Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
GitLab flaw CVE-2026-19478 is now under active exploitation, allowing unauthenticated attackers to modify or delete public projects.
← Thèmes
🛡️
Cybersécurité
Menaces, vulnérabilités, incidents et bonnes pratiques en sécurité informatique.
1347 articles
S’abonner (RSS)📡 Cybersécurité : 14 actualités majeures du 16 août 2026 (dont Apple) L'essentiel de la semaine...
Apple a corrigé en urgence une faille critique de macOS… mais des pirates se sont mis à exploiter la vulnérabilité pour lancer des cyberattaques. Le Centre national de cybersécurité des Pays-Bas vient de confirmer que cette vulnérabilité a bien été activement exploitée par des cybercriminels. Des pirates s'en servent pour installer un logiciel de minage de cryptomonnaie sur la machine.
Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
Researchers found that by combining two vulnerabilities, they could take over an Android device by delivering a payload and getting the victim to answer their phone.
Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware
Three testing models with the same goal but different directives engaged in "increasingly aggressive" territorial attacks on one another, according to Anthropic.
📡 OFCS : un quiz pour apprendre à repérer les images IA Publié le 11 août 2026, le quiz de l’Of...
semaine du 19 août 2026.
Fortune 500 Companies Hit in Azure Data Theft Campaign
A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials.
New Evooo1Bot Linux botnet turns routers into traffic relay nodes
Evooo1Bot is a Mirai-based Linux botnet that hijacks routers and IoT devices for DDoS attacks, credential theft and criminal proxy services.
Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure.
APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis found PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2
Nouveau dérapage de l’IA : un assistant a franchi une ligne rouge après une demande anodine
📡 OpenClaw détourne une API de liste d’attente de salle de sport Un agent OpenClaw sur Claude a exploité une API de réservation sans contrôle d’autorisation, éjecte un inscrit et illustre le risque des agents IA.
SafePal data breach impacts 39,798 customers, stolen info for sale
SafePal says an order-tracking flaw exposed personal and shipping data for 39,798 customers, but not wallet credentials or financial data.
Large-scale DDoS attacks disrupted Threema secure messaging service
Large DDoS attacks disrupted Threema, causing severe communication outages. Threema On-Prem users were unaffected by the attacks.
CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts
A recent report claims ransomware attacks on K-12 are down for the first half of 2026, while another news story’s headline today claims schools are becoming a new cybersecurity battleground. New? We don’t think it’s new. But the education sector has long been characterized as providing low-hangin...
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
Hackers are exploiting a patched macOS Screen Sharing bug to gain root access and install Monero cryptominers.
Hackers Exploiting Unpatched GeoServer Zero-Day
GeoServer faces an unpatched zero-day enabling SQL injection and potentially RCE, with attackers already probing exposed systems.
Boeing 737 - 60 secondes pour hacker l'avion
Une équipe de l’Université de Californie à San Diego et de l’Oberlin College, dans l’Ohio, a conçu un implant capable de manipuler certains systèmes d’un Boeing 737, révèle une enquête de WIRED. Minuscule et peu coûteux, le dispositif nécessite néanmoins un accès physique à l’avion et une expertise considérable. Il
Hackers arrested over €30M bank fraud exploiting service provider flaw
Police in Germany and Brazil dismantled a €30 million bank fraud ring, arresting four in Brazil and three more in Spain and Bulgaria.
Trump enrôle le secteur privé pour les missions de cybersécurité des États-Unis
Donald Trump a signé un mémorandum qui autorise des entreprises privées américaines à mener des cyberattaques contre des groupes criminels étrangers, sous le contrôle du gouvernement fédéral.
France investigates tax authority breach after hacker claims 600,000 victims
France’s tax authority says a data breach exposed tax and business information belonging to 678,000 people and professionals.
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
Hackers started exploiting a critical vulnerability in SAP Commerce Cloud just three days after its public disclosure.
Android malware combo takes out loans and relays victims' credit cards
Group-IB discovered WindRelay, a new Android malware built to capture live payment card data over NFC and relay it to attackers in real time.
RingCentral - 1,596,490 breached accounts
The ShinyHunters extortion group stole personal information from 1.6 million RingCentral accounts after hacking the company in July, according to the data breach notification service Have I Been Pwned.
AWS Certificate Manager will discontinue email validation to prove domain validation for certific...
AWS Certificate Manager will stop renewing email-validated certificates in September 2027. Customers should migrate to DNS validation.
Trezor discloses data breach affecting nearly 14,000 customers
Hackers stole the names, addresses, emails, and phone numbers of nearly 14,000 Trezor customers from ShipMonk.a