The European Union has proposed a new cybersecurity law aimed at banning high-risk suppliers from providing equipment for sensitive infrastructure. Although no specific companies were named, this initiative empowers the European Commission to conduct risk assessments and impose restrictions or outright bans on certain technologies deemed insecure. This move is part of a broader effort to bolster the EU's cybersecurity framework and protect critical infrastructure from potential threats. The implications of this legislation could significantly impact suppliers and manufacturers of technology within the EU, as they may need to comply with stricter regulations to operate in the market. The proposal emphasizes the importance of ensuring that critical systems are safeguarded against vulnerabilities that could be exploited by malicious actors.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
Microsoft has issued a temporary workaround for users experiencing freezes in Outlook after applying the latest Windows security updates. This issue has affected many customers who rely on Outlook for their email and daily tasks, causing disruptions and frustration. The freezes appear to be linked to the recent updates, prompting Microsoft to step in with a solution while they work on a permanent fix. Users are advised to implement the provided workaround to mitigate the impact on their productivity. This situation serves as a reminder of how software updates, while important for security, can sometimes lead to unexpected problems.
Cloudflare recently addressed a vulnerability in its ACME validation logic that could allow attackers to bypass security measures and access protected origin servers. The flaw was linked to how Cloudflare's edge servers processed requests directed at the /.well-known/acme-challenge/ path. If exploited, this could potentially grant unauthorized access to sensitive data or services hosted on those servers. The fix is crucial for organizations relying on Cloudflare for security, as it strengthens the integrity of their server access protocols. Users and administrators should ensure their systems are updated to mitigate any risks associated with this vulnerability.
A loan phishing scam in Peru is targeting individuals by mimicking legitimate financial institutions. Attackers create fake applications that trick users into providing sensitive information, including credit card details and personal identification numbers (PINs). This scam has raised concerns as it exploits the growing demand for loans, especially among those seeking financial assistance. Victims are at risk of identity theft and financial loss, making it crucial for users to be vigilant about the applications they download and the information they share. Authorities urge the public to verify the authenticity of loan offers and report suspicious activities to prevent further exploitation.
Phishing attacks are becoming more sophisticated and harder to detect, focusing on exploiting human emotions and timing rather than just careless users. Researchers from Flare have revealed that modern phishing tactics have evolved into industrialized operations, making them scalable and more challenging for individuals to recognize. This shift highlights the need for users to be more vigilant and educated about potential scams. Phishing can lead to severe consequences, including financial loss and data breaches, affecting both individuals and organizations. As these tactics grow in complexity, it's crucial for everyone to understand the risks and recognize the signs of phishing attempts.
Help Net Security
The European Commission has proposed a new cybersecurity package aimed at enhancing the EU's cyber resilience. This includes a revised EU Cybersecurity Act that focuses on securing information and communications technology (ICT) supply chains. The new framework adopts a risk-based approach to ensure that products reaching EU consumers are secure from the start. This move is significant as it seeks to protect both consumers and businesses from potential cyber threats by streamlining the certification process for ICT products. The changes reflect growing concerns over the security of technology supply chains in an increasingly digital world.
Hackers are taking advantage of poorly configured web applications that are designed for security training and testing, such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP. These applications are being used as gateways to access the cloud environments of various Fortune 500 companies and security vendors. The attackers exploit these misconfigurations to infiltrate systems that should ideally serve as safe environments for testing security measures. This situation raises serious concerns for companies that rely on these tools for internal security practices, as it exposes them to potential data breaches and unauthorized access. Organizations need to ensure that their security testing applications are correctly configured to prevent exploitation by malicious actors.
GitLab has issued a security patch for a serious vulnerability that allows attackers to bypass two-factor authentication (2FA) in both its community and enterprise editions. This flaw could potentially give unauthorized users access to sensitive accounts if exploited. Additionally, GitLab addressed issues related to denial-of-service (DoS) attacks, which could disrupt services for legitimate users. The company advises all users to update their systems promptly to mitigate these risks. This situation emphasizes the importance of keeping software up to date to protect against emerging threats.
Hackread – Cybersecurity News, Data Breaches, AI, and More
A recent study has uncovered that 64% of third-party applications are accessing sensitive user data without proper authorization. This alarming statistic raises concerns about data privacy and security, particularly for users who may unknowingly grant permissions to these applications. The research suggests that many apps do not have adequate safeguards in place to protect sensitive information, which could lead to unauthorized data exposure. This issue affects a wide range of applications across various platforms and industries, putting personal and organizational data at risk. Users and companies must be more vigilant about the permissions they grant to third-party apps to safeguard their sensitive information.
North Korean hackers are targeting macOS developers by luring them to malicious projects on GitHub and GitLab that are opened with Visual Studio Code. The attackers use these repositories to trick users into executing harmful code, potentially compromising their systems. This tactic poses a significant risk to developers who may unknowingly download and run these malicious projects, which could lead to data breaches or further exploitation of their systems. As these attacks exploit popular development tools, developers need to be vigilant about the sources of the projects they access. This incident emphasizes the ongoing threat posed by state-sponsored hackers and the need for heightened awareness in the software development community.
Security researchers successfully exploited Tesla's Infotainment System during the Pwn2Own Automotive 2026 competition, demonstrating 37 zero-day vulnerabilities on the first day. They earned a total of $516,500 for their exploits, which showcase significant flaws in the system. This incident raises concerns about the security of Tesla vehicles and the potential risks they pose to users. As more vehicles become connected, the implications of such vulnerabilities could extend beyond just infotainment systems, affecting critical vehicle functions and user safety. Companies like Tesla need to prioritize addressing these vulnerabilities to protect their customers and maintain trust in their technology.
MITRE has introduced the Embedded Systems Threat Matrix (ESTM), a new framework designed to enhance the security of critical embedded systems. This initiative aims to assist organizations in identifying and mitigating potential threats that target their embedded devices, which are increasingly integral to various industries, from automotive to healthcare. By providing a structured approach to understanding vulnerabilities and attack vectors, the ESTM seeks to bolster defenses against cyber threats that could compromise the functionality and safety of these systems. This development is particularly relevant as the reliance on embedded technology continues to grow, making it essential for companies to adopt better security practices. The framework is expected to serve as a valuable resource for organizations looking to strengthen their cybersecurity measures in this area.
Hackread – Cybersecurity News, Data Breaches, AI, and More
A security lapse at a Carlsberg exhibition exposed attendees' personal information due to a poorly secured wristband system. This system allowed unauthorized access to sensitive data, such as visitor photos, videos, and full names. Despite attempts by a researcher to report the vulnerability, their concerns were ignored for several months, raising questions about the company's response to security issues. The incident underscores the need for better data protection practices, especially at public events where personal information is collected. This breach not only affects the individuals whose data was exposed but also damages Carlsberg's reputation as a secure event organizer.
In January 2026, Oracle released its first Critical Patch Update (CPU) of the year, addressing approximately 230 unique vulnerabilities across over 30 of its products. This update includes a total of 337 new security patches, which users are encouraged to apply to protect their systems. These vulnerabilities could potentially expose systems to various security risks, making it crucial for affected organizations to implement the patches promptly. The update reflects Oracle's ongoing commitment to security, as it aims to mitigate risks associated with its software products. Users and administrators should ensure they are running the latest versions to safeguard against potential exploitation.
Infosecurity Magazine
The City of London Police has launched the UK's national Report Fraud service, aimed at improving the way economic crimes are reported and handled across the country. This new service is designed to streamline the reporting process for victims of fraud, making it easier for individuals and businesses to report incidents. By consolidating various reporting channels into one platform, the initiative hopes to enhance the response to economic crime and support victims more effectively. This move comes as fraud continues to rise, affecting countless individuals and businesses. The service is expected to provide better data collection and analysis, which could lead to more successful investigations and prosecutions.