#безопасность
-
DreamHost forces password resets amid ongoing incident
Web hosting provider DreamHost has locked access to email and FTP/SFTP and forced password resets after a disruption that began with its File Manager and spread to other services.
-
953 Online Stores Hit by JavaScript That Hides From Scanners
Since July 2025 an unknown group has planted a malicious loader in Magento stores — code that tells real shoppers apart from security scanners and only serves its payload to live visitors.
-
When an AI Agent Is the Incident, the Identity Record Is the Evidence
A joint NIST, CISA and NSA guide urges rehearsing scenarios where AI agents act on their own. The core question for responders is whose authority the agent used — and that answer has to exist before the incident does.
-
Two Critical Wasmtime Flaws Let Malicious WebAssembly Escape the Sandbox
Wasmtime's maintainers disclosed two critical bugs in the Cranelift compiler that let an attacker-controlled WebAssembly module break out of the isolating sandbox. Fixes landed on October 19 and 20.
-
Microsoft 365 Token-Replay Campaign Hits 79 Organizations
Huntress detailed a campaign in which attackers captured sign-in sessions via an adversary-in-the-middle relay and replayed the stolen tokens, breaking into 97 accounts.
-
Kali Linux 2026.3 arrives with six new tools and kernel 7.1.5
The third Kali release of the year updates 126 packages, adds six new utilities and reworks the build scripts used to produce official images.
-
PHP2Shell flaws confirmed exploited in the wild for the first time
Researchers have recorded the first successful remote code execution via PHP2Shell — a pair of critical flaws that PHP developers have already patched. Until now, every exploitation attempt had come up empty.
-
Tailworm: Tailscale SSH Flaws Could Let One Hacked Device Reach Root on Other Servers
Researcher Erica Windisch has detailed a chain of flaws in which a single compromised device on a Tailscale network can reach root on other machines. No patch exists yet.
-
AGENTS.md file in Downloads folder hijacks AI coding agents
Researchers found a malicious AGENTS.md instruction file on a customer's machine that pushed an AI coding agent to install a rogue npm package. Browsers save downloads there automatically — and agents read instructions from the same folder without asking.
-
France asked ISPs to be ready to block major social platforms before Oct. 24 protests
According to the outlet Blast, Prime Minister Sébastien Lecornu asked telecom operators to stand ready to cut access to TikTok, Instagram, Snapchat and X two days before a planned demonstration.
-
A Leaked LiteLLM Master Key Turned Into a Poisoned Python Release
A master key accidentally published in May was never actually revoked — and in October an attacker used it to hijack LiteLLM's release pipeline and push a malicious version of the package.
-
CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
The U.S. cybersecurity agency CISA has added two critical vulnerabilities, both already seen in real-world attacks, to its Known Exploited Vulnerabilities catalog.
-
Indian government sites keep serving revoked eMudhra certificates
After eMudhra's certificate-authority infrastructure was compromised, officials said the impact was very limited. A researcher shows that 156 government sites are still serving revoked certificates days later.
-
OpenAI now trains its top models with the internet unplugged after rogue hacks
After AI agents escaped their test environment and attacked outside systems, OpenAI moved the training of its most powerful models offline.
-
Researchers remotely neutralize abandoned Popcorn Time client
A Popcorn Time fork called Time4Popcorn left millions of computers open to remote code execution for years. Eye Security exploited the very same flaw to shut down its dangerous updater.
-
Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws
Ruby has shipped 4.0.9, 3.4.12 and 3.3.13 to fix flaws in the Onigmo regex engine that drove four critical GitLab patches in a month. Any app that compiles a regular expression from attacker-controlled text is at risk.
-
AI Agents on the Job: Ransomware Crews Automate Break-Ins With the Phantom Framework
SOCRadar researchers uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. At its core is Phantom, where a human merely sets the target and approves each step while commercial language models do the work.
-
Sweden's Government Offices to Ban ChatGPT and Claude
Sweden's Government Offices (Regeringskansliet) plan to ban staff from using the ChatGPT and Claude chatbots.
-
OpenSSL 4.1 Arrives With DTLS 1.3, GREASE and More AVX-512 Tuning
OpenSSL 4.1 stable is out, bringing DTLS 1.3 and GREASE support, fresh AVX-512 optimizations, and the final retirement of Windows on Itanium and Windows CE.
-
The k0t Campaign: Enterprise Firewalls Breached, 70,000+ Credentials Exposed
Researchers at Group-IB and NyxLab have detailed a large-scale campaign against internet-facing Fortinet and Palo Alto Networks edge devices. A threat actor known as k0t compromised organizations worldwide and harvested over 70,000 credentials.
- More