https://lestontons.tech/veille/ Dernières en Cybersécurité.fr https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html veille techno-1792216894156668 Fri, 16 Oct 2026 21:06:47 +0000 New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog… https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/ veille techno-1792216894156613 Fri, 16 Oct 2026 20:00:59 +0000 Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...] https://www.zdnet.com/uncategorized/meta-business-account-data-ai-scraping-terms/ veille techno-1792216894156592 Fri, 16 Oct 2026 19:36:02 +0000 And there’s no opt-out available. https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html veille techno-1792216894156512 Fri, 16 Oct 2026 17:48:45 +0000 A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP… https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/ veille techno-1792216894156489 Fri, 16 Oct 2026 17:20:03 +0000 Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...] https://www.zdnet.com/business/munich-proprietary-open-source-no-linux-desktop/ veille techno-1792216894156481 Fri, 16 Oct 2026 17:11:35 +0000 Open source in the public sector doesn’t fail because of technical issues. It fails because it’s not aligned with the political agenda https://www.zdnet.com/uncategorized/anthropic-embed-third-party-ai-auditors-safety/ veille techno-1792216894156479 Fri, 16 Oct 2026 17:10:27 +0000 As AI labs continue to self-regulate, external evaluators play a crucial role in spotting risks. https://www.zdnet.com/tech/iphone-duo-preorders-delay-supply/ veille techno-1792216894156446 Fri, 16 Oct 2026 16:44:50 +0000 Estimates for Duo preorders are now showing a ship date of late January, marking a new wait time record for Apple and its customers. https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html veille techno-1792216894156444 Fri, 16 Oct 2026 16:43:39 +0000 Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked… https://www.it-connect.fr/pwnescape-cve-2026-99999-faille-noyau-linux-evasion-vm/ veille techno-1792216894156417 Fri, 16 Oct 2026 16:24:02 +0000 PwnEscape (CVE-2026-99999), faille critique du noyau Linux, fait fuir la mémoire de l'hôte depuis une VM, jusqu'à l'évasion. Voici comment se protéger. Le post PwnEscape : une faille Linux permet de s’évader d’une VM KVM a été publié sur… https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html veille techno-1792216894156408 Fri, 16 Oct 2026 16:16:44 +0000 Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle… https://www.it-connect.fr/cloud-cyber-security-expo-paris-2026-les-inscriptions-sont-ouvertes/ veille techno-1792216894156382 Fri, 16 Oct 2026 16:00:00 +0000 Les inscriptions pour l'événement Cloud & Cyber Security Expo Paris 2026 sont désormais ouvertes. Obtenez votre badge gratuitement pour y participer. Le post Cloud & Cyber Security Expo Paris 2026 : les inscriptions sont ouvertes a été… https://www.it-connect.fr/backuply-cve-2026-93953-injection-sql-wordpress/ veille techno-1792216894156358 Fri, 16 Oct 2026 15:43:24 +0000 CVE-2026-93953 : une injection SQL dans Backuply, présent sur 600 000 sites WordPress, permet à un simple abonné de devenir administrateur. Mettez à jour. Le post Backuply : une faille SQL menace 600 000 WordPress, surtout si vous… https://thehackernews.com/2026/10/openai-research-model-spent-3rd-party.html veille techno-1792216894156294 Fri, 16 Oct 2026 14:03:04 +0000 OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test… https://www.it-connect.fr/windows-11-kb5127648-smart-app-control-grise/ veille techno-1792163739436874 Fri, 16 Oct 2026 13:59:57 +0000 Depuis la KB5127648, Smart App Control peut rester grisé sur Windows 11. Microsoft confirme le bug et propose deux contournements, via le Registre ou une GPO. Le post Windows 11 KB5127648 : la mise à jour d’octobre 2026 perturbe Smart App… https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/ veille techno-1792163739436856 Fri, 16 Oct 2026 13:50:59 +0000 Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block… https://www.it-connect.fr/microsoft-defender-endpoint-postes-travail-linux/ veille techno-1792163739436830 Fri, 16 Oct 2026 13:37:10 +0000 Microsoft Defender for Endpoint protège désormais les postes de travail Linux, en préversion publique. Compatibilité, licence... Voici l'essentiel à savoir. Le post Microsoft Defender for Endpoint prend désormais en charge les postes de… https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/ veille techno-1792163739436654 Fri, 16 Oct 2026 12:01:29 +0000 Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...] https://www.zdnet.com/innovation/ai-job-cuts-wage-loss-by-state-tracker/ veille techno-1792163739436614 Fri, 16 Oct 2026 11:47:39 +0000 CAIS’ Wage Loss Dashboard puts AI-related job cuts into dollars and cents. https://www.it-connect.fr/forensic-windows-analyser-navigateurs-chrome-edge/ veille techno-1792163739436607 Fri, 16 Oct 2026 11:45:00 +0000 Historique, téléchargements, cookies, identifiants, favoris : où Chrome et Edge stockent leurs traces sous Windows et comment les analyser en forensic. Le post Forensic Windows – Partie 16 : révéler les secrets des navigateurs Web (Chrome… https://thehackernews.com/2026/10/ai-decision-models-and-their-impact-on.html veille techno-1792163739436589 Fri, 16 Oct 2026 11:30:00 +0000 In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own… https://www.schneier.com/blog/archives/2026/10/backdooring-open-weight-ai-models.html veille techno-1792163739436554 Fri, 16 Oct 2026 11:04:53 +0000 This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular… https://www.it-connect.fr/danemark-fuite-cpr-mot-de-passe-123456/ veille techno-1792163739436413 Fri, 16 Oct 2026 09:58:24 +0000 Un mot de passe 123456 aurait ouvert le registre CPR danois : les noms, adresses et numéros d'identité de 8,8 millions de personnes sont dans la nature. Le post Pire que la France : 8,8 millions de Danois exposés à cause du mot de passe… https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/ veille techno-1792163739436315 Fri, 16 Oct 2026 08:44:22 +0000 Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...] https://www.it-connect.fr/sqlsimtools-microsoft-ostress-sql-server/ veille techno-1792163739436233 Fri, 16 Oct 2026 07:42:10 +0000 Vous testez la charge de SQL Server avec ostress ? Microsoft dévoile sqlsimtools, une suite open source qui repense cet outil historique en intégrant l'IA. Le post sqlsimtools : une suite open source signée Microsoft pour tester la charge… https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/ veille techno-1792163739436227 Fri, 16 Oct 2026 07:37:35 +0000 The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...] https://thehackernews.com/2026/10/china-linked-hackers-exploited.html veille techno-1792163739436180 Fri, 16 Oct 2026 06:55:55 +0000 The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The… https://thehackernews.com/2026/10/cert-in-warns-ai-agents-accessed.html veille techno-1792163739436178 Fri, 16 Oct 2026 06:53:09 +0000 AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned… https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/ veille techno-1792163739436143 Fri, 16 Oct 2026 06:18:08 +0000 BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...] https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html veille techno-1792163739436103 Fri, 16 Oct 2026 04:59:36 +0000 A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624… https://www.it-connect.fr/fin-support-office-ltsc-2021/ veille techno-1792130487228226 Fri, 16 Oct 2026 04:47:46 +0000 Depuis le 13 octobre 2026, Office LTSC 2021 et Office 2021 ne reçoivent plus de correctifs de sécurité. Microsoft 365 ou Office LTSC 2024 : que choisir ? Le post Office LTSC 2021 : c’est terminé, Microsoft ne publiera plus aucun correctif… https://arxiv.org/abs/2610.14661 veille techno-1792130487228126 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.14661v2 Announce Type: replace-cross Abstract: Public advertising transparency relies on a minimum accountability condition: an account authorized by a publisher in ads$.$txt or app-ads$.$txt should appear in the applicable… https://arxiv.org/abs/2610.14615 veille techno-1792130487228127 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.14615v2 Announce Type: replace-cross Abstract: We study autoregressive token generation through the notion of sequential samplers: A circuit that samples the next symbol only given the previous ones and possibly a small amount… https://arxiv.org/abs/2606.20717 veille techno-1792130487228128 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2606.20717v2 Announce Type: replace-cross Abstract: Multimodal Large Language Model (MLLM)-based web agents provide practical, high-precision solutions for visual browser automation; however, they inherently expand the attack… https://arxiv.org/abs/2605.12863 veille techno-1792130487228129 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2605.12863v2 Announce Type: replace-cross Abstract: This paper introduces language-based agent control (LBAC), a new programming model for agentic applications that brings techniques from programming languages and language-based… https://arxiv.org/abs/2512.20622 veille techno-1792130487228130 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2512.20622v3 Announce Type: replace-cross Abstract: Privacy concerns around 5G, the latest generation of mobile networks, are growing, with fears that its deployment may increase exposure to privacy risks. This perception is largely… https://arxiv.org/abs/2506.03467 veille techno-1792130487228131 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2506.03467v4 Announce Type: replace-cross Abstract: Gaussian Mixture Models (GMMs) are widely used statistical models for representing multi-modal data distributions, with numerous applications in data mining, pattern recognition… https://arxiv.org/abs/2610.17614 veille techno-1792130487228132 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.17614v2 Announce Type: replace Abstract: Modern mobile and edge platforms provide hardware-backed attestation of application and platform integrity at load-time. However, they offer little support once application execution… https://arxiv.org/abs/2610.10010 veille techno-1792130487228133 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.10010v2 Announce Type: replace Abstract: A cryptographic secret is issued for a purpose but grants a capability, and the capability is usually larger. Deployed systems state the purpose in policy and enforce only the capability.… https://arxiv.org/abs/2610.09730 veille techno-1792130487228134 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.09730v2 Announce Type: replace Abstract: Protocol verifiers check whether a protocol meets a security goal under stated trust assumptions, such as that a key is never leaked, a value is fresh, or a channel is authentic. They do… https://arxiv.org/abs/2610.01263 veille techno-1792130487228135 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2610.01263v2 Announce Type: replace Abstract: Open-source software (OSS) ecosystems face escalating supply chain threats, including typosquatting, dependency confusion, Trojan Source obfuscation, malicious build injection, and CI/CD… https://arxiv.org/abs/2609.39787 veille techno-1792130487228136 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2609.39787v2 Announce Type: replace Abstract: Scientific artificial intelligence (AI), spanning foundation models (FMs) to federated data-analysis pipelines, is becoming shared infrastructure across national laboratories… https://arxiv.org/abs/2609.19705 veille techno-1792130487228137 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2609.19705v2 Announce Type: replace Abstract: Large language model (LLM) agents already trade with real capital, yet agent-security research has mostly treated them as generic agents. Trading changes the threat: a compromised agent's… https://arxiv.org/abs/2606.30587 veille techno-1792130487228138 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2606.30587v2 Announce Type: replace Abstract: Researchers and practitioners increasingly apply Large Language Models (LLMs) for automated vulnerability detection. Recent work has shown that LLMs are susceptible to the same cognitive… https://arxiv.org/abs/2606.09549 veille techno-1792130487228139 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2606.09549v3 Announce Type: replace Abstract: Tool-using large language model (LLM) agents face two distinct security failures: unauthorized external actions and exposure of sensitive plaintext inside the runtime before any final… https://arxiv.org/abs/2605.05251 veille techno-1792130487228140 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2605.05251v2 Announce Type: replace Abstract: Function association is a useful process for binary reverse engineers. Search tools exist to perform association at scale, but they do not utilize the full range of capabilities that… https://arxiv.org/abs/2605.02255 veille techno-1792130487228141 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2605.02255v2 Announce Type: replace Abstract: Large language models (LLMs) face diverse privacy threats, yet existing studies typically evaluate individual attacks in isolation, offering limited guidance on which system factors drive… https://arxiv.org/abs/2602.05612 veille techno-1792130487228142 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2602.05612v2 Announce Type: replace Abstract: Federated Self-Supervised Learning (FSSL) integrates the privacy advantages of distributed training with the capability of self-supervised learning to leverage unlabeled data, showing… https://arxiv.org/abs/2601.13031 veille techno-1792130487228143 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2601.13031v2 Announce Type: replace Abstract: Secure aggregation lets a server learn the sum of inputs from multiple users without learning individual contributions. Recent single-server protocols achieve this with key- and… https://arxiv.org/abs/2505.16439 veille techno-1792130487228144 Fri, 16 Oct 2026 04:00:00 +0000 arXiv:2505.16439v3 Announce Type: replace Abstract: As network security issues continue gaining prominence, password security has become crucial in safeguarding personal information and network systems. This study first introduces various…