Vue normale

Il y a de nouveaux articles disponibles, cliquez pour rafraîchir la page.
Aujourd’hui — 13 janvier 2026Securité

Le réseau interne, angle mort du Zero Trust

Par : UnderNews
13 janvier 2026 à 14:52

Le principe du Zero Trust semble limpide : ne jamais faire confiance, toujours vérifier. Ce modèle s’est imposé comme un standard de sécurité pour les organisations modernes. Mais dans la réalité du terrain, il s’arrête trop tôt : encore trop souvent réduit à sa seule dimension d’accès distant, il s’efface dès qu’on franchit le périmètre […]

The post Le réseau interne, angle mort du Zero Trust first appeared on UnderNews.

[Webinar] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl

AI agents are no longer just writing code. They are executing it. Tools like Copilot, Claude Code, and Codex can now build, test, and deploy software end-to-end in minutes. That speed is reshaping engineering—but it’s also creating a security gap most teams don’t see until something breaks. Behind every agentic workflow sits a layer few organizations are actively securing: Machine Control

Target employees confirm leaked code after 'accelerated' Git lockdown

Par : Ax Sharma
13 janvier 2026 à 14:08
Multiple current and former Target employees confirmed that leaked source code samples posted by a threat actor match real internal systems. The company also rolled out an "accelerated" lockdown of its Git server, requiring VPN access, a day after being contacted by BleepingComputer. [...]

L’IA du Pentagone « ne sera pas woke », Grok intègre officiellement le réseau de l’armée américaine

13 janvier 2026 à 14:40

Le 12 janvier 2026, le secrétaire à la Défense Pete Hegseth a annoncé l’intégration imminente de Grok à la plateforme interne d’intelligence artificielle générative du Pentagone, GenAI.mil. Cette décision concrétise un accord de 200 millions de dollars conclu entre le Département de la Défense et xAI, la société fondée par Elon Musk et à l’origine du chatbot.

New Advanced Linux VoidLink Malware Targets Cloud and container Environments

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native Linux malware framework comprises an array of custom loaders, implants, rootkits, and modular

What Should We Learn From How Attackers Leveraged AI in 2025?

Old Playbook, New Scale: While defenders are chasing trends, attackers are optimizing the basics The security industry loves talking about "new" threats. AI-powered attacks. Quantum-resistant encryption. Zero-trust architectures. But looking around, it seems like the most effective attacks in 2025 are pretty much the same as they were in 2015. Attackers are exploiting the same entry points that

ServiceNow Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation

ServiceNow has disclosed details of a now-patched critical security flaw impacting its ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform arbitrary actions as that user. The vulnerability, tracked as CVE-2025-12420, carries a CVSS score of 9.3 out of 10.0 "This issue [...] could enable an unauthenticated user to impersonate another user and

L’Iran a‑t‑il trouvé l’arme pour faire taire Starlink ? La piste russe autour des systèmes brouillage du régime

13 janvier 2026 à 10:41

Depuis près d’une semaine, le régime iranien impose à sa population une coupure quasi totale d’Internet afin de contenir un mouvement de protestation sans précédent. En réponse, Elon Musk avait proposé aux Iraniens d’utiliser Starlink pour contourner ce black-out numérique, mais le système de connexion par satellite du milliardaire semble lui aussi perturbé par les dispositifs de brouillage du régime.

New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. "The infection chain follows a tightly orchestrated execution path: an obfuscated VBS launcher executed via wscript.exe invokes a

CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw impacting Gogs by adding it to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2025-8110 (CVSS score: 8.7), relates to a case of path traversal in the repository file editor that could result in code execution. "Gogs Path

Hier — 12 janvier 2026Securité

n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens

Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers' OAuth credentials. One such package, named "n8n-nodes-hfgjf-irtuinvcm-lasdqewriit," mimics a Google Ads integration, and prompts users to link their advertising account in a seemingly legitimate form and then

Piratage de la Fédération Française de Tennis : que risquent concrètement les licenciés ?

12 janvier 2026 à 18:25

Le 12 janvier 2026, la fédération française de tennis a annoncé avoir été la cible d’un « acte de cyber-malveillance ». Des informations personnelles des licenciés ont pu être consultées : voici ce que cela implique pour les concernés.

Target's dev server offline after hackers claim to steal source code

Par : Ax Sharma
12 janvier 2026 à 18:52
Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. After BleepingComputer notified Target, the files were taken offline and the retailer's developer Git server was inaccessible. [...]
❌
❌