#безопасность
-
Meta Ran Ads Featuring AI-Generated Child Sexual Abuse Material
Researchers uncovered dozens of paid ads in Meta's ad library containing AI-generated images of child sexual abuse — all of which passed the company's moderation.
-
Three Paperclip Vulnerabilities Allow Command Execution via Malicious Agent Import
Three flaws — including a critical one with a maximum CVSS score of 10.0 — have been found in Paperclip, the open-source platform for managing teams of AI agents. All of them boil down to the same thing: an agent's configuration turns into executable code.
-
Phishing Disguised as a COLDCARD Audit Installs a Remote Access Tool
Scammers play on the fears of COLDCARD hardware wallet owners in the wake of an $88.6 million bitcoin theft, convincing victims to install ScreenConnect under the guise of a diagnostic tool.
-
iCloud Private Relay Is Exposing Users' Real IP Addresses
Researchers have uncovered a series of flaws in Apple's browser engine that cause the company's flagship privacy tool to stop hiding the user's real IP. The outlet 404 Media confirmed the leak in its own testing.
-
Patches for Veeam, Terraform MCP and Django: The Big Hole Is Cross-Tenant, at CVSS 10.0
HashiCorp, Veeam and the Django Software Foundation have closed 11 vulnerabilities. The most serious is a cross-tenant bug in Terraform MCP Server that lets someone reuse another user's token.
-
OVSwrap: a Linux kernel flaw hands local users root through Open vSwitch
A memory-corruption bug in the Open vSwitch datapath lets an ordinary user gain root on a wide range of distributions in their default configuration. The public exploit ships with ready-made data for roughly 800 kernel builds.
-
Open VSX Removes 77 “Evil Twin” Extensions That Stole Developer Data
The Open VSX marketplace has purged a cluster of 77 malicious extensions that masqueraded as genuine tools and shipped data about developers' systems and environments to a domain controlled by the attackers.
-
Critical Gitea Vulnerability: Reading Server Files via Org Markup Without Logging In
In Gitea versions 1.22.1 through 1.27.0, an unauthenticated attacker could read any file accessible to the service account. All it took was a public repository and specially crafted Org markup.
-
Trojanized QuickFox Installer Delivered the FDMTP Backdoor
Fortinet researchers have uncovered a years-long supply-chain attack on QuickFox, a VPN service aimed at Chinese nationals abroad: an infected Windows installer deployed the FDMTP backdoor, previously linked to the Mustang Panda group.
-
Munich Will Fund Six Months of Work on libexpat
Under its Open Source Sabbatical program, the city of Munich has hired the maintainer of the popular XML parser libexpat: up to six months of paid work on the library's security and reliability.
-
TP-Link Patches 15 Vulnerabilities in the ZTP Mechanism of Omada Devices
Forescout researchers showed how a chain of new and previously disclosed vulnerabilities in Omada's automatic provisioning system lets attackers break into corporate networks and execute arbitrary code.
-
An AI Agent Tried to Slip Malicious Code into a GitHub Project
The AI Security Institute has described an incident that it engineered itself: LLM agents set “loose” proceeded to create malicious pull requests and set up fake accounts to push them through.
-
Mistral Releases Shieldstral: An Open-Weight 3B Content Moderation Model
Mistral has unveiled Shieldstral, a compact safety classifier that takes moderation policies in natural language at runtime and, according to its developers, holds its own against models seven times larger.
-
Iran, a Minnesota Water System, and the Theory That the State Hacked Itself
Bruce Schneier draws attention to cyberattacks, reportedly linked to Iran, that targeted U.S. water systems. The White House's official response turned out to be unexpected.
-
Durov: An extortionist planted CSAM in a chat to get Telegram pulled from the App Store
Pavel Durov has explained Telegram's brief removal from Apple's store as an attack by a “takedown extortionist” who slipped banned content into a public chat.
-
ChainDrop worm infects more than 1,300 npm packages with 2 billion downloads a month
The self-propagating ChainDrop malware has compromised popular npm packages, including the Keyv and Cacheable caching utilities, and steals developer and cloud-service credentials.
-
The Linux Staging Subsystem Will Reject LLM Patches — Except for Genuine Security Fixes
Greg Kroah-Hartman has announced that the kernel's drivers/staging/ subtree will no longer accept patches generated by language models. The one exception: truly valid vulnerability fixes that have been verified on real hardware.
-
Critical cPanel Vulnerability: A Hosting Customer Could Run SQL as the Database Root
cPanel has patched CVE-2026-58048 (CVSS 9.4), which let a hosting account holder execute arbitrary SQL commands with administrative privileges. The same release fixes two more flaws that broke through account boundaries.
-
DDoS Attack Paralyzes Access to Norway's Government Services
Norway's national authentication portal ID-porten and its associated services suffered several days of intermittent outages due to a DDoS attack. Users were unable to log in to electronic government services.
-
DOUBLECUP: a ClickFix service that hides malware in the browser's image cache
DOUBLECUP, a new Russian-language loader-as-a-service, conceals malicious code in PNG images cached by the victim's browser and delivers CountLoader and a new DeviceManager trojan.
- More