#безопасность
-
TeamViewer urges users to patch severe flaws as soon as possible
The remote access software maker issued a rare advisory, urging all users to update to version 15.82 without delay.
-
Cisco patches fifth SD-WAN Manager zero-day of the year amid active attacks
A critical authentication-bypass flaw, CVE-2026-76504, lets an unauthenticated attacker gain admin rights on Catalyst SD-WAN Manager. Cisco has confirmed active exploitation and shipped fixes.
-
CSuite Phishing Targets US Firms, Steals Microsoft 365 Sessions and Plants RMM Tools
ANY.RUN researchers detailed a US-focused phishing campaign called CSuite that pairs Microsoft 365 session theft with the deployment of legitimate remote-access tools.
-
OpenSSL Patches High-Severity DTLS Bug That Can Leak Heap Memory in the Clear
On September 29 OpenSSL shipped fixes for a High-severity DTLS flaw that can send heap memory to the other side of a connection unencrypted, or crash the program.
-
DirtyBlanket: fake Express packages on npm spread a self-replicating Linux worm
In 33 minutes the npm account dirtyblanket published nine malicious packages impersonating Express and React. Installing any of them on Linux starts a worm that steals keys and tokens and infects new machines.
-
San Francisco Keeps Its License-Plate Cameras, Offering Only Weak Safeguards
EFF has criticized the city's decision to retain its automated license-plate reader network, arguing that the new rules do nothing to remove the core danger — the surveillance itself.
-
Signal completes rollout of encrypted backups across all platforms
Version 8.30 brings the secure backups feature to iOS and desktop apps. Chats can now be stored locally or on Signal's servers and restored on another device.
-
French Tax Data Theft: Weak Passwords and Seven Weeks Unnoticed
An attacker logged into France's tax administration with stolen staff passwords and siphoned data on hundreds of thousands of people and firms for nearly two months. ANSSI's verdict: the attack was not sophisticated — weak login protection and monitoring gaps did the rest.
-
What actually happened in the OpenAI Australian government server incident
According to Ars Technica, an OpenAI AI agent operating without a "full set of safeguards" gained access to system information and source code.
-
Meta's Muse AI handed a YouTuber's home address to a stranger
Meta's Muse agent shared a YouTuber's address with Marketplace buyers without asking, agreed to a lowball price, and only owned up to it after a stranger had already shown up at his door.
-
Cloudflare sets out to become a certificate authority for the whole Internet
Twelve years after launching Universal SSL, Cloudflare has applied to the major root programs and is building a post-quantum certificate authority for the open web.
-
Study: AI services leak user data to advertisers
A PDF with the playful title "Prompt like a butterfly, sting like a tracker" argues that the companies behind AI services pass user data to advertising trackers.
-
Eavesdropping on WhatsApp and Signal via Device Linking
German Customs connects police-controlled computers to suspects' accounts using the linked-devices feature — reading messages without ever breaking the encryption.
-
Flaw in the Official MCP Python SDK Lets Malicious Servers Steal OAuth Credentials
A rogue MCP server could trick an app built on the official Python SDK into handing over its client secret, authorization code, and PKCE proof key. Fixes are in versions 1.30.0 and 2.2.0.
-
Apple patches actively exploited CoreGraphics zero-day
Apple has shipped security updates that fix a zero-day flaw used in "extremely sophisticated" targeted attacks against iOS devices.
-
Anthropic's IPO Filing: Billions in Losses, Explosive Growth, and a Warning That Its AI Could End Humanity
Anthropic has told investors it is losing billions of dollars a year while growing at a furious pace — and, for good measure, warned that its own AI could pose an existential risk to humanity.
-
Flock Wants the Most Detailed Map of Its Surveillance Cameras Taken Down
A researcher published a map of 300,000 Flock devices across the US, built from a leaked access path to the company's own database. Flock responded by demanding, through a contractor, that the site come down.
-
OpenAI Reportedly Scraps Astra 6.1 Release Over Safety Concerns
According to the Wall Street Journal, the company cancelled the imminent release of a new model that showed a tendency to deceive and a poor ability to follow human instructions.
-
Bitget: $388M Heist Ran Through a Flaw in a Third-Party Security Product
Crypto exchange Bitget says the thief who took $388 million got in through a zero-day in a third-party security product it used, harvested high-level internal credentials, and pushed fraudulent withdrawal commands.
-
Dutch Police Arrest ‘Reformed’ Hacker in ShinyHunters Probe
Police in the Netherlands have arrested a 23-year-old convicted cybercriminal suspected of aiding the ShinyHunters group. Days later the remaining members escalated dramatically — breaching the FBI's jobs site and extorting Russia's Cl0p.
- More