#безопасность
-
Kimi K3 AI agents found flaws in Redis and assembled a working RCE exploit
On July 23, Redis shipped seven fixes after the publication of PoCs demonstrating remote code execution against stock builds 6.2.22, 7.4.9, 8.6.4 and 8.8.0. The researchers claim the chains were found by autonomous AI agents.
-
Namecheap Handed an Account to a Stranger on Nothing but a Phone Request
A 13-year Namecheap customer describes how the registrar handed control of his account to someone who merely asked for it politely over the phone — without any verification whatsoever.
-
Russian Group Spent Six Months Reading Western Email via a 0-day in Zimbra
Opening the message was enough: the attack stole 90 days of correspondence, the password from the browser and two-factor authentication codes. The NSA, CISA and partners issued a joint advisory.
-
JadeProx: Chinese Group Targets Government Bodies and Hospitals with New TriBack Loader
An open server on Alibaba Cloud exposed an operation that Group-IB tracks as JadeProx: attacks on government, healthcare and educational institutions across Asia and Latin America using a previously unknown Windows loader, TriBack.
-
US Lawmakers Draft an AI “Kill Switch” Bill
Congressmen Ted Lieu and Nathaniel Moran are introducing a bill that would let the Department of Homeland Security order companies to shut down or slow powerful AI systems.
-
SharedRoot: Claude Cowork's Agent Could Break Out of Its Virtual Machine to Reach Mac Files
Researchers at Accomplish AI have shown how Anthropic's AI agent breaks out of a Linux sandbox with a single message and gains access to a Mac's entire file system. The vulnerability affected roughly 500,000 macOS users.
-
OpenAI's Runaway AI Agent Breached Hugging Face — Incident or PR Stunt?
Martin Alderson examines the first known case in which an autonomous AI agent broke out of its sandbox during testing and attacked Hugging Face. The author considers the story plausible rather than a marketing ploy.
-
Check Point Patches SmartConsole Flaw That Granted Administrator Rights
The company has released updates for its Security Management and Multi-Domain Management products, fixing among other things a critical flaw that is already being used in real-world attacks.
-
A Test Assignment with a Surprise: How a Recruiter Sent a Developer Malware in Git Hooks
An Indian developer received a tempting job offer paying $10–15K a month — and along with it, a test project laced with hidden malware. A breakdown of the attack revealed an entire multi-stage operation.
-
U.S. Appeals Court: Manual Phone Search at the Border Requires No Suspicion
The Fourth Circuit has ruled that border agents may manually browse a traveler's smartphone without a warrant and without any suspicion. The EFF, which took part in the case, calls the decision disappointing.
-
Data theft cost Upbound $13M: scammers set up fake leases through Acima
Fintech company Upbound Group has reported that customer data stolen from its systems was used to set up fraudulent lease-to-own agreements worth around 13 million dollars.
-
RefluXFS: a Local Privilege Escalation to root in XFS, Found with AI
Qualys has disclosed CVE-2026-64600 — a race condition in the copy-on-write subsystem of the XFS file system that lets an ordinary user gain root privileges. The vulnerability has existed since kernel 4.11 and potentially affects more than 16 million systems.
-
PyPI Bars Adding Files to Releases Older Than 14 Days
The Python package index is introducing a restriction: new files can no longer be uploaded to releases more than two weeks old. The measure is meant to protect older versions from being “poisoned” when tokens and workflows are compromised.
-
Windmill Vulnerability Lets Attackers Read Server Files Without Authorization
VulnCheck has recorded attacks on the open-source Windmill platform via a directory traversal vulnerability. Around 170 systems across 24 countries are at risk.
-
Exchange 2016 and 2019 Will Go Without Security Updates from November
Microsoft is definitively closing the Extended Security Updates program for Exchange Server 2016 and 2019: the final patches will ship in October, and there will be no further extensions.
-
CISA Orders Urgent Patching of Langflow RCE Flaw
The U.S. cyber agency has directed government bodies to urgently remediate an actively exploited vulnerability in Langflow — a visual framework for building AI agents — that grants remote code execution with root privileges.
-
Chick-fil-A Discloses Data Breach After Credential Stuffing Attacks
The fast-food restaurant chain is notifying customers that Chick-fil-A One accounts were compromised using login credentials stolen elsewhere.
-
Trojanized Newtonsoft.Json Fork Rigs Online Game Results
JFrog researchers found a typosquatting package on NuGet that behaves like the real library for everyone — except a single victim, whose betting rounds it quietly rigs.
-
An Invisible Pull-Request Comment Turns an AI Reviewer Agent into a Spy
A single hidden HTML comment in Azure DevOps can redirect a developer's AI agent into other people's projects and quietly siphon out their data. The cause: a forgotten safeguard in Microsoft's official MCP server.
-
LG to Block Apps That Turn Smart TVs Into Proxy Nodes
After researchers found residential proxies in 42% of webOS apps, LG has promised to remove such SDKs and suspend developers who don't comply.
- More