A new critical security vulnerability has been disclosed in n8n, an open-source workflow automation platform, that could enable an authenticated attacker to execute arbitrary system commands on the underlying host.
The vulnerability, tracked as CVE-2025-68668, is rated 9.9 on the CVSS scoring system. It has been described as a case of a protection mechanism failure.
It affects n8n versions from
Users of the "@adonisjs/bodyparser" npm package are being advised to update to the latest version following the disclosure of a critical security vulnerability that, if successfully exploited, could allow a remote attacker to write arbitrary files on the server.
Tracked as CVE-2026-21440 (CVSS score: 9.2), the flaw has been described as a path traversal issue affecting the AdonisJS multipart
The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives.
"This organization has continued to conduct high-intensity intelligence gathering activities against Ukrainian military and government departments in 2025," the 360 Threat Intelligence Center said in
The botnet known as Kimwolf has infected more than 2 million Android devices by tunneling through residential proxy networks, according to findings from Synthient.
"Key actors involved in the Kimwolf botnet are observed monetizing the botnet through app installs, selling residential proxy bandwidth, and selling its DDoS functionality," the company said in an analysis published last week.
Kimwolf
Cet article a été réalisé en collaboration avec Bitdefender
Et si vous débutiez 2026 en disant stop aux arnaques en ligne ? Voici comment y parvenir facilement grâce à l’IA et à de bons outils (gratuits, pour certains).
Cet article a été réalisé en collaboration avec Bitdefender
Il s’agit d’un contenu créé par des rédacteurs indépendants au sein de l’entité Humanoid xp. L’équipe éditoriale de Numerama n’a pas participé à sa création. Nous nous engageons auprès de nos lecteurs pour que ces contenus soient intéressants, qualitatifs et correspondent à leurs intérêts.
En narguant Washington par des chorégraphies électriques sur les dernières semaines de 2025, le président vénézuélien Nicolás Maduro a transformé un ultimatum diplomatique - celui de quitter le pouvoir - en une intervention militaire américaine éclair, le 3 janvier. Ce lundi, c'est menotté, mais toujours provocateur, qu'il doit comparaître à New York pour narcoterrorisme.
A threat actor known as Zestix has been offering to corporate data stolen from dozens of companies likely after breaching their ShareFile, Nextcloud, and OwnCloud instances. [...]
A new ClickFix social engineering campaign is targeting the hospitality sector in Europe, using fake Windows Blue Screen of Death (BSOD) screens to trick users into manually compiling and executing malware on their systems. [...]
Brightspeed, one of the largest fiber broadband companies in the United States, is investigating security breach and data theft claims made by the Crimson Collective extortion gang. [...]
Popular AI-powered integrated development environment solutions, such as Cursor, Windsurf, Google Antigravity, and Trae, recommend extensions that are non-existent in the OpenVSX registry, allowing threat actors to claim the namespace and upload malicious extensions. [...]
Global-e, prestataire e-commerce de Ledger, a été victime d’une intrusion informatique, ayant entraîné la fuite de données personnelles de certains clients de la marque de portefeuilles matériels pour crypto-monnaies. Quelles sont les données concernées ? Quels risques pour les personnes touchées ?
Ledger is informing some customers that their personal data has been exposed after hackers breached the systems of third-party payment processor Global-e. [...]
As agentic AI adoption accelerates, identity is emerging as the primary security challenge. Token Security explains why AI agents behave like a new class of identity and why CISOs must manage their access, lifecycle, and risk. [...]
The year opened without a reset. The same pressure carried over, and in some places it tightened. Systems people assume are boring or stable are showing up in the wrong places. Attacks moved quietly, reused familiar paths, and kept working longer than anyone wants to admit.
This week’s stories share one pattern. Nothing flashy. No single moment. Just steady abuse of trust — updates, extensions,
NordVPN denied allegations that its internal Salesforce development servers were breached, saying that cybercriminals obtained "dummy data" from a trial account on a third-party automated testing platform. [...]
Featuring:
Cybersecurity is being reshaped by forces that extend beyond individual threats or tools. As organizations operate across cloud infrastructure, distributed endpoints, and complex supply chains, security has shifted from a collection of point solutions to a question of architecture, trust, and execution speed.
This report examines how core areas of cybersecurity are evolving in
Depuis le 4 janvier 2025, un hacker affirme sur un forum du dark web détenir des données sensibles appartenant au géant des fournisseurs de réseaux privés virtuels, NordVPN. Contactée par Numerama, l’entreprise dément formellement toute intrusion et dévoile les conclusions de son enquête.
L’armée américaine ouvre un nouveau cursus pour former des officiers spécialistes de l’IA et du machine learning, officiellement réunis sous l’appellation 49B AI/ML Officer. Objectif affiché : transformer l’US Army en force « data‑centrée », capable de mieux tirer parti de l’écosystème d’outils d’IA déjà déployés sur le terrain.
Le nouveau chapitre du Kaspersky Security Bulletin analyse l’impact potentiel de l’Intelligence Artificielle (IA) sur le secteur mondial du divertissement en 2026. L’étude couvre divers aspects, allant des systèmes de billetterie et pipelines VFX aux réseaux de diffusion de contenu (CDN), en passant par le secteur du jeu et les enjeux réglementaires. Tribune – L’IA […]
Connexion
