Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-24858 (CVSS score: 9.4), has been described as an authentication bypass related to FortiOS single sign-on (SSO). The flaw also affects FortiManager and FortiAnalyzer. The company said it's

OpenAI plans to begin rolling out ads on ChatGPT in the United States if you have a free or $8 Go subscription, but the catch is that the ads could be very expensive for advertisers. [...]

Fortinet has confirmed a new, actively exploited critical FortiCloud single sign-on (SSO) authentication bypass vulnerability, tracked as CVE-2026-24858, and says it has mitigated the zero-day attacks by blocking FortiCloud SSO connections from devices running vulnerable firmware versions. [...]

The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard. [...]

Rapport Zscaler ThreatLabz 2026 sur les menaces IA – L’adoption rapide de l’IA crée un fossé critique entre innovation et sécurité, obligeant les organisations à adopter une plateforme de sécurité IA fondée sur le modèle Zero Trust. Principales conclusions de l’étude : L’adoption de l’IA s’accélère plus vite que la supervision des entreprises. Malgré une […]

The post L’activité IA et Machine Learning (ML) bondit de 91 % en un an : des milliers d’organisations exposées, sans cadre de gouvernance first appeared on UnderNews.

Le 28 janvier, les organisations et les citoyens du monde entier célèbrent la Journée de la protection des données. Elle agit comme un rappel général de l’importance de protéger les informations personnelles et de renforcer les mesures de protection des données dans un écosystème de plus en plus numérique. Cette journée souligne que la vie […]

The post Souveraineté et prudence face à l’IA : pourquoi la Journée de la protection des données est plus cruciale que jamais first appeared on UnderNews.

Yubico permet aux entreprises d’accélérer le déploiement à grande échelle de passkeys grâce à un système de commande en libre-service destiné aux employés. L’entreprise annonce l’amélioration des fonctionnalités YubiKey as-a-service avec la commande en libre-service de YubiKey pour les employés, grâce à un nouveau portail client. Tribune — Yubico, une entreprise moderne spécialisée dans la […]

The post Yubico permet aux entreprises d’accélérer le déploiement à grande échelle de passkeys first appeared on UnderNews.

Demain, la journée européenne de la protection des données rappellera l’importance de sécuriser nos données. Mais qu’en est-il de notre capacité à les restaurer après une attaque ? Le baromètre mondial de Cohesity sur la cyber-résilience dresse un état des lieux préoccupant : près d’un tiers des grandes entreprises françaises (27 %) n’ont pas la […]

The post Cyber résilience : Près d’un tiers des grandes entreprises françaises (27 %) n’ont pas la maturité suffisante pour se remettre d’une cyberattaque first appeared on UnderNews.

Meta on Tuesday announced it's adding Strict Account Settings on WhatsApp to secure certain users against advanced cyber attacks because of who they are and what they do. The feature, similar to Lockdown Mode in Apple iOS and Advanced Protection in Android, aims to protect individuals, such as journalists or public-facing figures, from sophisticated spyware by trading some functionality for

Indian government entities have been targeted in two campaigns undertaken by a threat actor that operates in Pakistan using previously undocumented tradecraft. The campaigns have been codenamed Gopher Strike and Sheet Attack by Zscaler ThreatLabz, which identified them in September 2025. "While these campaigns share some similarities with the Pakistan-linked Advanced Persistent Threat (APT)

Multiple threat actors, both state-sponsored and financially motivated, are exploiting the CVE-2025-8088 high-severity vulnerability in WinRAR for initial access and to deliver various malicious payloads. [...]

Nike is investigating what it described as a "potential cyber security incident" after the World Leaks ransomware gang leaked 1.4 TB of files allegedly stolen from the sportswear giant. [...]

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing arbitrary code on the underlying host system. [...]

A Nebraska federal grand jury charged 31 additional defendants for their involvement in an ATM jackpotting operation allegedly orchestrated by members of the Venezuelan gang Tren de Aragua. [...]

Cybersecurity researchers have disclosed details of a new campaign that combines ClickFix-style fake CAPTCHAs with a signed Microsoft Application Virtualization (App-V) script to distribute an information stealer called Amatera. "Instead of launching PowerShell directly, the attacker uses this script to control how execution begins and to avoid more common, easily recognized execution paths,"

Le 23 janvier 2026, Microsoft avouait avoir transmis les clés de déchiffrement de plusieurs PC Windows dans le cadre d'une enquête du FBI. Une collaboration rendue possible grâce aux paramètres par défaut du logiciel de chiffrement BitLocker.

Modern ransomware has shifted from encryption to psychological extortion that exploits fear, liability, and exposure. Flare shows how today's ransomware groups weaponize stolen data and pressure tactics to force payment. [...]

Nonprofit security organization Shadowserver has found over 6,000 SmarterMail servers exposed online and likely vulnerable to attacks exploiting a critical authentication bypass vulnerability. [...]

Cybersecurity teams increasingly want to move beyond looking at threats and vulnerabilities in isolation. It’s not only about what could go wrong (vulnerabilities) or who might attack (threats), but where they intersect in your actual environment to create real, exploitable exposure. Which exposures truly matter? Can attackers exploit them? Are our defenses effective? Continuous Threat Exposure