> TODAY'S SUMMARY (14 articles)
Today's cybersecurity news highlights several significant threats and trends. A major cyberattack on French bank Crédit Mutuel Arkéa resulted in fraudulent transactions totaling $133 million, emphasizing the risks associated with third-party service providers. Scammers are increasingly impersonating trusted brands in fake gift card schemes, collecting personal information from unsuspecting consumers. The rise of IoT vulnerabilities is underscored by recent hacks affecting critical infrastructure, such as blood labs and grocery stores. Additionally, vulnerabilities in SonicWall's SonicOS have been exploited, prompting CISA to add these to its Known Exploited Vulnerabilities catalog. Developers are also reminded of security best practices, as sensitive credentials were found exposed in public GitHub repositories.
|
// AI-powered summary generated at 20:00
Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial access to corporate networks. [...]
Attackers are exploiting the critical Adobe ColdFusion flaw CVE-2026-48282, which allows remote code execution on unpatched servers. Attackers have started exploiting CVE-2026-48282, a maximum-severity vulnerability in Adobe ColdFusion. The flaw is a path traversal issue that could result in arbitra...
Securonix says the sophisticated framework abuses compromised websites, Blogspot, PowerShell, and fileless techniques to evade detection and deploy the PureLog information stealer.
The post Blogspot-Hosted Payloads Delivered in âVeil#Dropâ Attacks appeared first on SecurityWeek.
L'autorité italienne sanctionne une commune pour l'utilisation d'un systÚme de vidéoverbalisation sans information adéquate, sans minimisation des données et sans analyse d'impact préalable.Faits et contexteL'autorité italienne de protection des données (GPDP) a aujourd'hui publié une décision de sa...
Le Comité européen de la protection des données (CEPD) a mis en ligne un formulaire de contact dédié pour permettre aux parties prenantes de signaler les incohérences dans l'interprétation du RGPD en Europe.Cette initiative s'inscrit dans les engagements de la Déclaration d'Helsinki du CEPD sur l'am...
An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations.
The activity, which has primarily singled out IT providers...
L'autorité italienne de protection des données (GPDP) a sanctionné un sous-traitant pour avoir effectué une prospection téléphonique illicite pour le compte d'un fournisseur d'énergie, utilisé un sous-traitant ultérieur sans autorisation et mal géré une demande d'exercice de droits, lui infligeant u...
La Conférence des délégués à la liberté d'information en Allemagne (IFK) s'oppose fermement au projet du gouvernement fédéral visant à restreindre de maniÚre significative la loi sur la liberté d'information.Selon les décisions publiées le 1er juillet 2026, le projet prévoit de conditionner le droit...
âVietnamese authorities have arrested and are prosecuting seven suspects believed to have run HiAnime, the largest anime piracy streaming service before its shutdown in June. [...]
La Commission Nationale de l'Informatique et des LibertĂ©s (CNIL) a publiĂ© un bilan de son activitĂ© de sanction par procĂ©dure simplifiĂ©e pour le premier semestre 2026, rĂ©vĂ©lant 23 nouvelles dĂ©cisions pour un montant total de 133 750 âŹ. Ces sanctions ciblent principalement des manquements rĂ©currents l...
La Commission de protection des informations personnelles (PIPC) sud-coréenne a initié une modification du décret d'application de la loi sur la protection des informations personnelles visant à étendre le droit à la portabilité des données aux secteurs de l'éducation et de l'emploi.Le projet, soumi...
Information like Social Security numbers and health-related data was accessed, but the company said it had âno evidence that impacted information has been publicly posted or exposed on the internet.â
At least two websites appear to be victim to 404 hijacking attacks. Army officials took the sites down after being contacted by CyberScoop.
The post US Army websites defaced with pro-Kurdish sentiments, insults to Trump appeared first on CyberScoop.
Modern LLMs can now crack CAPTCHAs faster than humans. Here is why traditional CAPTCHAs are soon to become history, whatâs replacing them, and what this means for your online security.
A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it.
Dubbed 'Januscape' and tracked as CVE-2026-53359, the flaw sits in the shadow MMU code that KVM shares across both Intel and AMD. The public...
Campaigners demand investigation and long-delayed action on PEGA Committee recommendations
If youâre building multi-agent AI systems, you need to prevent authorization scope from silently expanding as agents delegate tasks through multi-hop chains. Without proper controls, an agent can potentially act beyond what the originating user authorized, even when role-based access control (RBAC)...
The unnamed student, who lives in a city near Tokyo, allegedly exploited a flaw in a subscription-based anime streaming platform to fraudulently cancel more than 46,000 user subscriptions.
Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.
The vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the "X-WEBAUTH-USER" header f...
Scammers are using AI-generated images to make fake stories more convincing. Here's how to separate real from fake.