Latest CyberSec News by @thecyberpicker

This week on the Lock and Code podcast, we speak with Carey Parker about what Google Chrome knows about you.

Cisco Talos found UAT-5918, active since 2023, using web shells and open-source tools for persistence, info theft, and credential harvesting.

Des experts en cybersécurité ont développé des logiciels malveillants pour dérober les mots de passe depuis ChatGPT et DeepSeek. Les chercheurs ont construit un monde immersif pour tromper l'IA et pousser les chatbots à produire du code malveillant. Les hackers voient leur rêve devenir réalité. Un rapport de

CVE-2025-30066 supply chain attack compromised tj-actions on March 14, 2025, exposing 218 repositories and leaking credentials.

CVE-2025-30066 supply chain attack compromised tj-actions on March 14, 2025, exposing 218 repositories and leaking credentials.

The U.S. Treasury is lifting sanctions on Tornado Cash, a crypto mixer accused of helping North Korea's Lazarus Group launder illicit funds.

Spoiler : une grande partie d'entre elles sont relatives à l'implication, réelle ou supposée, de la NSA, la très puissante agence de renseignement technique américaine. Torpillé par les députés de la commission des lois, le controversé amendement sur les backdoors dans les messageries chiffrées s'est réinvité dans

Cybercriminals are abusing Microsoft's Trusted Signing platform to code-sign malware executables with short-lived three-day certificates.

Le Club Data Protection de L'Usine Digitale vous propose un best-of des actualités de la semaine du 17 mars en matière de protection des...-Club Data Protection

L’Usine Digitale vous propose un récapitulatif des grandes actualités de la semaine en matière de cybersécurité. Au programme, le...-Cybersécurité

U.S. Treasury lifts Tornado Cash sanctions after Fifth Circuit ruling, removing 100+ ETH wallets to bolster digital asset security.

Aztech DSL5005EN Router - 'sysAccess.asp' Admin Password Change (Unauthenticated).. remote exploit for Hardware platform

TeamPass 3.0.0.21 - SQL Injection. CVE-2023-1545 . webapps exploit for PHP platform

Microsoft Windows - NTLM Hash Leak Malicious Windows Theme. CVE-2024-21320 . remote exploit for Windows platform

Russian zero-day broker Operation Zero is looking for exploits for the popular messaging app Telegram, offering up to $4 million for them.

Researchers have determined that Coinbase was the primary target in a recent GitHub Actions cascading supply chain attack that compromised secrets in hundreds of repositories.

New research: An associate professor of chemistry and chemical biology at Northeastern University, Deravi’s recently published paper in the Journal of Materials Chemistry C sheds new light on how squid use organs that essentially function as organic solar cells to help power their camouflage abilities. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Oracle denies it was breached after a threat actor claimed to be selling 6 million data records allegedly stolen from the company's Oracle Cloud federated SSO login servers

Jasmin Ransomware - SQL Injection Login Bypass.. webapps exploit for PHP platform

The first initiative from the FCC's Council on National Security will be an investigation of Chinese-made equipment in America’s telecom infrastructure.

The Atlantic has a search tool that allows you to search for specific works in the “LibGen” database of copyrighted works that Meta used to train its AI models. (The rest of the article is behind a paywall, but not the search tool.) It’s impossible to know exactly which parts of LibGen Meta used to train its AI, and which parts it might have decided to exclude; this snapshot was taken in January 2025, after Meta is known to have accessed the database, so some titles here would not have been available to download. Still…interesting. Searching my name yields 199 results: all of my books in different versions, plus a bunch of shorter items...

The release of the JFK assassination records also resulted in the leak of hundreds of Social Security Numbers

Microsoft is investigating an Exchange Online bug causing anti-spam systems to mistakenly quarantine some users' emails.

L'Assemblée nationale s'oppose encore à l'accès aux contenus des messageries chiffrées au profit des services de renseignement. Des dispositions proposées dans le cadre de la proposition de loi pour lutter contre le trafic de drogue ont été largement rejetées. Rien n'y fait. Malgré l'insistance du ministre de

A new phishing campaign is targeting SEO professionals with malicious Semrush Google Ads that aim to steal their Google account credentials.

Researchers from Palo Alto Networks said the hackers likely planned to leverage an open source project of the company for additional attacks.

Tornado Cash, which the U.S. sanctioned in 2022, was dropped from that list by the Trump administration following a court decision favoring the cryptocurrency mixer in November.

Le coût de la cybersécurité personnelle est souvent élevé, avec des formules pouvant approcher la centaine d’euros par an. Alors quand l’antivirus Avast baisse le prix de ses abonnements, il faut en profiter. Vous avez toujours eu des scrupules à installer un bon antivirus sur votre ordinateur ou votre smartphone,

Trend Micro observed a continuous development of Albabat ransomware, designed to expand attacks and streamline operations