastructure, such as blood labs and grocery stores. Additionally, vulnerabilities in SonicWall's SonicOS have been exploited, prompting CISA to add these to its Known Exploited Vulnerabilities catalog. Developers are also reminded of security best practices, as sensitive credentials were found exposed in public GitHub repositories.
|
// AI-powered summary generated at 20:00
Along with other telemetry, Windows GDID makes online activity more traceable
Multiple security vulnerabilities were discovered in the Postfix mail transport agent, which could result in denial of service. For the stable distribution (trixie), this problem has been fixed in version 3.10.12-0+deb13u2. We recommend that you upgrade your postfix packages.
Two new alleged victims detailed how Grok was used by friends and family to generate sexual images of them as minors. The suit also adds Stability AI as a defendant.
The post Deepfake CSAM lawsuit against xAI, Grok expands appeared first on CyberScoop.
Per usual, there's no fix - or even any documentation - for GitLost
Nayax visée par une revendication pirate massive : données de paiement, clients et risque cyber sous surveillance. 1 milliard de CB concernées ?
Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers. [...]
Spain arrested a suspected CARR and Z-Pentest collaborator in an FBI-led probe for aiding pro-Russian hackers, coordinating attacks, and using crypto. Spanish National Police arrested a man in Palencia last March on charges of membership in and collaboration with a terrorist organization, glorifying...
With the introduction of models that require data sharing with third-party providers—such as Claude Fable 5—organizations need a way to centrally enforce data retention policies. Amazon Bedrock gives you control over whether your prompts and model outputs are retained after an inference request comp...
Yesterday, I talked about NAPTR records and how they are related to RCS. But there is another "odd" record that shows up in my DNS logs. This one isn&#;x26;#;39;t new, but I don&#;x26;#;39;t think I ever covered it: NIMLOC. At least that is what Zeek calls it. But let&#;x26;#;39;s see wh...
Scammers are tricking Reddit and Discord users into handing over login codes by claiming they were involved in a false report.
The alleged victim, believed to be a small Ohio county, reportedly paid the extortion group to prevent the public release of sensitive stolen data.
The post County Government Reportedly Paid $1 Million to Cyber Extortion Group appeared first on SecurityWeek.
A hidden authentication backdoor has been found in multiple Tenda router firmware versions, potentially allowing an attacker to gain administrative access to the device's web management panel. [...]
Attackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.
The post Critical Gitea Flaw Under Active Exploitation, Researchers Warn appeared first on SecurityWeek.
Dog-eat-dog world for credential-stealing attackers
Sanction d'un établissement scolaire pour la communication non autorisée d'une note disciplinaire sur un élève, visible par toute la classe via le registre électronique, en raison d'une erreur de manipulation d'un enseignant.Faits et contexteL'autorité italienne de protection des données (GPDP) a au...
A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim's phone, steal their banking logins, and capture the one-time codes that protect their accounts.
Zimperium's zLabs, which found the...
L'Autorité de protection des données néerlandaise (AP) a publié un avis détaillant les conditions de traitement des données personnelles dans le cadre de signalements de fraude ou de non-conformité.Cet avis s'adresse aux organismes publics qui fournissent des prestations, subventions ou crédits, ain...
L'autorité espagnole de protection des données (AEPD) a sanctionné le ministère de l'Agriculture de Castille-et-León pour ne pas avoir mis en œuvre des mesures de sécurité de base, ce qui a permis l'exfiltration des données de 43 000 propriétaires d'animaux de compagnie par l'usurpation des identifi...
Addressable could be made to consume resources and cause a denial of service if it received specially crafted input.
L'Autorité nationale hongroise pour la protection des données et la liberté d'information (NAIH) clarifie sa position concernant l'utilisation des données personnelles d'enfants à des fins politiques sur les réseaux sociaux.Suite à des informations parues dans la presse, l'autorité rappelle aux orga...