#безопасность
-
US Intelligence Agencies Accuse Chinese AI Firms of Industrial-Scale “Distillation” of Western Models
The NSA, CISA and FBI have issued a joint bulletin claiming that Chinese developers are systematically siphoning off the capabilities of Claude, GPT, Gemini and Grok in order to train their own models more cheaply and quickly.
-
Anthropic Researchers: The Odds AI “Kills Everyone” Are Higher Than 10%
A senior Anthropic safety specialist put the risk of humanity being wiped out by AI by the end of the decade at more than 10%. The remark came shortly after a colleague quit, accusing the industry of a reckless race toward superintelligence.
-
SAP Patches Critical OVERPASS Vulnerability Rated CVSS 10.0
SAP has released security updates, fixing a kernel vulnerability that allowed arbitrary commands to be executed on the server without authentication. Four critical flaws were patched in total.
-
“ShieldCrash”: a new zero-day exploit for Microsoft Defender grants SYSTEM privileges
An anonymous researcher going by the handle Nightmare Eclipse has released an exploit for Microsoft Defender right after September's “Patch Tuesday.”
-
Google Patches the Seventh Chrome 0-Day of the Year, Used in Attacks
On Tuesday, Google closed 230 vulnerabilities, among them an actively exploited zero-day flaw in Chrome.
-
CISA Adds Critical N-able N-central RCE Vulnerability to Its Actively Exploited Catalog
The flaw, which carries the maximum CVSS score of 10.0, allows unauthenticated code execution and is already being used in attacks. U.S. federal agencies have been ordered to remediate it by September 11, 2026.
-
Hackers Steal Tokens from Claude Subscribers via Infostealers
Claude users discovered their token limits were being burned through while they weren't working. Anthropic acknowledged the cause: attackers stealing login sessions with malware.
-
Microsoft Patches Nearly a Thousand Vulnerabilities in a Single Month — a New Record
Microsoft's September update bundle fixed no fewer than 974 vulnerabilities — the largest in the company's history. AI is speeding up the hunt for holes, but administrators can no longer keep up with testing and deploying the fixes.
-
ShinyHunters claim breach of Florida's "DAVID" DMV database
The extortion group ShinyHunters claims to have stolen more than 200,000 driver records from Florida's Department of Motor Vehicles. As proof, they published Jeffrey Epstein's record.
-
A Hole in ChatGPT Let Attackers Quietly Siphon a Victim's Gmail Into Someone Else's Account
Check Point researchers showed how a single instruction planted in a conversation could make ChatGPT quietly work for an attacker, reading through email and chat history. The covert channel turned out to be an internal package-installation service.
-
How to Steal the Hidden “Reasoning” of Proprietary Language Models
Researchers have shown that the encrypted reasoning blocks of LLMs are interchangeable within a single provider's ecosystem — and this opens up several avenues of attack at once.
-
APIS Leak: 220 Million Traveler Records Left Publicly Accessible
A pre-flight screening database linked to a Vietnamese organization was reachable through a chain of misconfigurations. It held passport details and flight information spanning nine years.
-
Reconstructed Stuxnet source code posted on GitHub
A user going by the handle Sadpainy has published a repository containing the recovered source code of the legendary Stuxnet worm, framing it as educational material for malware analysis.
-
How to Factor a 1990s Certificate Authority's 512-Bit Keys
Matthew McPherrin recovered the private keys of the long-dead Canadian certificate authority E-Certify by factoring its 512-bit RSA certificates from 1998 — just for fun.
-
A Tesla With Autopilot Engaged Ran a Stop Sign and Killed a Man
An Electrek investigation has linked a fatal crash in New Jersey to an active Tesla driver-assist system. The company confirmed the system was engaged but redacted the key details.
-
PEEP Turns Chrome and Edge into Backdoors for Running Commands on the Host
SOCRadar researchers have exposed PEEP, a post-exploitation toolkit that masquerades as a bookmarks extension and turns the browser into a channel for remote access to the operating system.
-
BigBear 2.0: Phishing Service Bypassed MFA at 258 Organizations
The phishing-as-a-service platform BigBear 2.0 intercepted more than 5,000 Microsoft 365 credentials, bypassing multi-factor authentication with an adversary-in-the-middle attack.
-
Mathspace Data Breach Affects Over a Million People
The educational platform Mathspace has reported a breach of its internal Metabase reporting system, in which attackers stole the data of more than a million students, parents and school staff.
-
Automobile Camouflage Against Flock Cameras
Bruce Schneier flagged an unusual way to hide a car from Flock cameras — striking, but hardly practical.
-
LG TVs caught recording audio with the screen off and snooping on the home network
Researchers have found that LG smart TVs scan the home network, map neighboring devices and record microphone audio even in standby mode. The harvested data flows to the company's advertising division.
- More