زومیت
روی تاریک هوش مصنوعی؛ توسعه «کلاد» شدیدا به گاز طبیعی وابسته است
پرونده‌ی بورسی آنتروپیک نشان می‌دهد توسعه‌ی هوش مصنوعی چگونه به گاز، خطوط انتقال و زیرساخت پرهزینه‌ی برق گره خورده است.
آرشیو ۹۰ روزه
همه اخبار
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
۱۱۷۱۶ خبر
صفحه ۲۸ از ۳۹۱
زومیت
اپل ۱۶۰ آسیب‌پذیری امنیتی آیفون را برطرف کرد؛ iOS ۲۷.۲ را همین‌حالا نصب کنید
اپل با انتشار به‌روزرسانی‌های iOS ۲۷.۲ و iPadOS ۲۷.۲، بیش از ۱۶۰ آسیب‌پذیری امنیتی خطرناک را در دستگاه‌های خود برطرف کرد.
The Hacker News
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory
CSO Online
OpenAI’s August fix for theft of reasoning traces was quickly bypassed
Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it, and paid a bug bounty for its discovery. The problem is that OpenAI had already deployed mitigations for the issue in August after a research report dubbed Stolen Thoughts revealed a sim…
Tenable Blog
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.Key TakeawaysCVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Goog…
The Register - Security
Japanese virtual desktop cloud hacked so hard it asks to be banned
CEO admits service used for foreign exchange trading had holes company was slow to fix
Dark Reading
So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring AI model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows.
CyberScoop
Experts temper emergency-level alarms over critical Brotli defect
The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild. The post Experts temper emergency-level alarms over critical Brotli defect appeared first on CyberScoop.
CERT-FR
Multiples vulnérabilités dans les produits Apple (27 octobre 2026)
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données. Apple indique que la vulnérabilité CVE-2026-86950...
GitLab Blog
Extend GitLab Duo Agent Platform into your business systems
Developers mostly use GitLab Duo Agent Platform where they already work: the IDE, merge requests, and issues. But DevSecOps teams also support the business systems the rest of the company runs on, and those systems break too.In Salesforce, for example, when a validation fails, a callout times out, or a null slips through a trigger, the error gets logged, but the log doesn’t explain the cause. An engineer still has to…
Quarkslab
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
Doyensec
ElectroNG is now open source!
ElectroNG is now free and open source! Today we are releasing both the desktop application and its core analysis engine under the Apache License 2.0, opening up years of Doyensec’s work on Electron application security to the community. Why we are open-sourcing ElectroNG We launched ElectroNG in September 2022 as a commercial static application security testing (SAST) tool for Electron applications. It grew out of ou…
CERT/CC Vulnerability Notes
VU#701544: mpc-lib hardened derivation fails to protect ancestor isolation
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. Description Fireblocks is a digital-asset custody and…
The Register - Security
Worm armed 42 GitHub repos by hiding a payload too big to fail
Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search
Security Affairs
Magento Campaign Infects 953 Online Stores Across Five Domains
Sansec tracks a Magento skimmer campaign that infected 953 stores, using five domains, bot filtering and malicious code hidden in CMS blocks. A criminal group has infected 953 online stores since July 2025, mostly Magento shops, according to Sansec researchers. The attackers add a small piece of code to store pages. When someone visits a […]
The Register - Security
LiteLLM supply chain attack started with an exposed master key
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
زومیت
هوش مصنوعی در فضا؛ ماه‌نورد رباتیک فلیپ مدل‌های زبانی بزرگ را به ماه می‌برد
ماه‌نورد فلیپ با اجرای آزمایشی مدل‌های زبانی بزرگ روی ماه، امکان استقلال بیشتر کاوشگرهای فضایی در مأموریت‌های آتی را فراهم می‌کند.
Tenable Blog
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster.Key takeawaysThe PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and u…
CERT/CC Vulnerability Notes
VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host me…
زومیت
هوش مصنوعی GPT-۶.۱ Terra با توانایی کنترل کامپیوتر و پیشرفت خیره‌کننده در کدنویسی از راه رسید
مدل GPT-۶.۱ Terra با تمرکز بر کار با کامپیوتر، استدلال بصری و هزینه‌ی کمتر، برای خودکارسازی وظایف روزمره از راه رسید.
Flare
Who Pays When AI Makes Cybercrime Cheaper? Inside the New Economics of Ransomware and Extortion
Tammy Harper, Senior Threat Intelligence Researcher Walking around Strasbourg during Underground Economy, I found myself thinking about the businesses as much as the buildings. Behind every restaurant storefront, there is work the customer never sees: someone supplies it, someone pays for it, and the business survives on whatever is left over. It made me wonder […] The post Who Pays When AI Makes Cybercrime Cheaper?…
The Hacker News
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
Dark Reading
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
The Register - Security
Microsoft releases emergency .NET security fixes for Google Brotli bug
Redmond joins growing list of software maintainers scrambling to patch compression flaw
The Hacker News
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
Rapid7 Blog
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.An attacker who can supply Brotli data that an application d…
EFF
Lessons Learned From 'AdFection' and What To Do Next
Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Alt…
Orca Security
PHP2Shell: From the attacker’s perspective
Executive Summary: What are CVE-2026-109618 and CVE-2026-109619? Why PHP vulnerabilities put most of the web at risk When you open a web page, something has to build that page before it reaches you. For roughly seven out of ten websites, the software doing that job is PHP. It sits on the web server, assembles the […]
زومیت
هکر پلی استیشن ۵ جایزه ۱۳٫۵ میلیارد تومانی را به خانه برد
گزارش حفره‌ای امنیتی که اجرای لینوکس روی PS۵ را ممکن می‌کرد، برای یک هکر ۵۰ هزار دلار (۱۳٫۵ میلیارد تومان) پاداش به‌همراه آورد.
AWS Security Bulletins
CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could cha…