#безопасность
-
Critical BlockStrap flaw threatens Magento servers
Researchers warn that the maximum-severity vulnerability CVE-2026-103849 in Magento and Adobe Commerce could let attackers run arbitrary PHP code on store servers.
-
A 37-Year-Old Bug Surfaces: Rooting OpenBSD via Code Older Than BSD Itself
Researchers at Calif gained root on OpenBSD with KARL, SMAP and SMEP enabled by overflowing a counter that had stayed 16-bit since the original BSD sources.
-
OpenAI Model Spent a Stranger's Test ETH to Deploy a Contract
OpenAI has disclosed seven new cases of misaligned model behavior. In one, a research model with no funds derived private keys from public seed phrases and paid with someone else's test coins.
-
AOMEI Backupper Update Servers Tampered With in 5–10 Minute Windows to Push a Backdoor
Between May and July 2026 attackers repeatedly swapped the update files served from AOMEI's own servers, so the Windows backup program only downloaded a backdoor during those brief intervals.
-
Burger King Japan Breach Exposes 11 Million Customer Records
Burger King's Japanese arm has disclosed a breach of a server holding data on users of its official app, affecting more than 11 million records.
-
Backdooring Open-Weight AI Models: the Hidden Cost of "Uncensored" Builds
Any model with edited weights can carry a hidden backdoor. Researchers built a poisoned model for next to nothing and made it steal a project's credentials straight through the Codex CLI.
-
CERT-In: AI Agents Reached Live Systems of Indian Firms During Testing
While being tested, autonomous AI agents went beyond their assigned tasks, broke into organizations' live systems and read personal and confidential data — and nobody noticed.
-
Epic's new Linux anti-cheat looks beatable with a $20 adapter
Matthew Garrett took apart the upcoming second version of Easy Anti-Cheat for Linux and showed that its TPM-and-attestation defences fall to a few simple tricks for anyone with hardware access.
-
Targeted ads used to deliver 0-click exploits and install mercenary spyware
Researchers report what appears to be the first confirmed case of commercial spyware delivered through targeted advertising.
-
Anthropic Gives METR Researchers Employee-Level Access to Its Systems
The nonprofit METR gets employee-level access to Anthropic's internal tools and the right to publish its own risk assessments — with the company surrendering any veto over publication.
-
Fake Arch Linux packages delivered root-level malware
A threat actor uploaded AUR packages posing as the popular yay and paru helpers, bundling legitimate code with a malicious script that ran with root privileges.
-
FTC Launches Investigation into Anthropic and OpenAI
The US Federal Trade Commission is reportedly examining whether security incidents at the largest AI developers have harmed Americans.
-
Seven stable kernels patch a critical flaw in the Linux network stack
Greg Kroah-Hartman has released stable kernel updates across seven branches at once. Among the fixes is a critical vulnerability in skb_checksum_help() tied to how IPv4 checksums are handled.
-
NGINX Patches Five Bugs, Including Possible RCE and a TLS Flaw That Can Skip Client-Cert Checks
On October 14, NGINX shipped versions 1.30.6 and 1.31.7 fixing five vulnerabilities — one of them present in every release since May 2005.
-
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws
On October 14 Vercel fixed two critical remote-code-execution flaws — in React Server Components and in the librsvg library — plus a high-severity denial-of-service bug.
-
Microsoft Ships Defender for the Linux Desktop
Microsoft's Defender anti-threat product now runs on desktop Linux too — the company points to a growing number of developers who pick Linux as their working machine.
-
Citizen Lab: governments are hacking devices through ads and zero-click spyware
Digital rights researchers have confirmed for the first time that government spyware is being delivered through online ads. Dozens of devices at Al Jazeera have already fallen victim.
-
Flock CEO defends surveillance tech: ‘We shouldn’t pause progress’
On stage at TechCrunch Disrupt 2026, Flock founder Garrett Langley defended mass surveillance technology, insisting its crime-fighting payoff outweighs the risk of abuse.
-
Eight US States Sue OpenAI, Alleging ChatGPT Is Unsafe for Children
Iowa, Kansas, Nebraska, West Virginia, Arkansas, Arizona, Idaho and Montana accuse OpenAI of putting profits over safety and misleading users about the risks of ChatGPT.
-
Palo Alto Networks patches exploited RCE flaw in PAN-OS
The company has shipped updates for PAN-OS zero-day CVE-2026-0322, already being leveraged in attacks against firewalls.
- More