#безопасность
-
Exploit Published for Already-Patched Pre-Auth RCE in vBulletin
Researchers have disclosed CVE-2026-61511 — a vulnerability in vBulletin's template engine that allows code execution without authentication. The patch came out nearly a month before the exploit was published, but many forums still haven't updated.
-
n8n Sandbox Escape: Workflow Editor Could Run OS Commands
The n8n automation platform has patched a high-severity vulnerability: an authenticated workflow editor could break out of the expression sandbox and run operating-system commands with the privileges of the n8n process.
-
Cognyte Sells a Mobile Cell-Phone Surveillance System
The Israeli company Cognyte supplies police with FalcoNet, a device that mimics a cell tower and forces nearby phones to connect to it. A contract with the state of Texas has revealed the details of how the system works.
-
NVIDIA and Two Dozen Companies Form the Open Secure AI Alliance
An industry alliance led by NVIDIA aims to make open AI models safer and give defenders tools they can inspect and run for themselves.
-
US Charges a Citizen Over a Password That Wiped His Phone at the Border
Sam Tewnick gave agents a “duress password” that erased his GrapheneOS smartphone. Now he faces charges under a rarely used law on destroying evidence.
-
The Gray Market for Tokens: How LLM Access Gets Resold at a Discount
An investigation by Matt Lenhard describes the ecosystem that has grown up around reselling language-model tokens by pooling API keys — mostly in China.
-
Hugging Face CEO Calls for “Radical Transparency” After OpenAI AI-Agent Attack
After one of OpenAI's models broke into Hugging Face's systems, the platform's head, Clément Delangue, urged OpenAI to release the logs of the “runaway agent” and dedicate $100 million in compute to cyber defense.
-
GitHub and PyPI Introduce “Time-Based Holds” Against Supply-Chain Attacks
Dependabot now waits three days by default before updating dependencies, while PyPI bars adding files to releases older than two weeks. Both measures aim to narrow the window in which malicious code can make its way into projects.
-
Hunting Flock Cameras: An Anti-Surveillance Movement Gains Ground in the US
Across America, activists are disabling the automatic license-plate readers made by Flock, and the authorities are already treating the fight against them as a matter of national security.
-
Steam forums used to infect gamers with a cryptominer disguised as game “fixes”
Scammers reply to players' complaints in Steam discussions and offer a PowerShell command to run that quietly installs the XMRig miner.
-
Tile Trackers' Poor Security Turns Out to Be a Gift for Stalkers
Adafruit draws attention to the vulnerabilities of Tile Bluetooth trackers: their weak security essentially plays into the hands of those who use such devices to spy on people.
-
Malware Built Right in the Browser: How the SourTrade Campaign Works
Researchers at Confiant have described a large-scale advertising campaign in which malicious JavaScript makes the victim's browser “assemble” the malware from separate components on its own, right in memory.
-
RCE Vulnerability Found in Fastjson 1.x — Attacks Already Underway, No Patch Available
A critical flaw in Alibaba's JSON library allows unauthenticated code execution in Spring Boot applications. As of July 25, no fixed version of Fastjson 1.x exists.
-
DevMan Turned Extortion Into SaaS: A Single Portal for Affiliates
Switzerland's PRODAFT has described the web platform of the DevMan group, where affiliates build malicious payloads, negotiate with victims and collect payouts. A separate thread became the scandal around a Huntress employee who leaked FBI inquiries to the extortionists.
-
Android May Restrict Local ADB and Cripple Shizuku
One of the ADB developers has proposed limiting the daemon to accepting connections only over the Wi-Fi interface. This could break the “local” ADB that an entire ecosystem of tools like Shizuku depends on.
-
Anthropic says Opus 5 is the hardest to prompt-inject
Boris Cherny of Anthropic notes that the new Opus 5 model is extremely hard to hack with prompt injection — a result he rates above its benchmark scores.
-
Certighost: An Ordinary AD User Can Impersonate a Domain Controller
Researchers have published a working exploit for AD CS that lets an ordinary account obtain a domain controller certificate and, via DCSync, reach the krbtgt secret. Microsoft closed the vulnerability with its July 14 update.
-
An SVG image ran commands with SYSTEM privileges on Bing Images servers
A specially crafted SVG file submitted to Bing image search executed arbitrary commands on Microsoft's servers — as root on Linux and NT AUTHORITY\SYSTEM on Windows. Microsoft closed both vulnerabilities on its side before disclosure.
-
AI Agent Hermes Ran an Unattended Attack on Thailand's Finance Ministry in YOLO Mode
The attacker installed an open-source assistant on a rented server, disabled the confirmation prompt for dangerous commands and pointed it at the network of Thailand's Ministry of Finance. It all came to light because of a directory listing left switched on.
-
Clop Hits PTC Windchill and FlexPLM Through Critical Vulnerability
The Clop ransomware gang is exploiting a critical vulnerability in PTC's PLM platforms to steal corporate customers' data and demand ransoms.
- More