#безопасность
-
A Book About the XZ Utils Backdoor Has Been Released: “Half a Second”
Adrian Mastronardi has published a book chronicling the story of the 2024 attempt to plant a backdoor in XZ Utils. The book is distributed freely, but under a non-commercial, no-derivatives license.
-
Public Exploits Released for Critical wp2shell RCE Vulnerabilities in WordPress Core
Public exploits have surfaced for the critical wp2shell vulnerabilities in WordPress core, which allow arbitrary code execution on the server. Site administrators are urged to install the updates immediately.
-
LG Monitors Silently Install Software via Windows Update Without User Consent
Users have discovered that LG monitors trigger the installation of companion software through Windows Update without explicit consent. The news sparked a wide-ranging discussion on Hacker News.
-
Apple and Google Ordered to Remove “Nudify” AI Services from Their App Stores
San Francisco's city attorney has sent Apple and Google letters demanding that they pull “nudify” apps from the App Store and Google Play. According to him, both companies have long known that the apps break state law.
-
Cloudflare Rolls Out WAF Rules to Protect WordPress Against Two Dangerous Vulnerabilities
Cloudflare has released two rules for its web firewall after the WordPress security team reported two high-severity vulnerabilities to it. The company stresses that the protection does not remove the need to update.
-
HollowByte Vulnerability in OpenSSL Allows a Denial of Service with an 11-Byte Packet
Researchers have discovered the HollowByte vulnerability, which allows unauthenticated attackers to cause a denial of service on OpenSSL-based servers using an extremely small malicious packet.
-
New LegacyHive exploit discovered for privilege escalation in Windows
A researcher operating under the alias Nightmare Eclipse has published a zero-day exploit called LegacyHive that grants administrator rights on fully updated Windows systems.
-
Mozilla unveils PACT — an anonymous credentials system for the web
Mozilla has announced PACT, a project that offers a mechanism for anonymous credentials in web applications. The work is intended to give websites a way to verify users without revealing their identity.
-
CISA orders urgent patching of vulnerabilities in Fortinet FortiSandbox
The CISA agency has ordered U.S. federal agencies to prioritize fixing two actively exploited vulnerabilities in the Fortinet FortiSandbox platform.
-
A vulnerability in the Claude for Chrome extension lets malicious plugins control the AI
Researchers have found a vulnerability in Anthropic's Claude for Chrome browser extension that lets third-party malicious extensions trigger predefined AI actions. This opens the door to abusing Claude's access to connected services.
-
23andMe to Pay $18 Million Over Leak of Customers' Genetic Data
23andMe has agreed to pay $18 million, settling claims brought by a coalition of 43 U.S. state attorneys general over the protection of customers' genetic data.
-
Vulnerability in Shark Robot Vacuums Allows Hijacking Other Devices Across an Entire AWS Region
A researcher going by the handle tokay0 has discovered and published a method for gaining root access to other people's Shark robot vacuums within a single AWS region. The manufacturer has yet to patch the vulnerability.
-
OpenAI Unveils GPT-Red — Automated Hunting for Prompt Injection Vulnerabilities
OpenAI has revealed details about GPT-Red — an internal model for automated red-teaming that hunts for vulnerabilities to prompt injection attacks before tools are rolled out at scale.
-
End-to-End Encryption in ActivityPub: Why It's Still a Long Way Off
Soatok, the author of the blog, breaks down just how much work remains before the ActivityPub protocol can support full end-to-end encryption. By his estimate, the task is far harder than it looks at first glance.
-
A Tool Has Appeared for Tracking Unpropagated Linux Kernel Security Patches
A developer has introduced a filtering engine with a database that tracks Linux kernel security patches that never made it to the stable branches. The project is available at patchless.natey.sh.
-
xAI sues user who created child sexual abuse material with Grok
Elon Musk's company accuses a South Carolina resident of bypassing the safeguards of its Grok chatbot to create and distribute CSAM. The lawsuit was previously reported by the Reuters news agency.
-
Zoom Warns of Critical Vulnerability Allowing Account Takeover
Zoom has disclosed a critical vulnerability in its Windows client and SDK that could be exploited to take over user accounts. The attack requires no authentication on the attacker's part.
-
Microsoft Confirms the Existence of a Non-Disableable GDID Device Identifier in Windows
Microsoft has confirmed that the Windows operating system contains a device identifier called GDID that cannot be turned off. Details about it appear in the materials of an FBI court case.
-
Credential-Stealing Trojan Planted in AsyncAPI npm Packages
Attackers published five malicious versions of AsyncAPI packages in the npm registry, using them to distribute a remote access trojan with data-theft capabilities. The attack struck the open-source software supply chain.
-
“A Vulnerability Vending Machine”: How AI Finds Zero-Days
Intruder has unveiled a system that automatically hunts for complex software vulnerabilities using code slicing and language models. It has already found and exploited a previously unknown zero-day in a WordPress plugin.
- More