CERT-Bund
[UPDATE] [mittel] rsyslog: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rsyslog ausnutzen, um einen Denial of Service Angriff durchzuführen.
آرشیو ۹۰ روزه
همه اخبار
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
۱۱۶۲۹ خبر
صفحه ۲۳ از ۳۸۸
CyberInsider
Apple patches CoreGraphics flaw exploited on older iPhones
Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a previously exploited CoreGraphics vulnerability on older devices, including the iPhone XS, XS Max, and XR. The updates address three vulnerabilities, including a separate flaw that could let a malicious app access the camera without permission. The most significant fix concerns CVE-2026-86950, an out-of-bounds write vulnerability … The post Apple patches CoreGr…
دیجیاتو
حباب هوش مصنوعی در چین ترکید؛ سقوط ۴۰ درصدی شاخص سهام فناوری
نزدیک به ۴۸۰ میلیارد دلار از ارزش بازار مربوط به شاخص فناوری استار ۵۰ چین از بین رفت. The post حباب هوش مصنوعی در چین ترکید؛ سقوط ۴۰ درصدی شاخص سهام فناوری appeared first on دیجیاتو.
CSO Online
Alibaba AI model tried to send data to Beijing server, Cohere says
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival developer Cohere said, raising concerns about the security of AI agents with access to enterprise systems. The model, Qwen3.8-Flash-Next, was being tested using Microsoft’s CTI-REALM cybersecurity benchmark, which tasked it with writing a rule to detect malicious file d…
The Cyber Express
Tailscale Investigates Serious SSH Privilege Escalation Issues After Tailworm Report
A new report called Tailworm claims that a single hacked device on a Tailscale network can gain root access on other servers it reaches. Two conditions apply: Tailscale SSH must allow port forwarding, and the attacker must already control a device the network's access rules permit to connect to the target. Erica Windisch of Cyberdione Labs published Tailworm on October 25 after three days of lab testing on Tailscale…
CERT-Bund
[UPDATE] [mittel] QT: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in QT ausnutzen, um einen Denial of Service Angriff durchzuführen oder Informationen offenzulegen.
CERT-Bund
[UPDATE] [hoch] Mautic: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
Schneier on Security
Hiding Capabilities in AI Models
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights…
Infosecurity Magazine
Copenhagen University Breach Compromises Data on Half a Million People
Hackers have stolen personal information on over 520,000 people from the University of Copenhagen
CERT Polska
Vulnerabilities in twofactor_gauthenticator plugin for Roundcube
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.
Security Affairs
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score…
شهر سخت‌افزار
افشای مشخصات پردازنده‌های Raptor Lake Next اینتل؛ بازگشت تیم آبی به پلتفرم DDR۴
ظاهراً اینتل قصد دارد با معرفی پردازنده‌های جدید Raptor Lake Next، دوباره به سراغ پلتفرم DDR۴ برود. در همین رابطه مشخصات ۲ مدل از این خانواده به بیرون درز کرده است که می‌تواند نشانه‌ای از نزدیک شدن زمان عرضه این پردازنده‌ها باشد.
Infosecurity Magazine
First ISC2 AI Security Certification Expected for Early 2027
ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification
Cisco Talos
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
زومیت
ساخت پاورپوینت با هوش مصنوعی در چند دقیقه؛ آموزش تبدیل جزوه به اسلاید با جمنای نوت‌بوک
با ابزار جمنای نوت‌بوک گوگل می‌توانید جزوه، کتاب یا فایل‌های آموزشی را به اسلایدهای فارسی تبدیل کنید و خروجی پاورپوینت بگیرید.
DarkOwl
ZeroForums: A New Chinese-Language Dark Web Forum Mimicking Established Cybercriminal Platforms
ZeroForums, a new Chinese-language dark web forum with a design that closely copies well-known cybercrime forums has emerged. DarkOwl’s has been monitoring since its launch. The post ZeroForums: A New Chinese-Language Dark Web Forum Mimicking Established Cybercriminal Platforms appeared first on DarkOwl, LLC.
CyberScoop
What happens when security tools go dark before the ransomware
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.
Security Affairs
Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP
Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The […]
دیجیاتو
موج جدید تعدیل نیرو در مایکروسافت: به ۶۰ هزار نفر پیشنهاد خروج داوطلبانه داده شد
کارکنان بخش‌های هوش مصنوعی، ویندوز، ایکس‌باکس و منابع انسانی بدون درنظرگرفتن سن و سابقه مشمول این طرح هستند. The post موج جدید تعدیل نیرو در مایکروسافت: به ۶۰ هزار نفر پیشنهاد خروج داوطلبانه داده شد appeared first on دیجیاتو.
SecurityWeek
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.
The Hacker News
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those
دیجیاتو
اپل در iOS ۲۷.۲ به تصاویر تولیدشده با هوش مصنوعی واترمارک نامرئی گوگل اضافه می‌کند
تصاویر تولیدشده با Image Playground و برخی عکس‌های ویرایش‌شده با هوش مصنوعی در iOS ۲۷.۲ واترمارک نامرئی SynthID گوگل خواهند داشت. The post اپل در iOS ۲۷.۲ به تصاویر تولیدشده با هوش مصنوعی واترمارک نامرئی گوگل اضافه می‌کند appeared first on دیجیاتو.
Security Affairs
Cohere Finds Qwen AI Model Contacting a Server in China
Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. “Asked to write a defensive detection rule, Qwen3.8-Flash-Next […]
دیجیاتو
هوش مصنوعی Qwen در آزمایش‌ها قصد ارسال اطلاعات به چین را داشت
پژوهشگران این مشکل را ناشی از خطای آموزشی مدل می‌دانند، نه تلاشی برای جاسوسی عامدانه. The post هوش مصنوعی Qwen در آزمایش‌ها قصد ارسال اطلاعات به چین را داشت appeared first on دیجیاتو.
CERT-Bund
[UPDATE] [hoch] ESRI ArcGIS: Mehrere Schwachstelle
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen SQL-Injection oder Cross Site Scripting Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service zu verursachen.
The Cyber Express
Columbia University Settles $16.1M Data Breach Lawsuit After 2025 Cyberattack
An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday. The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Ange…
شهر سخت‌افزار
جاسوس‌افزار جنجالی پگاسوس در صربستان؛ نفوذ به تلفن حامیان اعتراضات بدون حتی یک کلیک
درحالی‌که اعتراضات دانشجویی صربستان طی ماه‌های گذشته به یکی از مهم‌ترین چالش‌های سیاسی این کشور تبدیل شده، پژوهشگران امنیت سایبری از نفوذ موفق جاسوس‌افزار پگاسوس به برخی سران این اعتراضات خبر می‌دهند. نکته بسیار مهم این است که این حملات با روش Zero-Click و بدون کلیک روی لینک آلوده انجام شده است. اگرچه هویت عاملان این حمله هنوز مشخص نیستند ولی احتمال نفوذ دولت صربستان در این قضیه مطرح شده است.
CSO Online
The days of assuming another company’s breach is someone else’s problem are over
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a b…
The Hacker News
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past
NCSC Netherlands
NCSC-2026-0456 [1.00] [M/H] Kwetsbaarheden verholpen in Apple iOS en iPadOS
Apple heeft kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals onvoldoende validatie van symbolische links, onjuiste permissiecontroles, out-of-bounds lees- en schrijffouten, use-after-free fouten, integer overflows, race conditions, type confusion, en logische fouten in state management. Deze kunnen leiden tot ongeautoriseerde toegang tot gevoelige gebruikersda…