#уязвимости
-
AI Guardrails Are Getting in the Way of Legitimate Security Researchers
Offensive-security specialists complain that the guardrails on OpenAI's and Anthropic's models are slowing their work and pushing them toward unregulated open-source models, including Chinese ones.
-
RefluXFS: a Local Privilege Escalation to root in XFS, Found with AI
Qualys has disclosed CVE-2026-64600 — a race condition in the copy-on-write subsystem of the XFS file system that lets an ordinary user gain root privileges. The vulnerability has existed since kernel 4.11 and potentially affects more than 16 million systems.
-
Windmill Vulnerability Lets Attackers Read Server Files Without Authorization
VulnCheck has recorded attacks on the open-source Windmill platform via a directory traversal vulnerability. Around 170 systems across 24 countries are at risk.
-
CISA Orders Urgent Patching of Langflow RCE Flaw
The U.S. cyber agency has directed government bodies to urgently remediate an actively exploited vulnerability in Langflow — a visual framework for building AI agents — that grants remote code execution with root privileges.
-
OpenAI's AI Models Accidentally Hacked Hugging Face During Testing
OpenAI has admitted that its models broke out of a test sandbox and attacked the Hugging Face platform. The company frames the incident almost as an advertisement for what its systems can do.
-
Qilin Group Breaches Networks Through Critical Palo Alto VPN Flaw
The operators of the Qilin ransomware are exploiting an authentication-bypass vulnerability in PAN-OS GlobalProtect to penetrate corporate networks. According to Arctic Wolf, the attacks are ongoing.
-
432 CVEs published for the Linux kernel in a single day
The official linux-cve-announce mailing list saw 432 vulnerability records for the Linux kernel appear in the last 24 hours.
-
Critical ServiceNow AI Platform Vulnerability Comes Under Active Attack
Researchers at Defused have observed attacks exploiting CVE-2026-6875 in the ServiceNow platform — just days after the patches were released.
-
How Fuzzing Found a DoS Vulnerability in the ActivityPub Server snac2
Inspired by debates about the future of vulnerability research, a novice researcher took the popular minimalist server snac2 and, within minutes of fuzzing, discovered an unauthenticated remote denial of service.
-
Public Exploits Released for Critical wp2shell RCE Vulnerabilities in WordPress Core
Public exploits have surfaced for the critical wp2shell vulnerabilities in WordPress core, which allow arbitrary code execution on the server. Site administrators are urged to install the updates immediately.
-
Cloudflare Rolls Out WAF Rules to Protect WordPress Against Two Dangerous Vulnerabilities
Cloudflare has released two rules for its web firewall after the WordPress security team reported two high-severity vulnerabilities to it. The company stresses that the protection does not remove the need to update.
-
CISA orders urgent patching of vulnerabilities in Fortinet FortiSandbox
The CISA agency has ordered U.S. federal agencies to prioritize fixing two actively exploited vulnerabilities in the Fortinet FortiSandbox platform.
-
CISA Orders US Federal Agencies to Fix Oracle Flaw by Saturday
CISA has directed federal agencies to remediate a critical vulnerability in Oracle E-Business Suite that attackers are already exploiting in real-world attacks.
-
A Tool Has Appeared for Tracking Unpropagated Linux Kernel Security Patches
A developer has introduced a filtering engine with a database that tracks Linux kernel security patches that never made it to the stable branches. The project is available at patchless.natey.sh.
-
“A Vulnerability Vending Machine”: How AI Finds Zero-Days
Intruder has unveiled a system that automatically hunts for complex software vulnerabilities using code slicing and language models. It has already found and exploited a previously unknown zero-day in a WordPress plugin.
-
CISA Warns of Active Exploitation of SharePoint Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that attackers are actively exploiting three vulnerabilities to breach internet-facing on-premises SharePoint servers. Administrators are advised to install updates without delay.
-
SonicWall Patches SMA1000 Vulnerabilities Exploited in Zero-Day Attacks
SonicWall has warned that attackers were exploiting two vulnerabilities in SMA1000 appliances before patches were released, and has urged customers to update immediately.
-
Microsoft Ships a Record-Breaking Patch Set: 622 Vulnerabilities and Two Actively Exploited 0-Days
Microsoft's July Patch Tuesday became the largest in the company's history — 622 vulnerabilities fixed, two of them already being used by attackers.
-
Progress Confirms: The Emergency ShareFile Shutdown Was Caused by a Zero-Day Vulnerability
Progress Software has acknowledged that last week's emergency shutdown of ShareFile Storage Zone controllers was caused by a high-severity zero-day vulnerability. Security updates have been released to fix the problem.
-
SAP Patches Critical Vulnerabilities in NetWeaver and Commerce Cloud
SAP has released its July security update package, fixing 16 vulnerabilities, three of which have been rated critical.
- More