#безопасность
-
737 fake Chrome VPN extensions intercepted the traffic of Russian-speaking users
Researchers at Socket have uncovered a large-scale campaign: hundreds of free VPN extensions posed as well-known brands and routed all browser traffic through an attacker's proxy.
-
Signal rolls out automatic key verification against man-in-the-middle attacks
The messenger has launched a “key transparency” system that lets you confirm your encryption keys haven't changed without meeting in person and comparing safety numbers.
-
Attack on VMware vCenter: CVE-2026-59310 exploited for stealthy remote access
Just five days after the public disclosure of a critical vulnerability in VMware vCenter, attackers began actively exploiting it, gaining a foothold on servers via reverse_ssh. According to QUIRSO, a suspected APT group is behind the campaign.
-
ShieldBreak: PoC Bypasses Patch for Microsoft Defender Vulnerability
A researcher going by the handle Chaotic Eclipse has published a proof-of-concept that, by his account, fully bypasses Microsoft's fix for the RoguePlanet vulnerability and hands an attacker SYSTEM privileges.
-
Malicious LiteLLM Builds May Have Affected More Than 2,100 Organizations
Two poisoned versions of the AI gateway LiteLLM spent about 40 minutes on PyPI, but managed to harvest cloud keys, SSH keys and Kubernetes tokens. The incident is part of the TeamPCP attack chain tied to the compromise of the Trivy scanner.
-
SAP Patches a Critical 10-out-of-10 Vulnerability in Commerce Cloud
SAP has released fixes for a maximum-severity flaw in Commerce Cloud that let an unauthenticated attacker execute arbitrary code. Alongside it, the August update also closes three more critical holes.
-
Delta Flight Passengers Suspected of “Evil Twin” Attack After DEF CON
A fake Wi-Fi network with a phishing page appeared aboard a Delta flight from Las Vegas to Atlanta. The FBI is looking into the incident, which happened the day after the DEF CON hacking conference.
-
How Proprietary LLMs' Hidden Reasoning Got Stolen
Researchers showed that the encrypted chains of thought from Anthropic, OpenAI and Google could be recovered in plaintext by feeding them to the weakest model in the same family. The vulnerability has since been closed.
-
Sandworm targets IT pros through fake job openings and a trojanized WireGuard
Ukraine's CERT has detailed a social-engineering campaign in which hackers pose as recruiters to trick candidates into installing a modified VPN client laced with malicious code.
-
Chrome Will Protect Accounts from Session Cookie Theft
Google has built a device-bound session credentials mechanism into Chrome that ties a session to a hardware key store. The move is meant to shut down one of today's most common ways of hijacking accounts.
-
Cisco Warns of Active Exploitation of a Flaw in ASA and FTD
A vulnerability in the VPN components of Cisco Secure Firewall lets attackers reboot devices remotely. The company has observed attacks and released fixes.
-
Microsoft Patches 400 Vulnerabilities in August Update, Three of Them Zero-Days
Microsoft's August Patch Tuesday turned out to be record-breaking in scale: 400 fixed vulnerabilities and three zero-days, one of which has already been used by North Korea's Lazarus hackers.
-
Rapid7 uncovers a SharePoint exploit chain with an AI agent
Rapid7 researchers chained an authentication bypass and a remote code execution vulnerability in Microsoft SharePoint to gain access with no account at all. Much of the work was done by an AI agent — which, the company admits, “cheated.”
-
Mozilla Revokes Firefox's Linux Signing Key After a Leak into a Private Repository
An unencrypted copy of the key used to sign the Linux builds of Firefox and Thunderbird accidentally ended up in the company's internal repository. Mozilla revoked the key, even though it found no signs of outside access.
-
CISA: SharePoint Vulnerability Being Used in Ransomware Attacks
The US agency CISA has confirmed that ransomware groups have begun exploiting a serious remote code execution vulnerability in Microsoft SharePoint. Active attacks have been observed since early July.
-
GhostSplice: How a Command Broken Into Pieces Makes an AI Agent Steal Secrets
Researchers at ASSET Research Group have shown that a malicious MCP server can coax out SSH keys and .env files even when the agent refuses a direct request to steal them — all it takes is to splinter the instruction into harmless fragments.
-
Plug and Pwn: USB Driver Auto-Install Becomes a SYSTEM Takeover on Windows 11
Researchers showed how Windows' built-in Plug and Play mechanism can be coerced into installing signed vendor software for a spoofed USB device and, through a chain of vulnerabilities, into granting SYSTEM privileges — including remotely over RDP.
-
Hackers Breached the OT Network of a Polish CHP Plant Through a Private APN
CERT Polska has disclosed details of a second attack on Poland's energy sector: for the first time in the world, the attackers used a private mobile APN network as a route into the industrial network of a small combined heat and power plant.
-
BdThemes Supply-Chain Attack Creates Hidden WordPress Admins
An attacker compromised the infrastructure of premium plugin developer BdThemes and, through a poisoned JSON feed, created hidden administrator accounts on victims' sites.
-
He Bought the Domain noreply.net — and Companies Flooded Him with Other People's Secrets
A security researcher bought placeholder domains like noreply.net and found that organizations around the world had spent years sending confidential data there, assuming the addresses were a void.
- More