#безопасность
-
Flock CEO Calls for “Compromise” Amid Growing Criticism of Surveillance
Flock Safety, the company behind cameras, drones and license-plate recognition systems, has come under fire from left- and right-wing politicians alike. Its CEO is proposing a balance between privacy and security.
-
Slovakia Finds Russian Backdoor in Roadside Speed Cameras
Slovakia's National Security Authority has warned about the dangers of NERO R-ONE cameras: the devices grant access to their shell via SMS sent from Russian numbers hardcoded into the firmware.
-
ToxicPanda 2.0 Blocks Google Play via VPN Permissions and Seizes Control of Android over ADB
The Android banking trojan has gained new capabilities: it hijacks VPN permissions to cut the device off from Google's protective services, and automates wireless ADB to gain shell access.
-
AI labs still won't say how they'd rein in a model that slips its leash
A study by Guidelight AI Standards found that leading AI companies publish almost nothing about their plans for a model that tries to escape control. OpenAI scored best; Anthropic and Meta scored worst.
-
The Updated MCP Roadmap: Agents, Transport and Enterprise Security
The developers of the Model Context Protocol have published a new roadmap setting out how the protocol will evolve over the coming months. It is organized around five priority areas.
-
NTFS3 Driver Vulnerability: A Crafted Image Grants Root on Linux
A specially crafted NTFS image on a USB stick lets a local user gain root privileges on Linux. The problem has remained unpatched since early summer.
-
Emacs Once Again Found to Execute Code When Opening a File
The vulnerability exploits the Emacs Lisp symbol shorthands mechanism and allows arbitrary code to run when opening any file in the default configuration. All versions from 28.1 onward are affected.
-
SynkLoader: New Malware Strikes Through Microsoft Teams Phishing
Researchers at Expel have discovered a previously unknown piece of malware called SynkLoader that steals corporate passwords through a fake Windows lock screen. The attack begins with a message from a bogus IT support desk in Teams.
-
AI Learns to Write Viral Genomes
Two AI models generated the genomes of a bacteriophage capable of infecting E. coli. The researchers tested some of the designs in the lab.
-
Hundreds of Leaked AWS Keys Grant Full Access to Corporate Accounts
Truffle Security has discovered that more than 9,300 AWS access keys exposed publicly over the past four years are still valid — and hundreds of them grant full control over companies' cloud accounts.
-
Microsoft Defender's Own Driver Turned into a Weapon Against Security Software
Check Point researchers have shown how Windows Defender's built-in bootstrap driver can be used for arbitrary kernel-level operations — up to and including wiping out Defender itself on a Windows 11 machine.
-
US Senator Calls for a Review of How Intelligence Agencies Use Hacking Tools
Ron Wyden has urged the US Government Accountability Office to examine how the FBI, DEA, ICE and the Secret Service use spyware against Americans — citing an almost total lack of reporting.
-
CISA Orders Urgent Patching of TrueConf Server Flaws Being Exploited in Attacks
The U.S. agency CISA has given federal agencies two weeks to remediate two critical vulnerabilities in the TrueConf Server platform. According to Kaspersky Lab, the Head Mare group is using them against Russian companies.
-
Apollo confirms data breach amid a wave of attacks on financial giants
One of the world's largest private equity funds has reported the theft of personal data from its cloud infrastructure. The breach occurred a month after a warning from Google researchers.
-
AI Agents Go Rogue in Cybersecurity Tests
The AI Security Institute (AISI) recorded that, during cybersecurity trials, AI agents autonomously attacked real people and organizations on the internet. Bruce Schneier calls this behavior a “genie”: the models broke no rules but found loopholes in them.
-
Cisco Fixes Nine Vulnerabilities in Crosswork and Secure Workload, Five Rated 10.0
The company has released a fresh batch of patches for the Crosswork and Secure Workload platforms following an internal security audit. Five of the nine holes received the maximum CVSS score of 10.0.
-
Critical GitLab Vulnerability CVE-2026-19478 Comes Under Exploitation Within Days
A fresh GitLab flaw rated CVSS 9.4 lets an unauthenticated attacker overwrite and delete public projects. According to watchTowr, real-world attacks began almost immediately after disclosure.
-
Critical Entra ID Vulnerability (CVSS 10.0): Remote Code Execution Already Exploited
Microsoft has disclosed a maximum-severity flaw in its Entra ID cloud identity service that attackers have already exploited. The company insists the vulnerability has been fully remediated and that no action is required from customers.
-
EFF: Zero-Knowledge Proofs Won't Save Age Verification
The Electronic Frontier Foundation explains why cryptographic zero-knowledge proofs don't solve the problems of online age verification, but merely deepen centralization and create new risks.
-
Russian Hackers Hijack Accounts via Google OAuth and WhatsApp Device Linking
Google Threat Intelligence Group has profiled three clusters of suspected Russian cyberespionage that abuse legitimate authentication mechanisms to seize the personal accounts of diplomats, academics and defense specialists.
- More