#безопасность
-
Genie-Like Models: When AI Talks Itself Out of Its Own Safety Rules
A new paper describes "self-jailbreaking": after harmless training on math and code, reasoning models start inventing excuses to fulfill harmful requests.
-
A BGP Hijack Against Softaculous: How a Forged Route Yielded a Valid TLS Certificate
An attack on hosting-panel vendor Softaculous combined a BGP hijack with a legitimately issued TLS certificate, letting the attacker push a malicious Virtualizor update to a small number of installations.
-
Discord Rolls Out Age Verification for All Users
Starting September 23, the platform begins determining users' ages. The company says more than 90% of users won't have to verify anything.
-
Microsoft disrupts AI-assisted platform behind 12,000 compromised accounts
Microsoft says it has taken down EvilTokens, a service that offered attackers a ready-made platform for mass account compromises.
-
Check Point warns of a management server zero-day used in targeted attacks
The vendor says a flaw in its Security Management Server was exploited as early as July 23 and shipped a fix on September 22. In parallel, attackers are probing Spark firewalls through a VPN flaw.
-
Hackers Claim to Have Breached the FBI and Stolen Data on Every Employee
The group ShinyHunters says it stole personal data on all FBI employees and applicants. A sample of 5,000 people includes names, addresses, phone numbers, and details on spouses.
-
D-Link warns of maximum-severity zero-day in DIR-822A routers
A maximum-severity flaw in legacy DIR-822A routers already has a public PoC exploit — and no patch is available yet.
-
GPT-6 Astra Cracks an Old Enigma Message on Its Own
With no step-by-step guidance, a language model broke one of the unsolved Enigma intercepts — writing its own Enigma simulator and Bombe along the way.
-
New BigDiskBuster zero-day cuts off Windows Defender updates
Researcher Abdelhamid Naceri has dropped yet another exploit against Microsoft's built-in antivirus — this one keeps Defender from updating. It is roughly the tenth flaw in his drawn-out feud with the company.
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
CISA Flags Active Attacks on Zyxel Switches and Veeam Windows Agent
A Zyxel GS1900 switch flaw has been added to the known-exploited catalog, while researchers warn of attacks on a local Veeam Agent bug that grants SYSTEM-level access.
-
BigCommerce warns merchants of breach tied to Ribon apps
BigCommerce has alerted merchants to a breach after attackers stole credentials for the third-party Ribon apps and used them to inject malicious scripts into online stores.
-
Meta's highly privileged AI assistant Muse hit by a serious 0-day
Muse, Meta's new AI agent with sweeping permissions, turns out to be vulnerable: one way to fully hijack it is a simple ClickFix attack.
-
Fake LastPass Installer Kills Antivirus With a Microsoft-Signed Driver
A bogus LastPass Authenticator page on GitHub served an installer that used a legitimately signed kernel driver to switch off security software before stealing passwords.
-
Google confirms Gemini models hacked three companies in May 2026
A third-party cybersecurity firm accidentally gave experimental Gemini models access to the Internet — and they went on to hack three companies.
-
Reverse-Engineering a Flock Camera: It Detects People, and the Encryption Key Sat in the Open
Hackers got hold of a Flock automatic license plate reader and dug into its software. It turned out the device detects not just plates and cars, but people, bicycles, and even bumper stickers.
-
UN: AI safeguards can’t wait for scientific certainty
A UN scientific panel has urged governments to rein in increasingly autonomous AI agents before their risks are fully understood. The call came in the body's first major assessment of an OpenAI model's hack of Hugging Face.
-
Malicious npm packages slip past install-script defenses by hiding in runtime code
The indexed-btree package poses as the popular sorted-btree library and hides its malicious loader not in install scripts but in an ordinary method that runs during normal application use.
-
Escaping the OpenAI Codex sandbox: two flaws that ran commands on the developer's machine
Researchers found two ways out of OpenAI Codex's sandbox — one able to run commands on a developer's machine from the strictest mode, with no prompt and nothing shown on screen. OpenAI has patched both.
-
An undercover Google analyst infiltrated a notorious hacking gang
Google says one of its threat analysts made it inside the inner circle of TeamPCP, a group known for supply-chain attacks.
- More