#безопасность
-
France's supermarket fridges sat exposed online for months
On the night of October 12, attackers pushed the refrigeration systems of hundreds of French supermarkets into defrost mode. IPinfo went through its weekly Internet scans and found France had more of these control panels exposed than the rest of the world combined.
-
OpenBSD 8.0: the 61st release of the security-focused BSD
Theo de Raadt has announced OpenBSD 8.0, the 61st stable release of the free, multi-platform 4.4BSD-based UNIX-like system. Highlights include faster swap encryption and a much larger kernel address space.
-
Nikkei discloses third breach in a month, exposing 1.8M records
Japanese media group Nikkei has reported a new incident — its third in about a month. Some 1.83 million personal data records were put at risk.
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
Massive Florida DMV data breach hits current and former residents
Florida has begun issuing alerts after a statewide breach at its Department of Motor Vehicles, an incident tied to the ShinyHunters group.
-
F5 ships out-of-band patches for critical NGINX flaws
F5 has closed several NGINX web server vulnerabilities, including three critical ones that could let attackers run code on affected systems.
-
How a Chinese Crime Ring Hacked Staples to Steal Millions
Hackers broke into Staples' internal systems, issued gift cards worth millions, and went on a nationwide shopping spree across the U.S.
-
An AI That Gets Better at Cracking CAPTCHAs the More It Tries
Researchers built a system that solves visual CAPTCHAs and grows more accurate with every encounter — even recovering after defenders scramble the images against it.
-
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
On the night of October 16 an intruder reached a legacy system at OpenCode and may have exposed the third-party AI provider keys that users had stored in OpenCode Console.
-
October Windows Server updates break Exchange sign-in and mail flow
Microsoft has confirmed that this month's Windows Server security updates break Outlook on the web sign-in and leave messages stuck in the Outbox on some Exchange Server systems.
-
Unpatched Broadcom Wi-Fi Flaw Hands Nearby Attackers Root on Routers
Researcher Quentin Kaiser showed that a bug in Broadcom's own WPS code lets an attacker within Wi-Fi range run code as root — with no network password and no pairing. There is no patch and no CVE.
-
A Savannah officer handed her Flock login to her ICE agent husband
A former Savannah police officer was fired after an investigation found she had shared her login for the Flock license-plate system with her husband, an immigration agent.
-
Hackers exploit SiteGuard WAF flaw to run commands as root and SYSTEM
A critical OS command injection flaw has been found in the statistics feature of the SiteGuard Server Edition firewall. Attacks are already underway.
-
OpenCode Reports Breach: a 'Distillation Attack' Hit 1.4% of Users
OpenCode disclosed on X that it suffered an overnight breach tied to a large-scale 'distillation attack,' and says it has already emailed the affected users.
-
Nine Years to Hack an Xbox 360: How a £5 Pico Made the Impossible Trivial
A blogger recounts how a console-modding project that defeated him in 2017 became trivial in 2026 thanks to a five-pound microcontroller — and explains the fault injection that cracks even the sturdiest security.
-
Drupal patches two critical RCE flaws, warns exploits may come fast
Drupal has fixed two critical bugs that allow remote code execution on any supported version of the CMS and is urging administrators to update without delay.
-
Malicious npm Package imgdecode Hides a Shellcode Loader in a Windows Native Addon
SafeDep researchers flagged imgdecode, an npm package that is part of the long-running MALFEX campaign aimed at compromising Windows systems. Despite public exposure, it remains available and has already been downloaded 979 times.
-
Apple tightens App Store rules against AI 'nudify' apps
Updated store rules now explicitly ban apps that use AI to generate intimate images of people without their consent. The changes follow criticism of Apple over deepfakes made with Grok.
-
Home Assistant checks your passwords against HIBP — and not everyone was pleased
A security researcher discovered that Home Assistant was checking his passwords against a breach database without his consent and filed an angry issue. The developer first brushed it off, then apologized and explained how the mechanism works.
-
Claude cracks the origin of the ECDSA curves: it was just timestamps
In under half an hour, an internal Anthropic model solved a mystery that had vexed cryptographers for a quarter-century: the enigmatic "seeds" behind NIST's standard curves turned out to be the output of a weak 1990s random-number generator seeded from the Unix clock.
- More