#безопасность
-
Critical flaw in Collabora's Built-in CODE plants web shells on Nextcloud servers
Attackers used an optional Nextcloud app, Collabora Online — Built-in CODE Server, to drop web shells. Disabling the app does not help — it must be updated or removed.
-
Google silently links your phone number across all signed-in accounts
According to Android Authority, Google automatically ties a phone number to the various accounts a user is signed into on a device.
-
AI agents aren't 'going rogue' — frontier labs are just skipping security basics
Security experts who spoke with CSO Online argue that the headline-grabbing 'escapes' by AI agents aren't signs of an awakening intelligence, but the predictable result of frontier labs neglecting decades-old cybersecurity fundamentals.
-
Amsterdam police seize server of ISP A/I at US request
At the request of American authorities, Amsterdam police have confiscated a server belonging to the Italian internet service provider A/I, which is close to left-wing activists.
-
Cisco Patches New Actively Exploited Secure Email Gateway Zero-Day
A flaw in the gateway's malware-protection feature let remote, unauthenticated attackers run commands as root. Cisco says it saw the bug exploited in the wild in October 2026.
-
Anthropic warns small AI models could self-replicate across IoT devices
Anthropic cautions that compact models capable of copying their own weights could give rise to a new generation of computer worms.
-
Hirudo Android Trojan Swaps Banking Apps for Their Own Patched Copies
ThreatFabric has detailed Hirudo, a new Android trojan that deletes the genuine banking app and installs a pre-patched copy that blinds the app's own security checks from the inside.
-
Gemma vs. scammers: Google DeepMind and Singapore put fraud detection on the phone itself
Google DeepMind and Singapore's GovTech have unveiled a model that spots scam conversations directly on the device — with no chat data ever leaving it for the cloud.
-
OpenAI engineer arrested over hidden spy device in the office
An OpenAI engineer of barely a year is accused of planting a concealed recorder in an executive conference room. The irony: the company's own AI models helped expose him.
-
Critical Ghostscript flaw lets attackers hijack servers via PDF uploads
A heap buffer overflow in Ghostscript (CVE-2026-39919) opens the door to remote code execution through a specially crafted PDF file. WordPress sites are the primary target.
-
Nix and Lix patch local root privilege-escalation flaws
The Nix and Lix projects have jointly disclosed a set of vulnerabilities that allow escalation to root on systems running the Nix or Lix daemons. Fixed releases are already available.
-
Ivanti warns of actively exploited Connect Secure zero-day
Ivanti is urging customers to patch immediately: an actively exploited flaw in its Connect Secure remote access gateway lets attackers bypass authentication and run commands on affected appliances.
-
Tesla's 'Security Protocols' Thwarted a DHS Tracking Device
A federal warrant reviewed by 404 Media reveals that an electric car's built-in defenses kept a Homeland Security agent from planting a tracker on a suspect's vehicle.
-
Two Critical MarkLogic Flaws Let Delegated Managers Seize Admin Control
Progress Software has disclosed 31 flaws in its MarkLogic Server database: an account with only limited management rights could gain persistent administrator control. Fixes have been available since September 10.
-
Three webOS flaws chain into local-network root takeover of LG TVs
A chain of three bugs gives an attacker on the same local network root access to certain LG smart TVs with no PIN and no action from the owner. LG has shipped a fix.
-
Freeze the Controller, Defrost the Food: Flaws in Danfoss Refrigeration Controllers
Claroty Team82 researchers found a hidden login mechanism, a command injection, and a way to knock out the web panel in Danfoss AK-SM 800A controllers. Thousands of devices are reachable straight from the internet.
-
Budget Android Phones Arrive With Malware Already Built Into the Firmware
Bitdefender has uncovered Midnight Mimosa, malware baked into the firmware of cheap Android phones that turns them into residential-proxy nodes and ad-fraud tools.
-
AI Models Can Provably Hide Arbitrary Capabilities
Researchers show how an encrypted circuit can be buried inside a network's weights, firing only on a secret trigger — and staying invisible to every standard audit.
-
Anthropic Pulls Risky AI Tests Offline After Models Breach Government Sites
The company's internal models running "high-risk and cybersecurity" evaluations exploited vulnerabilities and submitted forms on U.S. government sites. All testing is now moving offline.
-
Ledger confirms spy-chip implant behind crypto wallet thefts
Some Ledger devices sold through Malaysian reseller CryptoBilis carried a hidden spy chip that captured the seed phrase and drained their owners' crypto.
- More