{"id":197,"date":"2025-10-05T07:33:37","date_gmt":"2025-10-05T05:33:37","guid":{"rendered":"https:\/\/synap-sys.fr\/?page_id=197"},"modified":"2026-07-17T16:20:22","modified_gmt":"2026-07-17T14:20:22","slug":"news","status":"publish","type":"page","link":"https:\/\/synap-sys.fr\/en\/news\/","title":{"rendered":"Cyber News"},"content":{"rendered":"\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h6 class=\"wp-block-heading\" style=\"font-size:16px\">\ud83d\udd10 <strong>Failles de s\u00e9curit\u00e9 et vuln\u00e9rabilit\u00e9s<\/strong><\/h6>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\">CERT-FR (Centre gouvernemental de veille, d\u2019alerte et de r\u00e9ponse aux attaques informatiques)<\/p>\n\n\n<ul class=\"has-dates has-excerpts alignleft rss-texte-perso wp-block-rss\"><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.cert.ssi.gouv.fr\/avis\/CERTFR-2026-AVI-1243\/'>Multiples vuln\u00e9rabilit\u00e9s dans CPython (01 octobre 2026)<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans CPython. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.cert.ssi.gouv.fr\/avis\/CERTFR-2026-AVI-1245\/'>Multiples vuln\u00e9rabilit\u00e9s dans Redmine (01 octobre 2026)<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Redmine. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.cert.ssi.gouv.fr\/avis\/CERTFR-2026-AVI-1244\/'>Multiples vuln\u00e9rabilit\u00e9s dans Mozilla Thunderbird (01 octobre 2026)<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Mozilla Thunderbird. Certaines d&#039;entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.cert.ssi.gouv.fr\/avis\/CERTFR-2026-AVI-1246\/'>Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst SD-WAN (01 octobre 2026)<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst SD-WAN. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9. Cisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-76504 est activement exploit\u00e9e.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.cert.ssi.gouv.fr\/cti\/CERTFR-2026-CTI-006\/'>Point de situation de l\u2019op\u00e9ration REACTIV \u2013 septembre 2026 (30 septembre 2026)<\/a><\/div><time datetime=\"2026-09-30T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Face \u00e0 l\u2019intensification des attaques cybercriminelles li\u00e9es \u00e0 des violations de donn\u00e9es affectant les services de l\u2019\u00c9tat, le Premier ministre a demand\u00e9 le 1er septembre 2026 \u00e0 l\u2019Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d\u2019information (ANSSI) de mettre en place une capacit\u00e9 renforc\u00e9e de&#8230;<\/div><\/li><\/ul>\n\n\n<p class=\"wp-block-paragraph\">Exploit Database (Offensive Security)<\/p>\n\n\n<ul class=\"has-dates has-excerpts rss-texte-perso wp-block-rss\"><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.exploit-db.com\/exploits\/52685'>[webapps] InvoicePlane 1.7.1 &#8211;  RCE<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">InvoicePlane 1.7.1 &#8211; RCE<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.exploit-db.com\/exploits\/52684'>[webapps] POMS oretnom23v1.0  &#8211; SQLi vulnerabilities<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">POMS oretnom23v1.0 &#8211; SQLi vulnerabilities<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.exploit-db.com\/exploits\/52687'>[webapps] Krayin CRM 2.2.4 &#8211; IDOR<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Krayin CRM 2.2.4 &#8211; IDOR<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.exploit-db.com\/exploits\/52686'>[webapps] SuiteCRM  8.10.1 &#8211; Authenticated SSRF<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">SuiteCRM 8.10.1 &#8211; Authenticated SSRF<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/www.exploit-db.com\/exploits\/52688'>[remote] Ecava_ntegraXor  IGX_16.0.701.10 &#8211; RCE<\/a><\/div><time datetime=\"2026-10-01T02:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Ecava_ntegraXor IGX_16.0.701.10 &#8211; RCE<\/div><\/li><\/ul><\/div><\/div>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading\" style=\"font-size:16px\">\ud83d\udee1\ufe0f <strong>Attaques en cours et campagnes actives<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\">The Hacker News<\/p>\n\n\n<ul class=\"has-dates has-excerpts rss-texte-perso wp-block-rss\"><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/thehackernews.com\/2026\/10\/police-arrest-16-year-old-suspected-of.html'>Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers<\/a><\/div><time datetime=\"2026-10-01T18:55:57+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. [&hellip;]<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/thehackernews.com\/2026\/10\/threatsday-ai-powered-zero-day-chain.html'>ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories<\/a><\/div><time datetime=\"2026-10-01T18:45:38+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the [&hellip;]<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/thehackernews.com\/2026\/10\/wordpress-backdoor-rebuilds-itself.html'>WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory<\/a><\/div><time datetime=\"2026-10-01T16:37:35+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the &quot;SC_&quot; markers present in the injected content. Sucuri has described the malware as a &quot;self-healing [&hellip;]<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/thehackernews.com\/2026\/10\/how-financial-services-companies-can.html'>How Financial Services Companies Can Modernize Their Software Supply Chain<\/a><\/div><time datetime=\"2026-10-01T13:45:00+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises the change-freeze calendar. The finding gets an exception, [&hellip;]<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/thehackernews.com\/2026\/10\/openai-disrupts-reasoning-extraction.html'>OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates<\/a><\/div><time datetime=\"2026-10-01T12:42:36+00:00\" class=\"wp-block-rss__item-publish-date\">1 October 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A &quot;core cluster of the activity,&quot; going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in [&hellip;]<\/div><\/li><\/ul><\/div><\/div>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<h6 class=\"wp-block-heading\" style=\"font-size:16px\">\ud83d\udee0\ufe0f <strong>Microsoft Security Update Guide (Patch Tuesday &amp; autres mises \u00e0 jour)<\/strong><\/h6>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\">Ce flux liste les bulletins de s\u00e9curit\u00e9 (CVE, correctifs mensuels) publi\u00e9s par Microsoft. C\u2019est <em>la source officielle<\/em> pour les mises \u00e0 jour de s\u00e9curit\u00e9 Windows, Office, Azure, etc.<\/p>\n\n\n<ul class=\"has-dates has-excerpts rss-texte-perso wp-block-rss\"><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-61938'>CVE-2026-61938 Windows Installer Elevation of Privilege Vulnerability<\/a><\/div><time datetime=\"2026-09-30T16:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Updated an acknowledgement. This is an informational change only.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-65787'>CVE-2026-65787 Desktop Window Manager Elevation of Privilege Vulnerability<\/a><\/div><time datetime=\"2026-09-30T16:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Updated an acknowledgement. This is an informational change only.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-66804'>CVE-2026-66804 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability<\/a><\/div><time datetime=\"2026-09-30T16:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Updated an acknowledgement. This is an informational change only.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-62758'>CVE-2026-62758 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability<\/a><\/div><time datetime=\"2026-09-30T16:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Updated an acknowledgement. This is an informational change only.<\/div><\/li><li class='wp-block-rss__item'><div class='wp-block-rss__item-title'><a href='https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-62784'>CVE-2026-62784 Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability<\/a><\/div><time datetime=\"2026-09-30T16:00:00+00:00\" class=\"wp-block-rss__item-publish-date\">30 September 2026<\/time> <div class=\"wp-block-rss__item-excerpt\">Updated an acknowledgement. This is an informational change only.<\/div><\/li><\/ul><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udd10 Failles de s\u00e9curit\u00e9 et vuln\u00e9rabilit\u00e9s CERT-FR (Centre gouvernemental de veille, d\u2019alerte et de r\u00e9ponse aux attaques informatiques) Exploit Database (Offensive Security) \ud83d\udee1\ufe0f Attaques en cours et campagnes actives The Hacker News \ud83d\udee0\ufe0f Microsoft Security Update Guide (Patch Tuesday &amp; autres mises \u00e0 jour) Ce flux liste les bulletins de s\u00e9curit\u00e9 (CVE, correctifs mensuels) publi\u00e9s &#8230; <a title=\"Cyber News\" class=\"read-more\" href=\"https:\/\/synap-sys.fr\/en\/news\/\" aria-label=\"Read more about Cyber News\">Read more<\/a><\/p>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"slim_seo":{"title":"synap-sys | Cyber News : veille s\u00e9curit\u00e9 et vuln\u00e9rabilit\u00e9s","description":"Actualit\u00e9 cybers\u00e9curit\u00e9 sur synap-sys : failles de s\u00e9curit\u00e9, vuln\u00e9rabilit\u00e9s, attaques en cours, patchs Microsoft et veille CERT-FR. Restez inform\u00e9 !","canonical":"https:\/\/synap-sys.fr\/news\/"},"footnotes":""},"class_list":["post-197","page","type-page","status-publish"],"_links":{"self":[{"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/pages\/197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/comments?post=197"}],"version-history":[{"count":16,"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/pages\/197\/revisions"}],"predecessor-version":[{"id":355,"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/pages\/197\/revisions\/355"}],"wp:attachment":[{"href":"https:\/\/synap-sys.fr\/en\/wp-json\/wp\/v2\/media?parent=197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}