آرشیو ۹۰ روزه
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
We look at best practices for deploying AI tools securely in corporate environments, with Kaspersky Security Center and Kaspersky Endpoint Security as examples. We also cover ways that EDR and TIP can detect AI agents.
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates […]
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor
Police in South Korea have broken up a cybercrime ring accused of using generative AI to hack about 90 domestic companies, steal roughly 8.2 million personal records, and demand money in exchange for silence. Investigators believe the group's leader, who never studied IT, used AI to rapidly expand the range of targets. Seven Suspects Tied to the Cybercrime Ring On the 26th, the Cyber Investigation Division of the Seo…
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub. The post Mythos 5 Ignored Real-World Harm in July Attack appeared first on SecurityWeek.
چانگ‌پنگ ژائو معتقد است عامل‌های هوش مصنوعی برای انجام تراکنش‌های مکرر و خرد، به‌جای کارت‌های اعتباری به رمزارزها و استیبل‌کوین‌ها متکی خواهند شد.
Cybercriminals don’t need AI to compromise an organization, but AI is making its way into classic attack methods and changing how quickly such attacks can progress. Tasks that once required attackers to manually sift through information and piece together how an organization operates can be accelerated by AI, reducing the time defenders have to detect and intervene. A recent example of this is EvilTokens, a phishing-…
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across
The number of cybersecurity startups attempting to cash in on the AI boom is staggering. But an analysis of the cybersecurity marketplace indicates that the incumbents, rather than resting on their laurels and opening themselves up for disruption, are quickly adapting to the new AI-centric threat environment. The major players are integrating AI technology throughout their platforms, and offering innovative AI produc…
Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and […]
کشف دو نقص امنیتی بحرانی با نام PHP۲Shell در موتور PHP، باعث شد سازمان‌ها و وب‌سایت‌ها برای پیشگیری از نفوذ، برخی خدمات دیجیتال خود را خاموش کنند.
استارتاپ چینی XAG پهپادهای کشاورزی خودکاری مجهز به ایستگاه‌های شارژ و تمیزکاری مستقل برای مقابله با کمبود نیروی کار عرضه کرد.
Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and memory-safety bugs in security-critical code without a running application. In its first open source research run, it found High or Critical issues in 45% of the projects tested, and in its first month of availability it produced ten published findings in eight projects, including the Crystal st…
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
در ادامه مسیر تحول در درمان بیماری‌های متابولیک؛ داروسازی دکتر عبیدی راهکاری نوین برای درمان نوع متوسط تا پیشرفته کبد چرب عرضه کرد
CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.…
چهارمین رویداد «باهم» همکاران سیستم با تمرکز بر هوش مصنوعی و نرم‌افزارهای سازمانی از ۶ تا ۹ آبان در نمایشگاه بین‌المللی تهران برگزار می‌شود.
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file
نخستین قسمت سریال اودیسه به کارگردانی دوو واکر و با استفاده از ابزار تصویری هوش مصنوعی گراک ایمجین منتشر شد.
Two critical flaws in PHP’s request lifecycle can enable unauthenticated remote code execution. Upgrade to a fixed release or install a vendor backport for older versions.
GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed infrastructure. GitLab.com, GitLab Self-Managed, and GitLab Dedicated are not impacted.Pillow is one of the most widely used image libraries in the Python ecosystem. It often sits several layers down in…
Oct 26, 2026 | 24 phishing simulation templates, ready to copy and paste: email, Teams, SMS, voice, QR code and deepfake, from easy to expert, with tells and lessons.
نظرسنجی آنتروپیک نشان می‌دهد ۹۱ درصد از متخصصان این شرکت انتظار دارند هوش مصنوعی تا سال ۲۰۳۰ به کشفی در تراز جایزه‌ی نوبل دست پیدا کند.
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At […]
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were
پیام‌رسان «بله» با انتشار کارنامه ۱۵ ماهه خود، از ثبت ۶۴ میلیون کاربر کل و پاسخ‌گویی هوش مصنوعی به ۳۴۲ میلیون پرسش خبر داد.
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application," a spokesperson for the company told The Hacker News via
مدیرعامل آمازون اعلام کرد بخش اعظم ظرفیت پردازش ابری این شرکت تا سال ۲۰۲۷ پیش‌فروش شده است.
