L'exploit ShieldCrash contourne le correctif de Microsoft pour la faille ShieldBreak et permet de lire n'importe quel fichier sur Windows et Windows Server.

Le post ShieldCrash : cette nouvelle zero-day Microsoft Defender offre un accès système a été publié sur IT-Connect.

Guide complet sur SafeLine, un WAF à déployer avec Docker : fonctionnalités clés, installation, configuration et tests de détection sur un site web.

Le post SafeLine : un WAF prêt à protéger vos applis web des bots malveillants a été publié sur IT-Connect.

Google a publié le bulletin de sécurité de septembre 2026 pour Android : il corrige 180 vulnérabilités, dont une faille critique exploitable à distance.

Le post Android : le patch de septembre 2026 corrige une faille critique exploitable à distance sans interaction a été publié sur IT-Connect.

Un Youtubeur accuse les TV LG de scanner le réseau local et de transcrire l'audio en veille. LG dément pour le micro, mais assume pour le réseau.

Le post Votre TV LG vous écoute même en veille et scanne votre réseau local a été publié sur IT-Connect.

FortiADC 8.0.4 B0136 and release notes are available for download from the Support site : https://support.fortinet.com

FortiVoice 7.4.2 B0707 and release notes are available for download from the Support site : https://support.fortinet.com

Attention à BigBear 2.0, un service de phishing AiTM qui a volé 5 137 identifiants Microsoft 365 malgré le MFA. La France est le 2e pays le plus touché.

Le post Phishing Microsoft 365 : BigBear 2.0 a contourné le MFA de 258 entreprises a été publié sur IT-Connect.

• Milestone

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (edge) is recommended for faster security patches.

Breaking change 💥:

• Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights✨:

• Filter global view feed list by state and search
• New option to hide badges showing number of unread articles (Phantom Obligation)
• Refresh only feeds in the current view
• Offer to add a prefix when re-sharing user labels

Bug fixes highlights 🐛:

• Several security attack scenarios patched
• Fix lost elements while parsing search query
• Fix “mark as read older than…” widening the active search
• Fix saving user queries
• Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

• Security
  • 💥 Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,
    #9195
    • Selected local networks can be allowed under System configuration or using the INTERNAL_HOST_ALLOWLIST environment variable
    • Passing * allows all networks like before (unsafe)
  • Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
  • Fix auth CSRFs (login and register actions) #9171
  • Log invalid challenge and ignore JSON error during login #9278
  • Disallow fetching of non remote URI #9215
  • Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
  • Fix access control in rss and opml actions #8912
  • Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
  • Cleaner limit anonymous mode to default user #9235
  • Fix HTML ingestions in templates #9146, #9170
  • Fix bad header filtering bypass #8964
  • Sanitize all fields during JSON import #9168
  • Gate greader (JSON) user query share format behind Share by OPML #9248
  • Public OPML should not contain cURL parameters #9070
  • Ignore security-relevant OPML attributes for dynamic OPML sources #9276
  • Strip feed URL credentials from anonymous user query output #9246
  • Set limits for regex during search #8913
  • Fix path disclosure in cache error message #9206
  • Limit the length and parentheses nesting depth of a search query #9277
  • Use timing-safe comparison for tokens #8945
  • Use hash_equals() for GReader API token comparison #9183
  • Mailer: allow disabling SMTPAutoTLS via config #9026
  • Warn during install if document root does not point to ./p/ #9010
  • Stop the unread-count poller after the session ends #9065
  • Add remote IP address to warning on form login #8942
  • Pin the GitHub actions using SHA #9200
  • Harden cache and SimplePie cache deserialization #9273
• SimplePie
  • Security: Disallow javascript: URI scheme (protocol) #8263
  • Fix wrong player parent logic leading to invalid type #8893, simplepie#978
  • Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
  • Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
  • Fix sanitizer whitelist stripping order #9066
  • Show only one representation per media:group #9009
  • Bump upstream SimplePie #8947
• Features
  • Filter global view feed list by state and search #9132
    • Use global view when searching from subscription page #9144
  • New option to hide badges showing number of unread articles (Phantom Obligation) #8844
  • Refresh only feeds in the current view #9060
  • Offer to add a prefix when resharing user labels #9236
  • Add log search to the logs page #9059
  • Add configurable log_level system setting #9185
  • New option to keep or not the custom sort order when navigating between categories and feeds #8969
  • New per-feed option to show or hide enclosures (attachments) #9015
  • Detect JSON feeds from URLs containing json #9058
    • Also when subscribing via the API #9167
  • Order categories during OPML import/export according to position #9203
  • OPML: include each feed’s refresh interval (TTL) in export/import #8982
  • Log failed CSS content retrieval (Web scraping) #9077
  • Allow providing a category when adding a feed by bookmarklet #9047
  • Add LinkAce sharing service #9024
  • Add Nextcloud Bookmarks sharing service #9032
• Bug fixing
  • Fix lost elements while parsing search query #8884
  • Fix “mark as read older than…” widening the active search #9173
  • Fix saving user queries #9190
  • Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
  • Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
  • Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
  • PostgreSQL: make committing new entries resilient to duplicate keys #9231
  • Preserve negative timezone offsets in date intervals #9071
  • Fix feed dropdown bugs due to hash desync #8949
  • Fix slider not reinitializing after form submit #8973
  • Minz: Skip loading duplicated JS/CSS assets #9000
  • Respect simplepie_syslog_enabled for the uses cache logs #8986
  • Fix statistics repartition averages #8996
  • Fix article hover date visibility #8997
  • Keep search and state filters when marking articles as read #9007
  • Fix --db-prefix silently drops following CLI flags #9042
  • Remove stale dynamic favicon links #9127
  • Fix desync between favicon and title unread counters #9262
  • Fix outdated username length hint on registration and install forms #9013
  • Redirect away from wrong URL paths #9075
  • Fix auto-share shortcut on first use #9072
  • Exclude hidden feeds from global view counts #9152
  • Fix only the last <media:credit> being written to the RSS output #9174
• CLI
  • New cli/reconfigure-user.php to read/write per-user config attributes #8873
  • Report new articles count per feed in app/actualize_script.php output #8948
  • Output a diagnostic when the cli/health.php check fails #8980
• API
  • Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
  • Fever API: log the client IP address on authentication failure #8981
  • WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
• Deployment
  • Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
  • Start supporting PHP 8.6+
    • Docker dev :newest with PHP 8.6 #9155
  • Docker: attach provenance and SBOM attestations to the published image #9150
  • Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
  • Fix .dockerignore being ignored during build in CI #9001
  • New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
  • Check GMP during 32-bit installation #9046
  • Improve actualize mutex to allow multiple instances #9045
  • OIDC: redirect to a default URL on expired auth state instead of 400 #9143
• UI
  • Always jump article to top when header is offscreen, also when Stick the article to the top when opened is disabled #8870
  • Move article header/footer options (feed title, authors and date, icons position, tags) from Reading to Display configuration #9139
  • Move disable button before remove button in user management #8944
  • Keep scroll position of slider after form submit #8974
  • Group export feeds by category #9079, #9154
  • Sort feed names with locale-aware collation #8985
  • Sort labels with locale-aware collation #9023
  • Format unread counter in title on page load #9263
  • Display slider after submit for all buttons in feed update UI #8999
  • Improve aside keyboard navigation #9202
  • Allows usage of Ctrl/Shift keys with the open website shortcut #9186
  • Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
  • Fix typo in alert error border color variable #9266
  • Use JavaScript Event() constructor instead of deprecated initEvent() #9035
  • Use :user-invalid instead of :invalid for CSS form field styling #9025
  • Remove unused simple layout #8998
  • Various UI and style improvements: #8823, #8824,
    #9140, #9145
• Extensions
  • Minor Minz_Extension typing #8952
  • Improve extension list fetch diagnostics #9055
  • Fix a PHP warning in Serve action #9267
  • Fix extension settings cancel action #9053
  • Fix sharing menu conflicts with extensions #9074
  • Add read status hook for entries #8995
  • Dispatch a new JavaScript event freshrss:entryStateChange when an entry finishes being marked read/unread #9031
  • Redirect after saving user CSS/JS so changes apply immediately #9006
• I18n
  • New plural system #8988
    • Pluralize the new articles count message
  • Prefer OS-bundled Japanese fonts when UI language is Japanese #9002
  • Add Azerbaijani #9269
  • Add Lithuanian #9201, #9213
  • Improve Brazilian Portuguese #9240, #9242
  • Improve German #9149
  • Improve Greek #8977, #9038
  • Improve Hungarian #8879
  • Improve Indonesian (Bahasa Indonesia) #9220
  • Improve Italian #8880
  • Improve Japanese #9064
  • Improve Persian #8923
  • Improve Spanish #8878, #9245
  • Improve Traditional Chinese #9037, #9069, #9223
  • Improve Turkish #8966, #8971, #8970,
    #8989
  • Improve Ukrainian #8871
  • Refactor user query translation keys #9049
• Misc.
  • Update to PHPMailer 7.1.1 #8907
  • Improve PHP code #8906, #9156
  • Fix PHPStan 2.2.2 in CLI #8911
  • Migrate markdownlint-cli to markdownlint-cli2 #8987
  • Update dev dependencies #8904, #8905, #8926,
    #8939, #8940, #8963,
    #8961, #8959, #8958,
    #8962, #8960, #9148,
    #9162, #9165, #9158,
    #9159, #9176, #9178,
    #9179, #9219, #9253,
    #9254, #9255, #9257

Après les fuites DGFiP et Éducation nationale, l'ANSSI lance REACTIV et peut imposer des mesures immédiates aux ministères. Voici ce qu'il faut retenir.

Le post REACTIV : l’ANSSI obtient le pouvoir d’imposer des mesures d’urgence aux ministères après les fuites de données a été publié sur IT-Connect.