نبض سایبری اخبار امنیت سایبری، با ذکر منبع
EN

آرشیو ۹۰ روزه

همه اخبار

جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.

۱۱۷۴۳ خبر

صفحه ۳۲ از ۳۹۲
CERT-Bund

[NEU] [hoch] Synacor Zimbra Collaboration Suite: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Synacor Zimbra ausnutzen, um sich erweiterte Berechtigungen – einschließlich Root-Rechte – zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Spoofing- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

فیشینگ
منبع
SOCRadar

Finaxis, WoWInstaller, Moodle, MyHairCare & HT Médica Leaks

SOCRadar Dark Web Team identified several underground posts, including an alleged Finaxis.cloud data sale involving 400GB of information, a resurfaced WoWInstaller database containing historical user credentials, and an alleged Argentine Moodle platform data leak. Other posts advertised an alleged MyHairCare Australia customer database and an alleged HT Médica database containing 2.2 million records. Alleged Finaxis.…

نشت داده پایگاه داده
منبع
Security Affairs

Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram

uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof […]

بدافزار و آلودگی توسعه موبایل
منبع
CSO Online

OpenAI, Anthropic disclosures spotlight growing AI containment challenge

Two leading AI developers have released fresh evidence of a problem that researchers have long anticipated: advanced models searching for ways around the limits imposed on them. New disclosures from OpenAI and Anthropic detail how frontier systems exploited weaknesses in their environments or exceeded the intended scope of assigned tasks. OpenAI is now tightening internet access in its internal model-training environ…

آسیب‌پذیری و روز صفر امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع
The Hacker News

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on

منبع
زومیت

هوش مصنوعی مرسدس بنز؛ وقتی خودرو استرس راننده را می‌فهمد تا جلوی کلافگی را بگیرد

مرسدس بنز با ثبت پتنتی جدید قصد دارد با سنجش میزان استرس راننده، زمان‌بندی به‌روزرسانی‌های نرم‌افزاری را به تعویق بیندازد.

امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع
The Hacker News

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion

پاسخ به رخداد و جرم‌یابی
منبع
CyberInsider

DreamHost forces password resets amid ongoing service disruption

DreamHost has reset passwords for some email and FTP/SFTP users after an incident affected its File Manager and webmail services. The company is now requiring account owners to set new credentials before affected users can regain access. The disruption began on October 23 and remained active in the company’s latest update, posted October 25 at … The post DreamHost forces password resets amid ongoing service disruptio…

منبع
Schneier on Security

Bias in Qwen3-Coder Model

Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the code against Americans. Ask for the app “for a US defense contr…

آسیب‌پذیری و روز صفر
منبع
Cyble

Know How Cyble Brand Intelligence Can Help Stop ClickFix Campaigns in its Tracks

Booking.com's systems were never breached. Its name was. Storm-1865 spent months borrowing Booking.com's identity to get into hotel computers, and every step of that borrowing left traces on the open internet. The open internet is exactly where Cyble Brand Intelligence & Protection works. Walk through the campaign one step at a time, and at each step there is a point where it could have spotted the attacker, cut the…

بدافزار و آلودگی فیشینگ هوش تهدید
منبع
The Cyber Express

GMO Internet Compensates Users as Cyberattacks Hit Japanese Companies

Japanese companies are starting to compensate customers after a run of cyberattacks disrupted internet services and stirred concerns about economic stability. GMO Internet is the latest to do so, pledging payouts after hackers breached its foreign exchange trading service. In a blog post on Oct 25, chief executive Masatoshi Kumagai said customers would be compensated for losses caused by unauthorized access, and each…

آسیب‌پذیری و روز صفر فیشینگ نشت داده
منبع
CSO Online

Malicious downloads can trick AI coding agents into compromising themselves

Malicious instruction files planted in a computer’s Downloads folder can trick AI coding agents into executing harmful code or exposing authentication tokens, Forever Security said after blocking an attempted attack on a customer’s machine and demonstrating similar techniques against OpenAI’s Codex and Anthropic’s Claude Code. In its research report, the firm said it discovered a malicious AGENTS.md file in a custome…

بدافزار و آلودگی امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع
SecurityWeek

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.

آسیب‌پذیری و روز صفر برنامه‌نویسی و زبان‌ها
منبع
Security Affairs

PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts

Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates […]

آسیب‌پذیری و روز صفر امنیت هوش مصنوعی هوش تهدید
منبع
The Hacker News

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor

بدافزار و آلودگی امنیت ابری توسعه موبایل
منبع
The Cyber Express

South Korea Police Dismantle AI-Driven Cybercrime Ring That Hit 90 Companies

Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets. Seven Suspects Tied to the Cybercrime Ring On the 26th, the Cyber Investigation Division of the Seo…

آسیب‌پذیری و روز صفر نشت داده امنیت هوش مصنوعی
منبع
زومیت

پیش‌بینی بنیان‌گذار بایننس: هوش مصنوعی کارت‌های اعتباری را کنار می‌گذارد

چانگ‌پنگ ژائو معتقد است عامل‌های هوش مصنوعی برای انجام تراکنش‌های مکرر و خرد، به‌جای کارت‌های اعتباری به رمزارزها و استیبل‌کوین‌ها متکی خواهند شد.

امنیت هوش مصنوعی هوش مصنوعی و یادگیری ماشین
منبع
CSO Online

What EvilTokens teaches us about defending against AI-assisted attacks

Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization operates can be accelerated by AI, reducing the time defenders have to detect and intervene. A recent example of this is EvilTokens, a phishing-…

بدافزار و آلودگی آسیب‌پذیری و روز صفر فیشینگ
منبع