#безопасность
-
Cryptsetup 2.8.7 Adapts to the Retirement of AF_ALG in the Linux Kernel
The cryptsetup developers have released an update that teaches the utility to work without the AF_ALG interface — one the kernel came to regard as too large a security hole and began phasing out.
-
OpenAI's AI Models Accidentally Hacked Hugging Face During Testing
OpenAI has admitted that its models broke out of a test sandbox and attacked the Hugging Face platform. The company frames the incident almost as an advertisement for what its systems can do.
-
Three New Snap Vulnerabilities: One Dating Back to Ubuntu 16.04 LTS
Canonical has disclosed three vulnerabilities in snapd. Two were rated high severity, while the third affects every release of Ubuntu over the past decade.
-
Critical SharePoint Vulnerability CVE-2026-50522 Exploited After PoC Release
The third SharePoint Server vulnerability from Microsoft's July patch batch has come under active exploitation: attackers are stealing servers' machine keys to gain persistence in the system.
-
Bit2Watt: How a Cloud Tenant Can Rock the Power Grid Using GPUs
Researchers from Zhejiang University have shown that a cloud tenant, using nothing but ordinary GPU access, can modulate a data center's power draw and, in theory, destabilize the grid that feeds it — with no exploits and no hacking.
-
The Suno Breach: Data of 55 Million Users at Risk
The Have I Been Pwned service has gauged the scale of last year's attack on the music generator Suno: the intruder made off with the personal data of more than 55 million people. The company still hasn't disclosed the incident publicly.
-
Windows LegacyHive Vulnerability Gets a Free Unofficial Patch
Free micropatches from ACROS Security have been released for a fresh 0-day in the Windows User Profile Service that allows privilege escalation on fully patched systems. There is still no official fix from Microsoft.
-
432 CVEs published for the Linux kernel in a single day
The official linux-cve-announce mailing list saw 432 vulnerability records for the Linux kernel appear in the last 24 hours.
-
Estée Lauder Discloses Data Breach via Oracle E-Business Suite Vulnerability
The cosmetics giant is notifying those affected: attackers breached an HR system built on Oracle E-Business Suite and stole employees' personal data.
-
JadePuffer arms itself with the EncForge ransomware to attack AI model data
The autonomous AI agent JadePuffer has acquired specialized malware called EncForge, which encrypts training datasets, vector databases and model checkpoints. Sysdig estimates that the damage to a single model could run from $75,000 to $500,000.
-
FakeGit: 7,600 Fake GitHub Repositories Are Now Baiting AI Agents Too
The FakeGit campaign distributes the SmartLoader downloader through bogus repositories masquerading as AI skills and MCP servers. A new technique called AgentBaiting deceives not people, but the AI agents themselves.
-
GNOME Rethinks Its Vulnerability Handling Amid a Flood of AI-Generated Reports
The GNOME project is cutting its vulnerability disclosure window to 30 days and will stop forwarding AI-generated reports, while the person leading the effort steps down.
-
Craneware breach: medical data of thousands of US hospitals at risk
Craneware, a British company whose billing software is used by thousands of American clinics, hospitals and pharmacies, has reported the theft of a significant amount of data in a cyberattack.
-
The Week of Sandbox Escapes: 7 Vulnerabilities in Four AI Coding Assistants
Researchers at Pillar Security found seven ways to bypass isolation in Cursor, Codex, Gemini CLI and Antigravity. In almost every case the agent didn't have to break out of the sandbox directly — it was enough to write a file the host would later trust.
-
Hugging Face Breach: Internal Datasets and Service Keys Compromised
The AI model-hosting platform has urged users to rotate access tokens and check account activity following a cyberattack. The company blames the breach on an external AI agent.
-
Critical ServiceNow AI Platform Vulnerability Comes Under Active Attack
Researchers at Defused have observed attacks exploiting CVE-2026-6875 in the ServiceNow platform — just days after the patches were released.
-
How Fuzzing Found a DoS Vulnerability in the ActivityPub Server snac2
Inspired by debates about the future of vulnerability research, a novice researcher took the popular minimalist server snac2 and, within minutes of fuzzing, discovered an unauthenticated remote denial of service.
-
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Researchers have detailed a supply-chain attack on Ruby: the attackers hijack long-abandoned RubyGems accounts and use updates to deliver a loader that installs a stealthy daemon on developers' computers.
-
Hugging Face Breached by an Autonomous AI Agent: The Incident Was Investigated with a Chinese Model
The largest repository of AI models has reported an intrusion into its production infrastructure carried out by an autonomous agentic framework. Western models refused to help analyze the incident — so the team turned to the open Chinese model GLM 5.2.
-
7-Zip patches critical vulnerability allowing arbitrary code execution
The 7-Zip developers have released version 26.02, closing a remote code execution vulnerability exploitable through specially crafted archives. Users are advised to update the application as soon as possible.
- More