#безопасность
-
Researcher Publishes New PoC for Windows Vulnerability Shortly After Patch Tuesday
A specialist using the alias Chaotic Eclipse has presented the LegacyHive exploit, which leverages a vulnerability in the Windows User Profile Service to escalate privileges.
-
Cursor Vulnerability: A Cloned Repository Can Run Code on Windows
A vulnerability has been found in the Cursor code editor on Windows: if a file named git.exe sits in the project root, the editor runs it with no warning and no confirmation. The malicious file then gains access to the user's SSH keys, cloud tokens and source code.
-
CISA Warns of Active Exploitation of SharePoint Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that attackers are actively exploiting three vulnerabilities to breach internet-facing on-premises SharePoint servers. Administrators are advised to install updates without delay.
-
Researcher Shows How Claude Can Be Tricked Into Revealing a User's Personal Data
The author of a blog post described a method he used to trick the AI assistant Claude into revealing confidential information stored in its memory. The publication sparked a lively discussion on Hacker News.
-
US Charges Operators of Russian “Bulletproof” Hosting Service
US federal prosecutors have unsealed charges against three Russian nationals suspected of providing bulletproof hosting to ransomware gangs. According to investigators, the damage to victims worldwide has exceeded $62 million.
-
Vancouver police website adds a “Quick Escape” button that wipes the trail from browser history
The Vancouver Police Department's official website has been fitted with a Quick Escape feature — an emergency exit button that deletes the record of the visit from the browser's history. The news caught the attention of Hacker News users.
-
GitHub Adds a Default Delay Before Package Updates in Dependabot
GitHub has changed the behavior of Dependabot version updates, introducing a waiting period before a package update is proposed by default. The news drew a notable response on Hacker News.
-
SonicWall Patches SMA1000 Vulnerabilities Exploited in Zero-Day Attacks
SonicWall has warned that attackers were exploiting two vulnerabilities in SMA1000 appliances before patches were released, and has urged customers to update immediately.
-
Vulnerability in Claude for Chrome Lets Third-Party Extensions Read Gmail
Researchers have discovered that a malicious browser extension can use Claude for Chrome to access a user's Gmail, Google Docs and Calendar. Exploitation requires an extension already capable of running scripts on the claude.ai site.
-
Microsoft Ships a Record-Breaking Patch Set: 622 Vulnerabilities and Two Actively Exploited 0-Days
Microsoft's July Patch Tuesday became the largest in the company's history — 622 vulnerabilities fixed, two of them already being used by attackers.
-
Progress Confirms: The Emergency ShareFile Shutdown Was Caused by a Zero-Day Vulnerability
Progress Software has acknowledged that last week's emergency shutdown of ShareFile Storage Zone controllers was caused by a high-severity zero-day vulnerability. Security updates have been released to fix the problem.
-
Iran Exploited Mobile Network Vulnerabilities to Track U.S. Military Personnel
According to a report, Iranian authorities exploited known cellular network vulnerabilities to locate U.S. military personnel in the Middle East. The data obtained was used in the run-up to and at the start of the conflict.
-
11 Old Microsoft-Signed Linux UEFI Bootloaders Found That Allow Secure Boot Bypass
Cybersecurity researchers have identified 11 outdated Microsoft-signed UEFI applications that can be used to bypass Secure Boot on most modern systems.
-
SAP Patches Critical Vulnerabilities in NetWeaver and Commerce Cloud
SAP has released its July security update package, fixing 16 vulnerabilities, three of which have been rated critical.
-
148 npm Packages Turned Students' Browsers into a DDoS Botnet
JFrog researchers uncovered a campaign of 148 npm packages disguised as student web proxies that, for about two weeks in May, turned visitors' browsers into nodes of a DDoS botnet.
-
Researchers Used an LLM to Find and Exploit FreeBSD Kernel Vulnerabilities
Praetorian has published the second part of its research on how language models helped discover and exploit bugs in the FreeBSD kernel. The project is called FreeBSoD.
-
Japan's Largest Taxi Operator Shuts Down Systems After Cyberattack
Nihon Kotsu, Japan's largest taxi operator, reported a breach of its systems and was forced to take part of its infrastructure offline.
-
MemGhost: An Email Attack That Forges the Memory of AI Agents
Researchers have described the MemGhost attack, in which a single email makes an AI assistant store a false “fact” about the user and quietly alter its answers in future sessions. The victim, meanwhile, receives an ordinary-looking response and has no idea of the substitution.
-
Google and Microsoft Pull the ModHeader Extension over a Hidden Data Collector
Google and Microsoft have removed the popular ModHeader extension, with roughly 1.6 million installs, from their extension stores after researchers discovered a hidden mechanism for collecting browsing history inside it. The collector itself remained dormant.
-
Debian Releases Final Regular Update for bookworm
The Debian Project has announced the last scheduled update for Debian 12 “bookworm.” Continued support for the version will carry on under LTS until 2028.
- More