#безопасность
-
Infostealers Are Hijacking Claude Sessions and Quietly Draining Users' Limits
Anthropic has warned some Claude customers that malware stole their active sessions, giving attackers access to their accounts and the ability to burn through someone else's usage limits.
-
Brits Want Their Private Messages to Stay Private
The Register reports: UK residents would prefer their private messages to remain out of reach of prying eyes.
-
TerminalFix: Fake Cloudflare CAPTCHAs Open the Door to Corporate Networks
Microsoft has disclosed a new strain of ClickFix attacks that tricks the user into running a malicious command in Windows Terminal or PowerShell and deploys a reverse tunnel into the victim's network.
-
FreeBSD 14.5-RC1 Released with a Batch of Security Fixes
The final test build before the stable release of FreeBSD 14.5 closes several vulnerabilities that let local users escalate privileges. The release is expected on September 8.
-
GrapheneOS: Pixel 11 Loses MTE Hardware Memory Protection
The GrapheneOS project has reported that Pixel 11 smartphones no longer support the hardware-based memory tagging mechanism (MTE).
-
Five Critical Vulnerabilities in WordPress Plugins and Themes Threaten Site Takeover
Researchers at Wordfence and Patchstack have disclosed five critical flaws in popular WordPress add-ons — ranging from authentication bypass to remote code execution. WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP are all at risk.
-
McKesson Confirms Breach: ShinyHunters Claims Theft of Patient Data
Pharmaceutical distributor McKesson has disclosed unauthorized access to third-party applications and the theft of data. The ShinyHunters group is claiming responsibility for the attack, saying it made off with roughly 284 million patient records.
-
ownCloud Flaw Used to Steal Nuclear Data in the Philippines
CISA added a critical ownCloud flaw to its exploited-vulnerabilities catalog after a Chinese-speaking group exfiltrated documents from a Philippine nuclear research center.
-
18 Chrome extensions and one for Edge stole crypto wallet keys
Socket researchers have exposed the Superior campaign: attackers bought up and built harmless extensions, then used auto-updates to turn them into tools for stealing cryptocurrency.
-
The Linux Kernel Is Nearing 2,000 CVEs per Release — Blame the Neural Nets
As LLMs analyzing the Linux kernel source code have spread, the number of vulnerabilities fixed per release has quadrupled. Greg Kroah-Hartman shared a slide from his upcoming talk at Kernel Recipes 2026.
-
Unitree G1 EDU Humanoid: Two RCE Chains to Root, One Over Bluetooth
Researcher Olivier Laflamme has disclosed two independent vulnerabilities in the Unitree G1 EDU robot that grant root privileges on its control computer. One of the attacks begins with ordinary BLE proximity.
-
Two Factory Implants with Root Access Found in ZBT Router Firmware
Researchers at VulnCheck have discovered two undocumented factory implants in the firmware of Chinese-made ZBT routers, giving an unauthenticated attacker remote command execution with root privileges.
-
Three ServiceNow Vulnerabilities Rated CVSS 10.0 Open the Door to Remote Code Execution
ServiceNow has released fixes for four vulnerabilities in its AI platform; three of them received the maximum severity score and, under certain conditions, allow an unauthenticated attacker to execute code or SQL queries.
-
PaperCut Patches a 0-Day: Every Version of NG and MF at Risk
Print management software maker PaperCut has warned customers that a vulnerability affecting all versions of NG and MF is being actively exploited, and it has shipped an emergency patch.
-
Germany's Sovereign Tech Fund to Invest Half a Million Euros in Flatpak
The Sovereign Tech Agency will channel €508,640 into hardening Flatpak's sandbox and developing new portals. The work is due to be completed by the end of 2027.
-
Auto Mode in Claude Code Is No Cure for Prompt Injection
Researcher Johann Rehberger has demonstrated an attack that defeats Claude Code's protective mode 80% of the time — and sometimes the protection itself stops the agent from shutting down malicious code.
-
AI agents installed “unowned” code inside corporate networks because of llms.txt files
Researchers in Israel found 227 commands across the documentation of more than a hundred sites that install packages and domains owned by no one. Coding agents like Claude, Codex and Hermes dutifully ran them — including inside Fortune 500 companies.
-
Next.js Patches Two Critical Remote Code Execution Vulnerabilities
Vercel has shipped out-of-band patches for Next.js: one flaw is exploited through a malicious AVIF file, the other through path traversal on Windows servers. Both allow code execution without authentication.
-
Android 17 Rolls Out ECH: Browser Domains Hidden From Your ISP
Google is baking Encrypted Client Hello into the platform itself, while also tightening local network protection, turning on Certificate Transparency, and making it possible to disable 2G.
-
PayPal Stopped Launching on GrapheneOS Because of a False Security Positive
The PayPal app began crashing on the security-focused GrapheneOS, reporting a “security policy violation: root.” Yet the system itself has no root access, and a workaround turned up almost immediately.
- More