Veille cybersécurité et IA — page 4

Violations de données à répétition : l’Anssi fait son bilan et donne ses conseils (nouvel onglet)

L’Agence nationale de la sécurité des systèmes d’information vient de publier une synthèse des origines constatées des centaines de violations de données survenues en France, et des remèdes à adopter.

« Supervision humaine minimale » : l’armée américaine veut envoyer des agents IA pirater ses ennemis (nouvel onglet)

Explorer des réseaux, se propager d’un appareil à l’autre et neutraliser des cibles : l’armée américaine veut confier des missions offensives à des agents IA. Une enquête de The Intercept, publiée le…

A visit to Samsung’s massive new semiconductor hub (nouvel onglet)

Generative AI models run on powerful chips known as GPUs, which depend on stacks of specialized memory chips packaged with the processor. To meet growing demand for memory, Samsung is building a…

Anthropic soumet en privé un projet de loi fédéral sur l'IA (nouvel onglet)

Les représentants d’Anthropic ont discrètement soumis aux élus du Congrès américain un projet de loi visant à…

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (nouvel onglet)

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and…

ServiceNow lance AI Passport pour gouverner les agents IA (nouvel onglet)

Les entreprises cherchent à mieux contrôler les agents IA qu’elles déploient dans leurs systèmes d’information.

Contrôle à l’export : la Chine laisse planer le doute sur le sort des modèles frontières ouverts (nouvel onglet)

Le gouvernement chinois envisage d’interdire et de restreindre l’accès à 23 technologies d’IA. Les futurs modèles de plus de 2 000 milliards de paramètres sont concernés par des mesures…

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (nouvel onglet)

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as…

Terminal X matches senior investor judgment 88.6% with GPT-6.1 (nouvel onglet)

Terminal X’s Eval Agent grades outputs against a 54-criterion rubric, catching 25% more deviances from a fund’s mandate with GPT-6.1 Sol.

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge (nouvel onglet)

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco…

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (nouvel onglet)

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere…

Analytique agentique : pour Tableau, Salesforce met la main sur Loops (nouvel onglet)

L’acquisition de cette startup permettra d’ajouter à la plateforme Tableau un agent d’IA capable de suivre et d’analyser les indicateurs clés de performance. Le projet d’intégration détaillé n’a pas…

OpenAI acquires Orchestra Bio (nouvel onglet)

OpenAI is acquiring Orchestra Bio to bring AI-powered operations to life sciences R&D, helping biopharma teams accelerate drug development and advance new treatments.

Hugging Face ❤️ TorchTPU: TPUs, Natively (nouvel onglet)

AnyLanguageModel 1.0: One Year of Local Models on Apple Platforms (nouvel onglet)

MPS in PyTorch 2.15 (nouvel onglet)

Researchers Infiltrate Microsoft Tech Support Scam Operation (nouvel onglet)

A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.

'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery (nouvel onglet)

Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.

ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs (nouvel onglet)

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.

Making the internet better for AI agents might make it worse for everyone else (nouvel onglet)

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. Until recently, you could divide internet users into just two…

“We were looking at it wrong”: The explosive claim that’s upended the AI world (nouvel onglet)

“I think I have good news about the nature of neural networks.” With those simple words of optimism, Nick Cammarata, a researcher at the AI startup Goodfire, kicked off a 26,000-word blog post that…

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor (nouvel onglet)

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public…

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor (nouvel onglet)

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on…

OnlyFans Copyright Takedowns Expose Compromised Websites (nouvel onglet)

Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's…

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More (nouvel onglet)

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks…

The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience (nouvel onglet)

An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site (nouvel onglet)

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who…

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories (nouvel onglet)

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a…

Cybersécurité : les infrastructures critiques françaises peinent à automatiser leur réponse aux attaques (nouvel onglet)

Les réseaux électriques, les usines, les hôpitaux, les systèmes de transport et les services publics constituent le socle du…

Advancing coding in low‑resource programming languages (nouvel onglet)

Learn how OpenAI is improving ChatGPT across low-resource programming languages, with new evaluations for software engineering, SQLite, and COBOL migration.

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software (nouvel onglet)

In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately…

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic (nouvel onglet)

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial…

AI researchers stranded Claude on a virtual desert island. It started to “play.” (nouvel onglet)

What do AI agents do if you don’t tell them to do anything? The answer looks a lot like play. Researchers repeatedly stranded them alone on a virtual desert island for 30 hours in an experiment…

Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers (nouvel onglet)

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin…

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (nouvel onglet)

An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is…

TorchNeuron: running HF models on AWS Trainium is easier than ever (nouvel onglet)

Des frigos de supermarchés piratés partout en France, le fossé invisible de l’IA et les bots russes toujours actifs malgré les frappes sur Yandex : on vous raconte la semaine Cyberguerre (nouvel onglet)

Trois actualités à retenir cette semaine dans le cyberespace, un piratage qui a fait grimper la température dans les rayons frais de centaines de supermarchés français, Andrej Karpathy qui décrit le…

Vous ne voyez aucune différence entre ce « a » et ce « а », et c’est un énorme problème de cybersécurité (nouvel onglet)

Une simple lettre venue de l’alphabet cyrillique suffit à créer une fausse adresse web presque impossible à distinguer de la vraie à l’œil nu. Un piège connu des spécialistes, qui reste…

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (nouvel onglet)

ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to…

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon (nouvel onglet)

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded…

Starlink bridé en Ukraine : ce serait bien Elon Musk qui aurait suggéré l’idée (nouvel onglet)

Alors qu'il s'est défaussé sur Donald Trump, Elon Musk aurait bien été à l'origine du bridage de Starlink en Ukraine, selon le Telegraph. Dans la nuit du 13 au 14 octobre, les drones ukrainiens qui…

BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs (nouvel onglet)

Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.

Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk (nouvel onglet)

Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.

Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform (nouvel onglet)

The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.

Enterprise AI Enters Risk Management Phase as Security Concerns Rise (nouvel onglet)

Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.

How Itaú is building generative AI for its entire customer base (nouvel onglet)

With ia.i, a conversational interface, and the IARA governance platform, Itaú is applying its AI First strategy to customers and employees — in one of Brazil’s most regulated sectors.

AI Takes Control of Robotic Arm in 16 Minutes Flat (nouvel onglet)

Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.

Roundtables: A Conversation With the Creator of AI-Designed Viruses (nouvel onglet)

Listen to the session or watch below Can AI design new life forms? In 2025, Stanford University PhD student Samuel King came up with a preliminary answer when he used a generative AI model to propose…

When Your Ransomware Negotiator Works for the Other Side (nouvel onglet)

The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.

When AI Agents Commit Breaches, Humans May Not Be Held Liable (nouvel onglet)

As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.