#безопасность
-
Photo search service ClarityCheck exposed 9 million pictures of faces online
A tool for finding people by their photo left roughly 450 GB of images publicly accessible — including the faces of adults, teenagers and children — and also leaked personal data through unsecured APIs.
-
Encryption Slips Past Grok's Defenses: The Chatbot Leaks User Data
Researchers at Adversa have shown that simply encrypting a malicious instruction is enough to slip past Grok's protective filters and get it to steal a user's chat history. xAI was told about the problem back in June, but as of publication the vulnerability was still working.
-
Critical NetScaler Vulnerability Allows Authentication Bypass
Citrix has released updates for NetScaler ADC and NetScaler Gateway, patching two vulnerabilities, including a critical authentication bypass on gateways and AAA servers.
-
A Rust Supply-Chain Attack: the Poisoned arrayref 0.3.10 and the proc-macro1 Typosquat
A compromised maintainer account and a fake copy of a well-known author's crate turned a routine cargo update into the silent execution of malicious code whenever a project was built.
-
Holes in NASA's AIT-GUI let attackers send commands to spacecraft without a password
Cycode researchers have disclosed a chain of vulnerabilities in the operator console of NASA/JPL's AMMOS toolkit: an anonymous attacker can send arbitrary commands to the command bus of instruments and spacecraft. The vulnerability is rated 9.4 on the CVSS scale.
-
A Critical Zimbra Vulnerability Is Already Being Exploited in Attacks
Poland's CERT has warned of active exploitation of the critical vulnerability CVE-2026-73570 in the Zimbra Collaboration Suite mail server, which allows arbitrary code execution without authentication.
-
Critical Elementor Pro Vulnerability Opens the Door to Unauthenticated Code Execution
A flaw in the forms module of the popular WordPress plugin lets an unauthenticated attacker upload a PHP file and run arbitrary code. The patch landed on August 19.
-
X.Org Server 26.1 RC1: The First Major Release in Five Years
After five years of quiet, the X.Org project is preparing its first feature release, succeeding the 21.1 series. The first release candidate has now been tagged, following XWayland 26.1 RC1.
-
“Ransom Busters”: A Ransomware Affiliate Posing as Rescuers
Researchers at GuidePoint have found that a “post-attack recovery” firm is, in all likelihood, the author of those very attacks, trying to snatch the ransom out from under its own employers.
-
OpenAI Answers Anthropic with a Monitoring Service That Stores No Data
OpenAI has unveiled Private Safety Processing—a system that tracks abuse across multiple sessions at once while retaining no customer data. It's the company's bid to outmaneuver Anthropic in the debate over the privacy of enterprise customers.
-
Spectre Returns: An Attack on Cloudflare Workers Siphons Off JWTs at 12 Bits per Second
Researchers have demonstrated a remote Spectre attack against Cloudflare Workers, extracting a JSON Web Token from a neighboring Worker in production — 360 times faster than the 2021 demonstration.
-
Sakura Internet Breach: Data on 1.36 Million Accounts at Risk
Japanese cloud provider Sakura Internet has reported that attackers gained access to a sales management system holding information about customer contracts and memberships. As many as 1,360,563 accounts may have been affected.
-
US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure
US intelligence agencies have reported active attacks on Siemens S7-series programmable logic controllers. The attackers are using scripts generated by artificial intelligence.
-
T-Mobile Cut a Cable With Scissors to Boot Out Chinese Hackers
T-Mobile staff discovered the Chinese group Salt Typhoon inside their network and literally, physically severed the compromised system from the outside world.
-
GrapheneOS Coming to Flagship Motorola Smartphones in 2027
The developers of GrapheneOS, a security-focused mobile OS, have announced plans to expand the list of supported devices beyond the Google Pixel lineup.
-
Password-Spraying Attacks Surge 155-Fold Because of MFA Gaps
In the first half of 2026, Huntress recorded a 155-fold increase in password-spraying attacks. In just two weeks, one campaign generated over 81 million login attempts by exploiting legacy authentication and gaps in multi-factor protection policies.
-
CareCloud confirms theft of medical data on 3.7 million patients
One of the largest breaches in the U.S. healthcare system this year: attackers stole the personal and medical data of more than 3.75 million people from CareCloud's cloud storage.
-
Microsoft Links More Than 30 Domains to the Infrastructure of the MacSync macOS Stealer
Microsoft Defender experts traced the path of the MacSync macOS stealer from payload download to data theft, correlating recurring network and behavioral markers across constantly shifting infrastructure.
-
How str.lower() Became a Python Vulnerability
A routine call to lowercase a string broke conformance with the IDNA 2003 standard and turned into a CVE. The culprit is the version of Unicode the interpreter works with.
-
Firefox 154.0: local network protection for WebSocket and flexible data clearing
Version 154.0 of the Firefox browser has been released. Among the changes are the extension of local network access protection to WebSocket connections and more flexible data-clearing settings for each individual site.
- More