IBM urged customers to patch a critical authentication bypass vulnerability in its API Connect enterprise platform that could allow attackers to access apps remotely. [...]

Disney has agreed to pay a $10 million civil penalty to settle claims that it violated the Children's Online Privacy Protection Act by mislabeling videos and allowing data collection for targeted advertising. [...]

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on Tuesday removed three individuals linked to the Intellexa Consortium, the holding company behind a commercial spyware known as Predator, from the specially designated nationals list. The names of the individuals are as follows - Merom Harpaz Andrea Nicola Constantino Hermes Gambazzi Sara Aleksandra Fayssal Hamou

A new cybercrime tool called ErrTraffic allows threat actors to automate ClickFix attacks by generating 'fake glitches' on compromised websites to lure users into downloading payloads or following malicious instructions [...]

As 2025 draws to a close, Tony looks back at the cybersecurity stories that stood out both in December and across the whole of this year

The European Space Agency (ESA) confirmed that attackers recently breached servers outside its corporate network, which contained what it described as "unclassified" information on collaborative engineering activities. [...]

A newly discovered campaign, which researchers call Zoom Stealer, is affecting 2.2 million Chrome, Firefox, and Microsoft Edge users through 18 extensions that collect online meeting-related data like URLs, IDs, topics, descriptions, and embedded passwords. [...]

Two former employees of cybersecurity incident response companies Sygnia and DigitalMint have pleaded guilty to targeting U.S. companies in BlackCat (ALPHV) ransomware attacks in 2023. [...]

CISA ordered U.S. federal agencies to patch an actively exploited MongoDB vulnerability (MongoBleed) that can be exploited to steal credentials, API keys, and other sensitive data. [...]

Le groupe américain Meta vient d’annoncer le rachat de Manus, une startup fondée en Chine et spécialisée dans le pilotage d’agents d’IA généralistes. Si les spéculations autour du montant de la transaction font les gros titres, cette acquisition en dit long sur les ambitions de la société de Mark Zuckerberg, mais aussi sur l’orientation prise par l’industrie de l’IA dans son ensemble. On en a discuté avec le chatbot qui, précisément, n’a pas pour vocation à bavarder.

Le 30 décembre 2025, l'Agence Spatiale Européenne (ESA) a annoncé avoir été informée d'un incident de cybersécurité affectant des serveurs situés hors de son réseau. Peu d'informations ont été communiquées sur les causes de cet incident, l'enquête est toujours en cours.

Le 27 décembre 2025, Sam Altman, patron d’OpenAI, maison mère de ChatGPT, a profité de son audience sur X pour partager une fiche de poste visiblement cruciale à ses yeux. L’entreprise cherche à recruter son prochain Chef de la préparation aux situations d’urgence. Un poste stratégique, très bien payé qui a déjà connu un turnover impressionnant au sein de l’organisation.

The Cyber Security Agency of Singapore (CSA) has issued a bulletin warning of a maximum-severity security flaw in SmarterTools SmarterMail email software that could be exploited to achieve remote code execution. The vulnerability, tracked as CVE-2025-52691, carries a CVSS score of 10.0. It relates to a case of arbitrary file upload that could enable code execution without requiring any

The threat actor known as Silver Fox has turned its focus to India, using income tax-themed lures in phishing campaigns to distribute a modular remote access trojan called ValleyRAT (aka Winos 4.0). "This sophisticated attack leverages a complex kill chain involving DLL hijacking and the modular Valley RAT to ensure persistence," CloudSEK researchers Prajwal Awasthi and Koushik Pal said in an

Selon le média américain Insider Gaming, Sony envisagerait de repousser la sortie de la future PlayStation 6 pour éviter de lancer sa console en pleine crise mondiale de la RAM qui frappe l’ensemble de l’industrie technologique. Un cas concret, très parlant pour le grand public, qui illustre les conséquences de cette pénurie de mémoire vive alimentée par le boom de l’IA.

Artificial intelligence (AI) is making its way into security operations quickly, but many practitioners are still struggling to turn early experimentation into consistent operational value. This is because SOCs are adopting AI without an intentional approach to operational integration. Some teams treat it as a shortcut for broken processes. Others attempt to apply machine learning to problems

A new sample of the ToneShell backdoor, typically seen in Chinese cyberespionage campaigns, has been delivered through a kernel-mode loader in attacks against government organizations. [...]

Coupang, the largest retailer in South Korea, announced $1.17 billion (1.685 trillion Won) total compensation for the 33.7 million customers whose information was exposed in the data breach discovered last month. [...]

A Lithuanian national has been arrested for his alleged involvement in infecting 2.8 million systems with clipboard-stealing malware disguised as the KMSAuto tool for illegally activating Windows and Office software. [...]