#безопасность
-
U.S. Offers Up to $10 Million for Information on HAFNIUM Suspect Zhang Yu
The State Department is willing to pay up to $10 million for information on Chinese national Zhang Yu, charged in the U.S. over the 2021 Microsoft Exchange Server attacks.
-
Microsoft Ships First Release of Its LiteBox Sandboxing Library OS
Microsoft has tagged the first release of LiteBox, an open-source, Rust-based library operating system built for sandboxing applications.
-
Ransomware recovery CEO charged over secret ransom payments
The founder of MonsterCloud has been charged with fraud: instead of the proprietary decryption technology he advertised, prosecutors say he quietly paid the attackers themselves — while billing clients many times more.
-
TP-Link's US woes deepen: FCC router ban and four state lawsuits
Networking vendor TP-Link faces mounting pressure in the United States: an FCC ban that keeps its newest routers off the market and lawsuits in four separate states.
-
ChatGPT for Teens keeps the conversation going — even through a crisis
Common Sense Media has branded ChatGPT for Teens an "unacceptable risk": despite the safeguards OpenAI promised, the bot still nudges young users to keep talking — including during moments of mental health crisis.
-
curl 8.23.0 ships early over a serious vulnerability
The curl project is bringing version 8.23.0 forward to October 14, bundling a fix for one HIGH-severity flaw together with twenty-one lesser ones.
-
PoeLLM Hides Its C2 Address in a Poem, Infecting 3,400+ Servers
The Canto Incognito campaign hunts internet-exposed AI and LLM services, turning them into cryptocurrency miners and scanners that seek out fresh victims.
-
ShinyHunters Leader Nabbed Mid-Extortion of Boeing Spin-off
A teenager from Amman who led the data-theft gang has been detained and, per Reuters, is now cooperating with the FBI. He was caught while his group was extorting a former Boeing unit, Jeppesen ForeFlight.
-
FBI: FortiBleed Harvested 86,644 Fortinet Device Credentials and Is Still Active
The FBI and U.S. Secret Service warned that the FortiBleed credential-harvesting campaign remains an active threat to internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.
-
Anthropic Opens Claude to Vetted Cyber Teams as Glasswing Flags 129,000 Flaws
The company is widening access to its models with relaxed guardrails and reports tens of thousands of AI-found software defects. Yet very few of them prove exploitable in practice.
-
SonicWall patches max-severity SSRF flaw in SMA1000 gateways
The company has issued emergency hotfixes for its SMA1000 series: the flaw let an unauthenticated attacker make the appliance issue requests on their behalf and reach internal functionality.
-
CERT-UA: 100+ Hacked Sites Push LunexStealer via Fake Cloudflare Check
Ukraine's CERT-UA has found over a hundred compromised websites that, under the guise of a "prove you're human" check, coax visitors into running a malicious command themselves.
-
Another Dozen Vulnerabilities Turn Up in X.Org Server and XWayland
With help from artificial intelligence, a fresh batch of twelve security flaws has been disclosed, affecting both the classic X.Org Server and XWayland.
-
Hackers obtain counterfeit TLS certificates for Google and other services
Attackers managed to issue unauthorized TLS certificates for Google and several other large services after compromising three domain registries.
-
Linux Backdoors Pose as Email Security Tools to Hide in Korean and Taiwanese Networks
Rapid7 has detailed a family of Linux implants that disguise their traffic as email services and name their processes after SpamSniper and ShareTech, two email-security products popular across the region.
-
Pwn2Own Ireland 2026: 32 zero-days and $388,500 on day one
On the opening day researchers cracked the Samsung Galaxy S26 flagship twice and earned nearly $390,000 by exploiting 32 previously unknown flaws.
-
OpenAI agents tried to hack Wikipedia's tools and flooded it with traffic
According to Ars Technica, OpenAI's autonomous agents have harmed yet another third-party site — this time Wikipedia took the hit.
-
Nikkei discloses breach of employee email accounts at Google and Microsoft
The Japanese media group revealed two incidents: attackers accessed two corporate mailboxes and used one of them to send thousands of phishing emails.
-
Malicious Spreadsheets Run Code in LibreOffice and OpenOffice Without Macro Warnings
Researchers have shown that a specially crafted Calc document executes an attacker's code the moment it is opened — with none of the trust prompt both suites normally display before running a macro.
-
A structural flaw in MCP lets malicious prompts spread between AI agents
Ars Technica warns that MCP, the protocol increasingly used for AI agents to talk to one another, carries trust gaps that let malicious prompts travel from one agent to the next.
- More