Chaos dans les aéroports russes ce lundi 28 juillet : la compagnie nationale Aeroflot a été contrainte d’annuler et de reprogrammer plus d’une cinquantaine de vols. La raison ? Une cyberattaque d'une ampleur inédite revendiquée par le groupe de hackers ukrainiens « Silent Crow »

The Tea app data breach has grown into an even larger leak, with the stolen data now shared on hacking forums and a second database discovered that allegedly contains 1.1 million private messages exchanged between the app's members. [...]

A vulnerability in Google's Gemini CLI allowed attackers to silently execute malicious commands and exfiltrate data from developers' computers using allowlisted programs. [...]

Gaming peripherals maker Endgame Gear is warning that malware was hidden in its configuration tool for the OP1w 4k v2 mouse hosted on the official website between June 26 and July 9, 2025. [...]

Attackers could use a recently patched macOS vulnerability to bypass Transparency, Consent, and Control (TCC) security checks and steal sensitive user information, including Apple Intelligence cached data. [...]

Security researcher Bobby Gould has published a blog post demonstrating a complete exploit chain for CVE-2025-20281, an unauthenticated remote code execution vulnerability in Cisco Identity Services Engine (ISE). [...]

CISA warns that threat actors are exploiting a high-severity vulnerability in PaperCut NG/MF print management software, which can allow them to gain remote code execution in cross-site request forgery (CSRF) attacks. [...]

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens and destroy victim systems, Socket said in a report published last week. In addition, 73 repositories

Microsoft has reminded customers today that the last supported editions of Windows 11 22H2 will reach their end of servicing on October 14. [...]

OpenAI's ChatGPT-5 could drop in the coming days, and it could be one of the best models from the Microsoft-backed startup. [...]

France's state-owned defense firm Naval Group is investigating a cyberattack after 1TB of allegedly stolen data was leaked on a hacking forum. [...]

AI companies like OpenAI and Perplexity like to be the "everything company," and OpenAI's latest ChatGPT feature, "Shopping," makes that obvious. [...]

The Internet Archive has become an official U.S. federal depository library, providing online users with access to archived congressional bills, laws, regulations, presidential documents, and other U.S. government documents. [...]

Un hacker affirme détenir des documents sensibles sur Naval Group. Le 26 juillet, il a publié 30 Go de données sur un forum du dark web. Contacté par Numerama, le géant militaire français confirme que les documents proviennent bien de l’entreprise, mais assure qu’aucun n’est classé « secret défense ».

Exposed API documentation is a gift-wrapped roadmap for threat actors. The free Autoswagger tool from Intruder scans for exposed docs and flags endpoints with broken access controls—before attackers find them. [...]

Google Cloud Security vient de publier les conclusions de son nouveau Threat Intelligence Benchmark : « Stop Reacting; Start Anticipating »*, une étude réalisée en partenariat avec Forrester. Les résultats mettent en lumière un écart alarmant entre la visibilité sur les menaces et le niveau de préparation des dirigeants, dans un environnement de cybermenaces en perpétuelle mutation. […]

The post Former pour mieux détecter les cybermenaces first appeared on UnderNews.

Some risks don’t breach the perimeter—they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight. This week, the clearest threats weren’t the loudest—they were the most legitimate-looking. In an environment where identity, trust, and tooling are all interlinked, the strongest attack path is often the one that looks like it belongs. Security teams are

L'application Tea, qui permettait à des femmes de s'échanger des informations sur les hommes qu'elles rencontrent, a été victime d'une fuite de données. Des pièces d'identité et des selfies de vérification des utilisatrices ont été exposés, et dérobées par des hackers.

Picture this: you’ve hardened every laptop in your fleet with real‑time telemetry, rapid isolation, and automated rollback. But the corporate mailbox—the front door for most attackers—is still guarded by what is effectively a 1990s-era filter. This isn't a balanced approach. Email remains a primary vector for breaches, yet we often treat it as a static stream of messages instead of a dynamic,