À lire
Actualité et avis hors périmètre
La presse spécialisée et les avis sur des technologies que nous ne suivons pas, sur 7 jours. Pour information (P4).
- PHP2Shell exploit bypasses protections designed to stop remote code execution
- Capcom confirms data breach affecting 11.7 million accounts
- 2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
- 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
- 2026-012: Critical Vulnerabilities in Check Point Products
- 2026-013: Critical Vulnerability in F5 BIG-IP APM
- 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway
- 2026-015: Critical Vulnerability in Multiple Atlassian Products
- 2026-016: Critical Vulnerability in GitLab CE and EE
- 2026-017: Critical Vulnerability in Cisco Secure Email Gateway
- 2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions
- LiteLLM release pipeline hacked to distribute info-stealer malware
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
- eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
- Frigos de supermarchés piratés : l'Anssi pointe des failles de sécurité élémentaires
- Deux failles critiques dans PHP : les entreprises sous pression
- ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
- Max-severity GitLab bug allows remote code execution over 12 years of releases
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
- Disgraced Indian cert issuer leaves the cert issuing business
- Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
- PHP2Shell puts dozens of UK government services out of service
- Microsoft shares how to fix broken Exchange Online EWS apps
- Cybermalveillance.gouv.fr lance une AlerteCyber concernant deux failles de sécurité critiques dans PHP
- When the attacker becomes the user: Rethinking account takeover
- Körber s'appuie sur les SBOM pour unifier la sécurité de ses logiciels
- Hacker Conversations: Corey Thuen and the Evil Bit
- Machine speed attacks require machine speed detection and response
- INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
- Amazon says PHP2Shell exploitation began 4 days before patches
- Localizing compliance at scale: achieving South Korea’s ISMS certification
- Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
- Signal Vulnerability Lets Malicious Callers Block Hang-Ups
- Tech and Security Companies Respond to PHP2Shell Vulnerabilities
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
- The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
- GitLab warns of new max severity code execution vulnerability
- AlerteCyber : Failles de sécurité critiques dans PHP
- Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
- Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
- Splunk, SolarWinds Release Fresh Security Updates
- OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
- Cisco Patches 34 Vulnerabilities Across Multiple Products
- IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
- PHP2Shell Exploitation Started Days Before Patches
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
- Authorities disrupt nearly 11,000 cybercrime networks in Africa
- Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
- Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
- Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
- New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
- Certification authority eMudhra defends its laughably weak private keys
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
- ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
- Vulnérabilité dans les produits Mozilla
- Multiples vulnérabilités dans les produits SolarWinds
- Multiples vulnérabilités dans GitLab
- Multiples vulnérabilités dans ISC BIND
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
- Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- Lazarus hackers use post-quantum cryptography for malware delivery
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
- LiteLLM supply chain attack hoovers up passwords and secrets
- Arrêtée pour avoir bloqué un robot de livraison Uber
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
- Signal bug could keep your mic - and camera - on after hangup
- Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
- OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
- OpenAI agents disabled safety monitoring, one lied about it
- Widespread PHP Flaw May Cause Many Site Outages Today
- Panne chez Orange et Sosh !
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Musique IA et faux streams : 18 mois de prison
- LibreOffice et OpenOffice piégés par des tableurs
- Claude transmet une fausse piste à la police
- Introducing full transaction detection for Cloudflare WAF
- PHP ships emergency patches for critical PHP2Shell flaws
- ClickFix has never been bigger, and AI tools are its most convincing lure yet
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- Cloudflare deploys protections against php2shell vulnerability
- Nir Peleg, directeur mondial de la sécurité des systèmes d'information chez JFrog : «La gouvernance doit fonctionner à la vitesse des agents »
- Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
- PHP2Shell : deux failles critiques menacent les serveurs web
- Microsoft PowerToys adds CursorHide, Button Lock mouse tools
- China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
- AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers
- Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
- Nvidia picks OpenShell to tame AI gents
- EU wants Booking.com to check out of its scam problem
- PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
- The Harness Is the Hard Part of Agentic Pentesting
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
- Arnaque au bitcoin : un réseau piloté depuis des prisons
- Des arrestations autour d’un SMS blaster
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
- Une ministre française ciblée par un logiciel espion
- Ledger piégés : l’enquête examine plusieurs circuits de distribution
- U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
- State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
- ISC Stormcast For Wednesday, October 21st, 2026 https://isc.sans.edu/podcastdetail/10144, (Wed, Oct 21st)
- Multiples vulnérabilités dans Mattermost Server
- Multiples vulnérabilités dans Google Chrome
- Multiples vulnérabilités dans Oracle Systems
- Multiples vulnérabilités dans Oracle Java SE
- Multiples vulnérabilités dans Oracle Database Server
- Multiples vulnérabilités dans les produits StormShield
- Vulnérabilité dans Traefik
- Multiples vulnérabilités dans les produits Mozilla
- Multiples vulnérabilités dans Apache Tomcat
- Multiples vulnérabilités dans Oracle Virtualization
- Multiples vulnérabilités dans Oracle Weblogic
- Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’