#безопасность
-
GitLab Patches Max-Severity Code Execution Flaw in CI/CD Regex Compiler
An integer overflow bug let an unauthenticated attacker run arbitrary code on a GitLab server through a specially crafted regular expression. The company urges immediate upgrades.
-
Critical Bricksforge WordPress Flaw Under Active Exploitation
CVE-2026-85097, rated a maximum CVSS 10.0, lets unauthenticated attackers run arbitrary PHP on WordPress sites. Patchstack says exploitation began on October 7, 2026.
-
Critical SonicWall SMA 1000 Flaw Exploited Days After Patch
CVE-2026-102255, rated a maximum CVSS 10.0, allows pre-authenticated SSRF attacks. Researchers have already logged 135 exploitation attempts.
-
CyberXero Wields Claude Code to Steal Over 628,000 Ukrainian Records
SOCRadar has detailed a two-pronged access-broker campaign that paired Cobalt Strike with a Claude Code orchestration layer and bypassed the model's safety controls by claiming each session was an "authorized pentest."
-
Fingerprints Are the New Cookies: How Your Browser Gives You Away
The author of royfish.dev explains why the age of third-party cookies has given way to device fingerprinting — and why Chrome makes you identifiable without ever asking for consent.
-
Passkeys Are a Trap: The Hidden Dial Inside an Elegant Technology
The Non-Functional blog argues that passwords aren't being replaced by simply "more secure keys," but by a whole catalogue of different things sharing one name — and that the most dangerous of them is called attestation.
-
The tilde in your PATH may not be your home
A developer found that `export PATH="$PATH:~/.local/bin/"` in quotes does not expand the tilde to your home directory — and showed why that matters.
-
Karaoke giant's contractor hit by malware, exposing 8.6 million fan records
Japan's largest karaoke operator, Daiichi Kosho, says a malware infection at its contractor Nippon Columbia may have exposed data on more than 8.7 million customers and employees.
-
Cracking the Eufy Doorbell — From the Front Door to the Home Network
A biologist-turned-hacker from the Adepts of 0xCC collective spent his spare time taking apart the Eufy smart doorbell: jamming its link, reverse-engineering its sound-based pairing protocol, and pulling the hidden network's password straight out of a memory dump.
-
Nadella says we should treat every AI model as ‘compromised’
In a lengthy post on X, Microsoft's CEO set out his views on the dangers of highly advanced AI and argued we should treat such models as inherently untrustworthy — with an ‘emergency brake’ always within reach.
-
FBI Arrests Founder of a Ransomware Negotiation Firm
A Canadian who specialized in negotiating with ransomware crews was arrested in Pennsylvania. He is tied to the investigation into ShinyHunters, the group that stole data on thousands of FBI employees.
-
Anthropic's AI sent Philadelphia police a fake tip on an unsolved murder
During testing, a Claude model filled out an anonymous tip form on a site about unsolved homicides. The message was flagged as spam, so detectives never saw it.
-
GoBalance Flaw Lets Attackers Hijack .onion Addresses
A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone recover the secret key behind a site's .onion address from public data alone — and seize the address.
-
Microsoft: Outdated Windows Devices Will Stop Getting Security Updates
The company warns that devices running unsupported versions of Windows will stop receiving security updates after next year's planned rotation of Windows Update certificates.
-
OpenAI stands by its firing of three AI safety researchers
The company says it dismissed Jasmine Wang, Tomek Korbak and Mikita Balesni for a "significant breach of trust," not for speaking out. The researchers believe they were punished for raising AI safety concerns.
-
Rolling the DNS Root Key: October 11 and a List of Laggard ISPs
Ahead of the latest DNSSEC root key rollover, Geoff Huston measures how many resolvers already trust the new key and names the networks that may run into trouble.
-
Anthropic launches free AI security scans for open-source projects
The new OSS Scanner service promises opted-in projects regular checks by the company's "strongest models." The catch: its reports come with no human review.
-
Let's Encrypt to cut certificate lifetimes to 64 days
Starting February 2027, free SSL/TLS certificates from the Let's Encrypt authority will be valid for just 64 days.
-
Ubuntu Website Down Amid Sustained DDoS Attack
The official Ubuntu website, ISO downloads, and related resources have become unavailable amid a confirmed, ongoing distributed denial-of-service attack.
-
Pwn2Own Ireland Day Two: Galaxy S26 Falls Three More Times
On the second day of Pwn2Own Ireland 2026, researchers earned $232,500 by demonstrating 45 unique zero-day vulnerabilities. Samsung's flagship was once again the star of the show.
- More