Le principe du Zero Trust semble limpide : ne jamais faire confiance, toujours vérifier. Ce modèle s’est imposé comme un standard de sécurité pour les organisations modernes. Mais dans la réalité du terrain, il s’arrête trop tôt : encore trop souvent réduit à sa seule dimension d’accès distant, il s’efface dès qu’on franchit le périmètre […]

The post Le réseau interne, angle mort du Zero Trust first appeared on UnderNews.

AI agents are no longer just writing code. They are executing it. Tools like Copilot, Claude Code, and Codex can now build, test, and deploy software end-to-end in minutes. That speed is reshaping engineering—but it’s also creating a security gap most teams don’t see until something breaks. Behind every agentic workflow sits a layer few organizations are actively securing: Machine Control

Multiple current and former Target employees confirmed that leaked source code samples posted by a threat actor match real internal systems. The company also rolled out an "accelerated" lockdown of its Git server, requiring VPN access, a day after being contacted by BleepingComputer. [...]

Le 12 janvier 2026, le secrétaire à la Défense Pete Hegseth a annoncé l’intégration imminente de Grok à la plateforme interne d’intelligence artificielle générative du Pentagone, GenAI.mil. Cette décision concrétise un accord de 200 millions de dollars conclu entre le Département de la Défense et xAI, la société fondée par Elon Musk et à l’origine du chatbot.

Cybersecurity researchers have disclosed details of a previously undocumented and feature-rich malware framework codenamed VoidLink that's specifically designed for long-term, stealthy access to Linux-based cloud environments According to a new report from Check Point Research, the cloud-native Linux malware framework comprises an array of custom loaders, implants, rootkits, and modular

Old Playbook, New Scale: While defenders are chasing trends, attackers are optimizing the basics The security industry loves talking about "new" threats. AI-powered attacks. Quantum-resistant encryption. Zero-trust architectures. But looking around, it seems like the most effective attacks in 2025 are pretty much the same as they were in 2015. Attackers are exploiting the same entry points that

ServiceNow has disclosed details of a now-patched critical security flaw impacting its ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform arbitrary actions as that user. The vulnerability, tracked as CVE-2025-12420, carries a CVSS score of 9.3 out of 10.0 "This issue [...] could enable an unauthenticated user to impersonate another user and

Vous aviez Lydia avant la migration vers Sumeria ? Attention, la plateforme va commencer à facturer 3 € par mois aux comptes inactifs. Un détail facile à rater… mais qui peut coûter.

Depuis près d’une semaine, le régime iranien impose à sa population une coupure quasi totale d’Internet afin de contenir un mouvement de protestation sans précédent. En réponse, Elon Musk avait proposé aux Iraniens d’utiliser Starlink pour contourner ce black-out numérique, mais le système de connexion par satellite du milliardaire semble lui aussi perturbé par les dispositifs de brouillage du régime.

Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOW#REACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. "The infection chain follows a tightly orchestrated execution path: an obfuscated VBS launcher executed via wscript.exe invokes a

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a high-severity security flaw impacting Gogs by adding it to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, tracked as CVE-2025-8110 (CVSS score: 8.7), relates to a case of path traversal in the repository file editor that could result in code execution. "Gogs Path

The Amsterdam Court of Appeal sentenced a 44-year-old Dutch national to seven years in prison for multiple crimes, including computer hacking and attempted extortion. [...]

Hackers over the past six months have relied increasingly more on the browser-in-the-browser (BitB) method to trick users into providing Facebook account credentials. [...]

CISA has ordered government agencies to secure their systems against a high-severity Gogs vulnerability that was exploited in zero-day attacks. [...]

Apex Legends players over the weekend experienced disruptions during live matches as threat actors hijacked their characters, disconnected them, and changed their nicknames. [...]

​University of Hawaii says a ransomware gang breached its Cancer Center in August 2025, stealing data of study participants, including documents from the 1990s containing Social Security numbers. [...]

Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers' OAuth credentials. One such package, named "n8n-nodes-hfgjf-irtuinvcm-lasdqewriit," mimics a Google Ads integration, and prompts users to link their advertising account in a seemingly legitimate form and then

Le 12 janvier 2026, la fédération française de tennis a annoncé avoir été la cible d’un « acte de cyber-malveillance ». Des informations personnelles des licenciés ont pu être consultées : voici ce que cela implique pour les concernés.

Hackers are claiming to be selling internal source code belonging to Target Corporation, after publishing what appears to be a sample of stolen code repositories on a public software development platform. After BleepingComputer notified Target, the files were taken offline and the retailer's developer Git server was inaccessible. [...]