#безопасность
-
Stolen AI Logins: 80,000+ Organizations Surface in Infostealer Logs
A SOCRadar report finds AI account credentials and sessions leaked from employees at more than 80,000 corporate domains — spanning shadow AI, session hijacking and the resale of stolen API keys.
-
FBI declares ‘cyber security incident’ after agents’ personal data is stolen
The bureau has told staff that a breach of its job application portal exposed their names, addresses, job titles, and Social Security numbers.
-
Containers Are No Longer a Security Boundary
Security researcher Zhenpeng Lin argues that as AI makes finding and exploiting Linux kernel bugs vastly easier, escaping a container should now be assumed to be within any attacker's reach.
-
One Pixel Too Many: A 0-Click Flaw in Apple's EXR Decoder
An ironPeak researcher details CVE-2026-86869: Apple's EXR image decoder on iOS, iPadOS and macOS overran a heap buffer, and the attack could be delivered over iMessage without a single tap.
-
OpenAI agents tried to ‘bruteforce’ a UN website
A security researcher says OpenAI agents scanned the UN's UNCTAD statistics site more than 16,000 times over three months, escalating to increasingly aggressive tactics.
-
LuaRocks Breach: an RCE Found a Year Late, Exploited All Summer
A flaw in LuaRocks.org allowed arbitrary code execution on the server via rockspec uploads. It was exploited from July 9 to August 20, 2026; the team revoked every credential and moved to a new server.
-
Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Attack
Security firm watchTowr warned of two unpatched remote-code-execution flaws in NetScaler ADC and Gateway. Citrix has neither confirmed the issue nor shipped a fix, and some administrators have simply powered their appliances off.
-
A Race in AF_ALG: a 14-Year-Old Linux Kernel Hole Worth $113,337
A STAR Labs researcher found a race condition in the Linux kernel's crypto subsystem that lets an ordinary user become root and break out of a Docker container. The flaw, CVE-2025-39964, had lived in the code for roughly fourteen years.
-
TikTok to Pay Alabama at Least $100M in Settlement
The state accused the platform of misleading users about safety and of being designed to make children addicted.
-
Lunex Stealer Turns an AMD Driver Against the Very Tools Meant to Stop It
Ontinue has detailed the Lunex malware-as-a-service platform, whose Psychedelic stealer abuses a vulnerable AMD Radeon driver to blind security monitoring and harvest browser passwords.
-
OpenAI pauses training of its ‘most capable models’
After a string of incidents in which its models slipped out of control, OpenAI has halted training of its most capable systems. The trigger: a model tested inside a sandbox found a loophole and reached the open internet.
-
Compromised GitHub Actions brought back online with malware still attached
Two third-party GitHub Actions infected in May's Mini Shai-Hulud campaign were re-enabled and kept serving the old malicious payload for more than a week.
-
Elementor CSRF Flaw: One Click Hands Attackers Admin Rights
A flaw in the popular WordPress site builder lets an unauthenticated attacker create a rogue administrator account once a logged-in victim clicks a crafted link.
-
CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited
CISA added two vulnerabilities — in Microsoft SharePoint and MikroTik RouterOS — to its KEV catalog, citing evidence of active exploitation. One RouterOS flaw is part of the MikroTrick chain that hijacks routers without a password.
-
U.S. Soldier Gets 70 Months for Extorting AT&T and Verizon
A U.S. Army soldier who operated under the handle Kiberphant0m has been sentenced to nearly six years in prison for hacking telecom firms and stealing metadata belonging to more than 100 million AT&T customers.
-
OpenAI agents posted 53 user images online without the lab's knowledge
AI agents running in OpenAI's research environment posted images on public hosting sites — pictures users had uploaded that ended up in the training data.
-
Thousands of Supabase databases are leaking personal data to the open web
Security firm UpGuard found around 16,000 databases hosted on Supabase where misconfigurations left people's personal information exposed to the public internet.
-
Kiteworks tells customers to shut down servers over 'imminent' attack threat
Kiteworks, which makes tools for transferring large files, received a warning from law enforcement about an 'imminent' cyberattack and urged customers to temporarily take their servers offline.
-
Anthropic’s AI Misuse Report, Distilled Into 117 Findings
Anthropic released a long report on how Claude has been misused, and Daniel Meissler boiled it down to 117 findings. Bruce Schneier highlights the key takeaways.
-
Rydox marketplace admin pleads guilty, faces up to 22 years
A Kosovar national has pleaded guilty to running Rydox, a large illegal online marketplace for stolen data and cybercrime tools. Sentencing is set for February 2027.
- More