همه اخبار

[NEU] [hoch] QT: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen.

[NEU] [hoch] Gitea: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen.

[NEU] [UNGEPATCHT] [mittel] GStreamer: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GStreamer ausnutzen, um einen Denial of Service Angriff durchzuführen und um Daten zu manipulieren.

[NEU] [mittel] Gogs: Schwachstelle ermöglicht Darstellen falscher Informationen und Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gogs ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um falsche Informationen darzustellen.

[NEU] [hoch] ILIAS: Schwachstelle ermöglicht Codeausführung

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in ILIAS ausnutzen, um beliebigen Programmcode auszuführen.

[NEU] [mittel] Linux Kernel: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

[NEU] [UNGEPATCHT] [hoch] BusyBox: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in BusyBox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

[NEU] [mittel] Znuny: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Znuny ausnutzen, um Sicherheitsvorkehrungen zu umgehen, wodurch er Daten manipulieren und offenlegen kann.

[NEU] [hoch] Progress Software MOVEit: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Progress Software MOVEit ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen und um einen SQL-Injection Angriff durchzuführen.

ایلان ماسک: اسپیس‌ایکس خسارت خریدهای اشتباه گراک را پرداخت می‌کند

این موضوع درحالی اعلام شده که پلتفرم‌ها در قوانین خود، مسئولیت تراکنش‌هایی که ایجنت‌های هوش مصنوعی انجام می‌دهند را برعهده خود کاربران می‌دانند. The post ایلان ماسک: اسپیس‌ایکس خسارت خریدهای اشتباه گراک را پرداخت می‌کند appeared first on دیجیاتو.

The 2026 Infostealer Intelligence Shortlist: Top 10 Vendors Security Teams Should Know

Infostealer intelligence has become one of the important tool in cybersecurity as malware has become one of the most efficient tools in a cybercriminal's kit. A single infected laptop can leak saved passwords, browser cookies, autofill data, and enough machine details for an attacker to impersonate the user outright. Stolen session cookies are especially damaging because they let intruders skip multi-factor authentic…

Researchers Uncover Thousands of Phishing Domains Hiding Behind Inactive Pages

A domain returns a blank page. Maybe a generic “Not Found” message. There is no login form, suspicious branding, or obvious phishing content to investigate. Yet the phishing site may still be there. Check Point Exposure Management researchers uncovered a large scale, multi region phishing infrastructure designed to conceal active campaigns behind seemingly inactive domains. Starting with a handful of phishing URLs, t…

Analysis After the Refrigeration System Attack in France: Two Thirds of Exposed Refrigeration Controllers Share an Address with Cameras, Remote Desktop, and VPNs

By Adrian Cheek, Senior Cybercrime Researcher Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. The French national CERT published an alert on October 12, naming two series of refrigeration system […] The post Analysis After the R…

از برچسب‌های هوشمند تا ابزارهای صوتی؛ گجت‌های کاربردی زندگی روزمره‌ نابینایان

ابزارهای هوشمند با تسهیل کارهای روزمره، استقلال فردی و کیفیت زندگی افراد نابینا را بهبود می‌بخشند.

New Aoki Infostealer Targets AI Coding Assistant Credentials

Symantec warned that Aoki can steal API keys and tokens from a number of popular AI coding assistants, including Claude and Gemini

Huntress + AlgaPSA Integration: Built in Days by Nine Minds

Nine Minds used the Huntress API and public docs to turn Huntress incident reports into AlgaPSA tickets in days. See how they did it and what you can build.

Cloudflare and OpenAI: making AI discovery better for everyone

How Cloudflare and OpenAI are working together to help AI find useful content, keep up with changes, and make fewer wasted requests — making the experience better for users and website owners alike.

Israeli firm's digital ads enabling installation of 'zero-click' spyware

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could

Is this link safe? Find out with Malwarebytes Scam Link Check

Not sure if a link is safe? Malwarebytes Scam Link Check scans suspicious links for signs of phishing, scams, malware, and other online threats before you click.

Dangerous Deviation Detection: Catching the Agent Action Nobody Asked For

Key takeaways In the past year, 78 percent of organizations reported a confirmed or suspected AI-related security incident, according to Check Point’s 2026 Cloud Security Report. →No attacker required. Agents plan their own steps, and an agent trying to help can take one nobody asked for that deletes data, leaks it or widens someone’s access →Permissions and prompt screening miss the action itself. Least privilege ca…

Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers

Roughly 700 French supermarkets were hit by the cyberattacks, for which no group has claimed responsibility. The post Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers appeared first on SecurityWeek.

X purges 13,000 accounts linked to suspected meddling ahead of US midterms

Platform points to Iran, Russia, and China but provides no public evidence for attribution

OpenAI کارمند سابق خود را به انتقال ۱۰۰ فایل محرمانه به مدیران اپل متهم کرد

OpenAI می‌گوید نمایشگر هوشمند خانگی جدید اپل HomeView و دستگاه‌های دیگری که این شرکت به‌تازگی معرفی کرده، براساس همین اطلاعات ساخته شده‌اند. The post OpenAI کارمند سابق خود را به انتقال ۱۰۰ فایل محرمانه به مدیران اپل متهم کرد appeared first on دیجیاتو.

WhatsApp now lets people without accounts join calls

WhatsApp has introduced guest calling, letting people without an account join voice and video calls through a web browser. The feature supports individual and group calls with up to 32 participants, and requires host approval before guests can join. The update extends WhatsApp calling beyond registered users, removing the need for every participant to have … The post WhatsApp now lets people without accounts join cal…

Cisco warns of actively exploited Secure Email Gateway flaw

A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild. The flaw affects the product’s Advanced Malware Protection (AMP) feature and stems from improper handling of email…

کلیک هم لازم نیست؛ جاسوس‌افزار جدید از تبلیغات آنلاین برای نفوذ هدفمند استفاده می‌کند

برای آلوده شدن به جاسوس‌افزار، همیشه لازم نیست روی لینکی مشکوک کلیک کنید یا برنامه‌ای ناشناس نصب کنید. گاهی نمایش یک تبلیغ اینترنتی هم می‌تواند شروع حمله باشد. پژوهشگران امنیتی دانشگاه تورنتو به شواهدی رسیده‌اند که نشان می‌دهد یک شرکت تبلیغاتی از زیرساخت نمایش آگهی برای شناسایی افراد مشخص و آلوده کردن دستگاه‌هایشان به جاسوس‌افزار استفاده کرده است.

حلقه‌های اتصال در جهان نابینایان؛ از شعر و غزل تا ورزش و سفر

اگر همین فردا دیگر چشم‌هایتان جایی را نبیند چطور باید با این موضوع کنار بیایید؟ چطور باید به قدم‌های بعدی ادامه دهید؟

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wi…