Administradores de ambientes virtualizados com XenServer 8.4 e XenServer 9 devem ficar atentos a quatro correções divulgadas pela Citrix. Três delas abrem caminho para que alguém já privilegiado dentro de uma máquina virtual afete o servidor que hospeda esse ambiente, seja compro…
A Proofpoint anunciou um acordo definitivo para adquirir a Varonis em uma transação em dinheiro avaliada em aproximadamente US$ 6,3 bilhões, embora o valor tivesse sido anunciado como US$ 5,9 bilhões no final do mês passado. A Varonis era uma das empresas do portfólio da Thoma Br…
Uma nova versão do Curl foi publicada com a correção de mais de vinte vulnerabilidades, incluindo uma falha de execução remota de código (RCE) encontrada pela empresa de inteligência artificial Anthropic. Apesar de permitir execução remota de código, o impacto da CVE-2026-92392 f…
A adoção de agentes de inteligência artificial capazes de consultar documentos, acessar aplicações, alcançar dados, usar credenciais, chamar APIs e executar tarefas exige que instituições financeiras ampliem controles de identidade, monitoramento e resposta a incidentes. Segundo …
Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.
The incident is likely 1st confirmation of mercenary spyware delivered by targeted ads.
Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and…
Equipes bem treinadas são o pilar do sistema de segurança cibernética de qualquer empresa, mas muitos programas de conscientização se limitam a simulações periódicas de phishing por e-mail e treinamentos anuais de poucos minutos. Enquanto isso, criminosos desenvolvem abordagens c…
Uma campanha de proxyjacking atingiu dispositivos em 34 países e monetizou conexões de internet das vítimas por meio de uma rede comercial de proxies residenciais. O operador instalou o Pawns.app, aplicativo legítimo de compartilhamento de banda que permite a usuários ganhar dinh…
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted…
By Jody Buchman - The core message across nearly every event this year centers on data integrity, foundational infrastructure, and sustained organizational capacity. For software to perform reliably and for care quality to remain high, health systems must establish an accurate da…
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
Cybersecurity Is Patient Safety: EHR Association Privacy & Security Workgroup Marks Cybersecurity Awareness Month - The EHR Association’s Privacy & Security Workgroup issued the following statement to mark Cybersecurity Awareness Month (October). The post Cybersecurity Awareness …
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
Staffing For Doctors Launches Medical Virtual Staffing Marketplace 01net
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the mome…
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that ma…
