Source : The Hacker News Malicious code on the website of prediction market Polymarket sold some signed-in traders’ positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain […]

Source : BleepingComputer Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers’ AI API keys. […] Lire l’article original Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel […]

Source : The Hacker News A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client’s public certificate. Once in, the attacker would act […]

Source : BleepingComputer A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed « SMS of Death » and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. […] Lire l’article original Vous vous demandez si votre entreprise est exposee a […]

Source : BleepingComputer A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. […] Lire l’article original Vous vous demandez si votre entreprise est exposee a ce type de […]

Source : The Hacker News Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based « targeted intrusion adversary » it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in […]

Source : The Hacker News American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. « This month, Chainalysis detected an […]

Source : BleepingComputer Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. […] Lire l’article original Vous vous […]

Source : BleepingComputer Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […] Lire l’article original Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel […]

Source : BleepingComputer Blockchain analytics firm Chainalysis disclosed a data breach after attackers used « offensive agentic techniques » to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. […] Lire l’article original Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel decouverte […]