Hier
ISAE-Supméca : des hackers paralysent le système informatique de cette grande école d’ingénieurs
L’école d’ingénieurs ISAE-Supméca a été victime d’une cyberattaque par rançongiciel le 31 octobre 2026, affectant l’ensemble de son...
OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions
After its sandbox proxy failed, an internal OpenAI model crafted raw packets and probed AWS services trying to reach the internet.
MetaMask says recent attack didn't affect wallet infrastructure
Cryptocurrency wallet provider MetaMask said a recent security incident has not affected MetaMask wallets or its wallet infrastructure. [...]
Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company sa…
Pharmagest : une faille de sécurité pourrait exposer les données de patients de milliers de pharmacies françaises
Une possible faille de sécurité touchant les logiciels Pharmagest, utilisés dans des milliers de pharmacies françaises, soulève de...
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in i…
Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw,…
Cyberattaque contre le Forum Pompier : 65 694 comptes et près de 133 000 messages privés en fuite
Les données de près de 66 000 utilisateurs du site français Forum-Pompier.com seraient compromises. Le 5 novembre 2026,...
3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Million
The trio, who have nicknames that include “Rocky Balboa,” “Superman Cash” and “Fat Boy,” often targeted the companies’ accounting departments.
FBI, CISA warn of cyberattacks targeting refrigeration systems
The FBI and CISA warn that hackers are actively targeting industrial refrigeration and cold-chain monitoring systems worldwide, potentially causing food spoilage, equipment damage, and fire hazards. [...]
jeudi 5 novembre
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and authentication sessions. [...]
Le Rassemblement national confirme une cyberattaque et une fuite de données d’adhérents
Le Rassemblement national (RN) a officiellement confirmé, mercredi 4 novembre 2026, avoir été victime d’une cyberattaque ayant entraîné...
Nearly 1.5 million exposed secrets targeted in new revocation program
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid. [...]
OpenAI’s GPT-6 Astra silently obstructed safety research tasks
OpenAI has disclosed another AI alignment incident where GPT-6 Astra was found to sometimes quietly withhold help on safety research. [...]
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw cr…
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration r…
Cyberattaque contre les frigos de l’EFS : le plasma visé
Cyberattaque EFS : trois sites touchés, du plasma menacé. ZATAZ revient sur les précédents et les risques industriels.
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
Illicado piraté : un hacker contourne ses protections et récupère des cartes-cadeaux numériques d’entreprises
Illicado confirme avoir été victime d’une cyberattaque ayant permis à un individu de récupérer frauduleusement des copies de...
Plus de 100 millions d’euros dérobés lors d’une cyberattaque contre le Crédit Mutuel Arkéa
Mercredi, le Crédit Mutuel Arkéa a confirmé avoir été victime d’une cyberattaque portant sur plus de 100 millions d’euros. Les fonds dérobés auraient ensuite été convertis en cryptomonnaies par les cybercriminels. Tribune ESET – Une enquête a été ouverte afin de faire la lumière sur cette attaque. D…
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some…
Une vulnérabilité expose les risques des robots IA utilisés à domicile et dans les écoles
Les chercheurs en sécurité de JFrog ont découvert cinq CVE dans Reachy Mini, un robot de bureau open source à 499 $ conçu par Pollen Robotics et Hugging Face. Une seule requête HTTP non authentifiée suffit à faire exécuter le code d’un attaquant au robot, qui obtient alors un accès root ainsi que le…
Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out
A critical finding can move through several security tools and still leave the organization exposed. The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what prot…
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs. "Our prototype identified and analyzed 2,308 candidate Linux kernel finding…
Ordre du jour de la séance plénière du 5 novembre 2026
Rejeu de session : ces outils qui enregistrent votre activité en ligne
Outils de rejeu de session : la CNIL publie sa recommandation pour guider les acteurs
5 Active Cyber Threats That Put US Enterprises at Risk in October 2026
October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk o…
1 280 dollars pour dénicher et exploiter une faille du noyau Linux : OpenAI affirme avoir industrialisé la chasse aux bugs
OpenAI affirme avoir mis en place une chaîne d’agents d’IA capable de chercher des failles dans le noyau Linux, de les exploiter et de proposer des correctifs. Ce prototype aurait exploité 948 failles en octobre, mais des chercheurs humains doivent encore relire ses résultats.