Cybersecurity researchers have disclosed details of yet another maximum-severity security flaw in n8n, a popular workflow automation platform, that allows an unauthenticated remote attacker to gain complete control over susceptible instances.
The vulnerability, tracked as CVE-2026-21858 (CVSS score: 10.0), has been codenamed Ni8mare by Cyera Research Labs. Security researcher Dor Attias has been
En 2025, les tensions mondiales et les conflits géopolitiques ont rythmé l’actualité avec, au premier plan, les affrontements entre Israël et le Hamas, ainsi qu’entre la Russie et l’Ukraine. Ces événements dépassent le terrain physique, s’étendant au champ numérique et créant des risques sans précédent pour les organisations du monde entier. Tribune – Selon le […]
File-sharing platform ownCloud warned users today to enable multi-factor authentication (MFA) to block attackers using compromised credentials from stealing their data. [...]
Veeam released security updates to patch multiple security flaws in its Backup & Replication software, including a critical remote code execution (RCE) vulnerability. [...]
AI, including AI Overviews on Google Search, can hallucinate and often make up stuff or offer contradicting answers when asked in two different ways. [...]
Depuis la capture de Nicolás Maduro par les États-Unis le 3 janvier 2026, une vague de soupçons plane sur Polymarket et les autres plateformes de paris. La cause ? Une mise suspecte effectuée peu avant l’opération américaine. Pour éviter tout délit d’initié, un élu démocrate propose d’interdire aux fonctionnaires de parier s’ils détiennent des « informations non publiques importantes ».
Alors que les entreprises du secteur de l’industrie bloquent davantage de tentatives d’attaques de ransomware, les cyber adversaires optent pour le vol de données, indique une nouvelle étude de Sophos. Tribune. Le secteur de l’industrie a enregistré un taux de chiffrement de 40 % qui reflète l’efficacité accrue de la détection en amont. Pour conserver leur […]
Propulsées par l’IA, les cyberattaques sont toujours plus rapides, crédibles, automatisées et difficiles à détecter. La cybersécurité entre dans une nouvelle ère où les cybermenaces évoluent plus vite que jamais et où les modèles de protection traditionnels ne suffisent plus. Dans son livre blanc CyberSecurity Masterclass 2025, Getronics dévoile six réalités incontournables que les entreprises […]
Security teams are still catching malware. The problem is what they're not catching.
More attacks today don't arrive as files. They don't drop binaries. They don't trigger classic alerts. Instead, they run quietly through tools that already exist inside the environment — scripts, remote access, browsers, and developer workflows.
That shift is creating a blind spot.
Join us for a deep-dive
Open-source workflow automation platform n8n has warned of a maximum-severity security flaw that, if successfully exploited, could result in authenticated remote code execution (RCE).
The vulnerability, which has been assigned the CVE identifier CVE-2026-21877, is rated 10.0 on the CVSS scoring system.
"Under certain conditions, an authenticated user may be able to cause untrusted code to be
Non-human employees are becoming the future of cybersecurity, and enterprises need to prepare accordingly. As organizations scale Artificial Intelligence (AI) and cloud automation, there is exponential growth in Non-Human Identities (NHIs), including bots, AI agents, service accounts and automation scripts. In fact, 51% of respondents in ConductorOne’s 2025 Future of Identity Security Report
Veeam has released security updates to address multiple flaws in its Backup & Replication software, including a "critical" issue that could result in remote code execution (RCE).
The vulnerability, tracked as CVE-2025-59470, carries a CVSS score of 9.0.
"This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as the postgres user by sending a malicious
Threat actors engaging in phishing attacks are exploiting routing scenarios and misconfigured spoof protections to impersonate organizations' domains and distribute emails that appear as if they have been sent internally.
"Threat actors have leveraged this vector to deliver a wide variety of phishing messages related to various phishing-as-a-service (PhaaS) platforms such as Tycoon 2FA," the
The United Kingdom has announced a new cybersecurity strategy, backed by more than £210 million ($283 million), to boost cyber defenses across government departments and the wider public sector. [...]
Multiple reports suggest that OpenAI is going ahead with its plans to add ads to ChatGPT, but the experiment will be initially limited to its employees. [...]
A newly discovered critical security flaw in legacy D-Link DSL gateway routers has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2026-0625 (CVSS score: 9.3), concerns a case of command injection in the "dnscfg.cgi" endpoint that arises as a result of improper sanitization of user-supplied DNS configuration parameters.
"An unauthenticated remote attacker can inject
Cybersecurity researchers have discovered two new malicious extensions on the Chrome Web Store that are designed to exfiltrate OpenAI ChatGPT and DeepSeek conversations alongside browsing data to servers under the attackers' control.
The names of the extensions, which collectively have over 900,000 users, are below -
Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI (ID:
The CERT Coordination Center (CERT/CC) has disclosed details of an unpatched security flaw impacting TOTOLINK EX200 wireless range extender that could allow a remote authenticated attacker to gain full control of the device.
The flaw, CVE-2025-65606 (CVSS score: N/A), has been characterized as a flaw in the firmware-upload error-handling logic, which could cause the device to inadvertently start
Dans un article de blog publié le 5 janvier 2026, les chercheurs de l’entreprise de cybersécurité Securonix mettent en lumière une nouvelle campagne cybercriminelle visant en particulier les établissements hôteliers européens. Baptisée PHALT#BLYX, cette opération dissimule son piège derrière un faux écran bleu de la mort de Windows.
Connexion
