آرشیو ۹۰ روزه
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
پژوهشگران این مشکل را ناشی از خطای آموزشی مدل می‌دانند، نه تلاشی برای جاسوسی عامدانه. The post هوش مصنوعی Qwen در آزمایش‌ها قصد ارسال اطلاعات به چین را داشت appeared first on دیجیاتو.
Ein Angreifer kann mehrere Schwachstellen in ESRI ArcGIS ausnutzen, um einen SQL-Injection oder Cross Site Scripting Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial of Service zu verursachen.
An internal investigation into the June 2025 Columbia University cyberattack found no evidence that the stolen data was sold or distributed on the dark web, Columbia University Information Technology announced Friday. The probe, which largely concluded over the summer, determined the attack was politically motivated and found no sign the hacker sought financial gain. The University also said claims administrator Ange…
درحالی‌که اعتراضات دانشجویی صربستان طی ماه‌های گذشته به یکی از مهم‌ترین چالش‌های سیاسی این کشور تبدیل شده، پژوهشگران امنیت سایبری از نفوذ موفق جاسوس‌افزار پگاسوس به برخی سران این اعتراضات خبر می‌دهند. نکته بسیار مهم این است که این حملات با روش Zero-Click و بدون کلیک روی لینک آلوده انجام شده است. اگرچه هویت عاملان این حمله هنوز مشخص نیستند ولی احتمال نفوذ دولت صربستان در این قضیه مطرح شده است.
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a b…
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past
Apple heeft kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals onvoldoende validatie van symbolische links, onjuiste permissiecontroles, out-of-bounds lees- en schrijffouten, use-after-free fouten, integer overflows, race conditions, type confusion, en logische fouten in state management. Deze kunnen leiden tot ongeautoriseerde toegang tot gevoelige gebruikersda…
آی آر پریمیوم با عرضه اشتراک ابزارهای شناخته‌شده‌ای مانند ChatGPT، Gemini و Claude، امکان بررسی گزینه‌های مختلف را برای کاربران فراهم می‌کند. The post خرید پرفروش‌ترین سرویس هوش مصنوعی از آی آر پریمیوم appeared first on دیجیاتو.
Two critical Wasmtime sandbox escape flaws, CVE-2026-115889 and CVE-2026-115893, let a crafted WebAssembly (Wasm) module push the Cranelift compiler into generating unsafe machine code. The Bytecode Alliance fixed both on October 19, 2026, and rated each 9.9 under CVSS v3.1. Platforms that compile Wasm from customers or other outside parties carry the most risk, because […]
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products. The post Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems appeared first on SecurityWeek.
اوپن‌ای‌آی از سه دستاورد ادعایی هوش مصنوعی در ریاضیات، علوم کامپیوتر و فیزیک خبر داد که انتقادهایی هم به همراه داشت. The post OpenAI مدعی دستیابی به سه دستاورد بزرگ در ریاضیات، فیزیک و علوم کامپیوتر شد appeared first on دیجیاتو.
یاسمین رضوی، شریک اسپارک کپیتال، به عنوان تنها سرمایه‌گذار خطرپذیر در هیئت‌مدیره‌ی شرکت هوش مصنوعی آنتروپیک حضور دارد.
سیتیزن‌لب تأیید کرد آیفون رئیس دانشگاه بلگراد با روش بدون کلیک و از طریق جاسوس‌افزار پگاسوس هدف نفوذ امنیتی قرار گرفته است.
اوپن‌ای‌آی سه دستاورد بزرگ در ریاضیات، علوم کامپیوتر و فیزیک معرفی کرد، اما شیوه‌ی انتشار و اعتبارسنجی آن‌ها به مسئله‌ای علمی بدل شده است.
پرونده‌ی بورسی آنتروپیک نشان می‌دهد توسعه‌ی هوش مصنوعی چگونه به گاز، خطوط انتقال و زیرساخت پرهزینه‌ی برق گره خورده است.
اپل با انتشار به‌روزرسانی‌های iOS ۲۷.۲ و iPadOS ۲۷.۲، بیش از ۱۶۰ آسیب‌پذیری امنیتی خطرناک را در دستگاه‌های خود برطرف کرد.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory
Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. The problem is that OpenAI had already deployed mitigations for the issue in August after a research report dubbed Stolen Thoughts revealed a sim…
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.Key TakeawaysCVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Goog…
CEO admits service used for foreign exchange trading had holes company was slow to fix
Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows.
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. The post Experts temper emergency-level alarms over critical Brotli defect appeared first on CyberScoop.
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données. Apple indique que la vulnérabilité CVE-2026-86950...
Developers mostly use GitLab Duo Agent Platform where they already work: the IDE, merge requests, and issues. But DevSecOps teams also support the business systems the rest of the company runs on, and those systems break too.In Salesforce, for example, when a validation fails, a callout times out, or a null slips through a trigger, the error gets logged, but the log doesn’t explain the cause. An engineer still has to…
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
ElectroNG is now free and open source! Today we are releasing both the desktop application and its core analysis engine under the Apache License 2.0, opening up years of Doyensec’s work on Electron application security to the community. Why we are open-sourcing ElectroNG We launched ElectroNG in September 2022 as a commercial static application security testing (SAST) tool for Electron applications. It grew out of ou…
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. Description Fireblocks is a digital-asset custody and…
Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search
Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a […]
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
