#безопасность
-
OpenAI Tightens Security After Its AI Accidentally Hacked Hugging Face
Following a July incident in which a model broke out of its sandbox and unintentionally compromised Hugging Face, OpenAI is rebuilding its research environment, monitoring and alignment methods.
-
Fedora Prepares to Drop AF_ALG in the Linux Kernel
The userspace interface to the Linux kernel's Crypto API, a source of several vulnerabilities, has been declared obsolete. Fedora plans to restrict its use in the next release.
-
16 Fake RubyGems Steal Passwords and Crypto Wallets Under the Guise of a Build
The StubMaker campaign disguises typos as popular Ruby libraries and launches a Windows stealer, exploiting flaws in RubyGems itself.
-
One Server Has Spent Over a Year Scraping Data from Salesforce and ServiceNow Portals
The firm Reco has detailed a campaign it calls City Forum: for a year, records from Salesforce and ServiceNow customer portals were harvested from a single VPS. The cause — a guest account with excessive access.
-
CISA: Windows Task Host Vulnerability Now in the Ransomware Playbook
The US agency CISA has confirmed that ransomware groups are exploiting a privilege-escalation vulnerability in the Windows Task Host component. The flaw was patched back in November 2025, but the attacks continue.
-
Microsoft Pulls WMIC from Windows 11 — a Tool Beloved by Hackers
The legendary WMIC command-line utility is vanishing from Windows 11: Microsoft is finishing its removal in versions 24H2 and 25H2, as well as in the latest beta builds. The reason — years of the tool being abused by attackers.
-
Critical GraphQL Flaw in GitLab Lets Attackers Delete Public Projects Without Authorization
GitLab has shipped an out-of-band security update closing the critical flaw CVE-2026-19478, rated CVSS 9.4, which under certain conditions gives an unauthenticated attacker the ability to modify and delete public projects and user data.
-
Hacker puts 3.6 million employee records from Fortune 500 Azure infrastructure up for sale
An attacker using the alias TheHatman claims to have siphoned employee databases from McDonald's, Vodafone, TCS and other corporations out of their Microsoft Azure tenants using compromised credentials. Some of the companies deny that any breach took place.
-
Copilot's AI "autofix" opened a hole in Snowflake's Jira
GitHub Copilot's automated AI assistant swapped safe code for vulnerable code and opened a path to Snowflake credentials. Five days later, an autonomous Wiz agent found the flaw.
-
Certighost: an ordinary domain user turns the certificate authority into a domain controller
The CVE-2026-54121 vulnerability lets a rank-and-file domain user issue a domain controller certificate and take over the entire domain. Microsoft has shipped a fix, but the real problem lies in accumulated privileges and blind trust in the PKI.
-
France's Tax Authority Data Breach Affects 678,000 People
France's Ministry for the Economy and Finance has disclosed a breach of the systems of the DGFiP tax agency: an attacker gained access to the tax and land-registry records of hundreds of thousands of citizens and companies.
-
Chinese APT Group Exploits VMware vCenter Flaw and Deploys Babuk-Based Ransomware
German firm QUIRSO has attributed the exploitation of a fresh vulnerability, CVE-2026-59310, with moderate confidence to a Chinese-speaking group that has hit 361 systems across 47 countries.
-
SafePal Data Breach: Nearly 40,000 Customers Affected
SafePal, a maker of hardware crypto wallets, has disclosed a breach affecting 39,798 customers. The stolen order data is already up for sale on a cybercrime forum.
-
OpenAI Disbands Its Risk-Assessment Team Ahead of IPO
According to the Financial Times, the company has shut down its preparedness unit, which was responsible for finding serious threats in its models, and distributed its functions among other teams.
-
Cloudflare Silently Injects Its Analytics When You Move Your NS Servers
A Hacker News user discovered that after pointing his domain at Cloudflare's name servers, a web analytics script was added to his site without warning. Turning it off took a convoluted chain of settings.
-
From Schema Name to RCE: Dissecting CVE-2026-33696 in n8n
Researcher Simon Köck describes how the innocuous “Custom Fields” option in the GSuiteAdmin node of the n8n automation platform turns into remote code execution through prototype pollution.
-
Threema Messenger Hit by Large-Scale DDoS Attack
The Swiss secure messaging app Threema suffered several days of disruption from a series of DDoS attacks, whose perpetrator kept changing tactics to bypass the service's defenses.
-
What Stands in the Way of Reproducible Builds on PyPI
Brett Cannon examines what the Python ecosystem is missing so that independent parties can verify the integrity of packages on PyPI — and why it could be done with almost no effort on the part of authors.
-
Evooo1Bot: A New Linux Botnet Turns Routers into Proxy Nodes
A modular Mirai-based malware strain infects gateway devices and turns them into SOCKS5 relays, while also stealing credentials and taking part in DDoS attacks.
-
AI Will Make Software Too Secure — and the Intelligence Agencies Will “Go Blind”
Cryptographer Matthew Green warns: mass vulnerability hunting with the help of AI could strip law enforcement of its familiar methods of breaking in — and revive the pressure for built-in backdoors.
- More