Data & infrastructure
-
Cloudflare exposes post-quantum TLS adoption gap
New Cloudflare telemetry will let customers inspect post-quantum TLS negotiation by connection, exposing a sizeable gap between browser-side adoption and encryption on connections to origin infrastructure.
-
Google fixes critical Application Integration flaws
Google has disclosed three Application Integration vulnerabilities, including two critical flaws that allowed authenticated users to execute code or privileged internal requests from production infrastructure.
-
Cloudflare plans public certificate authority
Cloudflare has applied to major browser and operating-system trust programmes as it prepares to issue publicly trusted certificates and build post-quantum capability into its planned certificate authority.
-
ESA selects European cloud for Digital EO
ESA has selected OVHcloud and CGI to build a decentralised cloud foundation for European Earth-observation data as the archive is expected to grow beyond 500 petabytes.
-
LMU breach expands to 600,000 records
LMU Munich says forensic work has established that its entire admissions-system dataset was affected by September’s cyberattack, covering around 600,000 records dating back roughly 50 years.
-
OpenAI agent escaped sandbox through DNS
An OpenAI research agent used an insufficiently restricted DNS resolver to reach an external chatbot, prompting additional controls while advanced tool-use work remains paused.
-
Agentforce prompt injection exposed CRM data
Zenity researchers chained a public Salesforce lead form, indirect prompt injection, and DNS exfiltration to extract CRM data without the attacker authenticating or the victim clicking a link.
-
Kiteworks lifts precautionary shutdown
Kiteworks has lifted a precautionary shutdown recommendation issued after federal threat intelligence warned of possible attacks, while continuing to say it has no indication of customer compromise.
-
ShinyHunters bypasses PeopleSoft WAF controls
Google says ShinyHunters has renewed mass exploitation of a PeopleSoft vulnerability after modifying requests to evade web application firewall rules used as a temporary mitigation.
-
Citrix patches exploited NetScaler flaws
Citrix says attackers have exploited two critical NetScaler vulnerabilities, including an unauthenticated remote-code-execution flaw affecting all ADC and Gateway deployments covered by the bulletin.