زومیت
برای نخستین‌بار دارویی با قابلیت درمان عملکردی هپاتیت B تأیید شد
سازمان غذا و داروی آمریکا داروی جدیدی برای هپاتیت B تأیید کرده است که می‌تواند برخی بیماران را از مصرف مادام‌العمر داروهای ضدویروسی بی‌نیاز کند.
آرشیو ۹۰ روزه
همه اخبار
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
۱۱۷۹۹ خبر
صفحه ۳۷ از ۳۹۴
Wired Security
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
The Hacker News
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory,
The Hacker News
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
The Hacker News
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
Security Affairs
Capcom Data Breach Exposes 11.7 Million Email Addresses
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, […]
زومیت
ابولا از مرزهای کنگو گذشت؛ خطر انتقال پنهان ویروس جدی است
ابولا اکنون به نیجریه و کنیا رسیده و سه منطقه از آفریقا را درگیر کرده؛ اما هنوز مشخص نیست بیمار نیجریه‌ای کجا به این ویروس مرگبار آلوده شده است.
زومیت
اشتباه مهلک هوش مصنوعی در منو رستوران؛ یک کاسه توله‌ببر بخورید!
پلتفرم جاست ایت به دلیل نمایش ناخواسته‌ی تصاویر هوش مصنوعی از توله‌ببر به جای غذا در منوی خود، ناچار به عذرخواهی از مشتریان شد.
زومیت
حذف یک واژه کافی نبود؛ نگرانی ناشران از شروط تازه هوش مصنوعی متا
متا شرایط تجاری خود را تغییر داده است، اما کارشناسان حقوقی معتقدند بندهای جدید همچنان اجازه‌ی استخراج اطلاعات رسانه‌ها را می‌دهد.
زومیت
ترس از هوش مصنوعی برای نخستین‌بار در میان ۱۰ نگرانی بزرگ آمریکایی‌ها قرار گرفت
نتایج یک نظرسنجی جدید نشان می‌دهد که نیمی از آمریکایی‌ها از پیامدهای هوش مصنوعی بر نظام سیاسی و اقتصاد کشورشان می‌ترسند.
The Hacker News
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
Security Affairs
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central managem…
زومیت
امضای الکترونیکی تا دو هفته آینده به نسخه الکترونیک اضافه می‌شود/ ورود هوش مصنوعی به حوزه پزشکی در ایران
مدیرعامل بیمه سلامت از اضافه شدن امضای الکترونیک تا دو هفته آینده خبر داد و به اجرای طرح کمک‌تشخیصی هوش مصنوعی در ماموگرافی اشاره کرد.
زومیت
اوپن‌ای‌آی حالا هوش مصنوعی پرچمدارش را بدون اینترنت آموزش می‌دهد
اوپن‌ای‌آی پس از نفوذ مدل‌های هوش مصنوعی خود به سازمان‌ها، فرایند آموزش پیشرفته‌ترین سیستم‌هایش را در محیطی کاملا آفلاین از سر گرفت.
زومیت
هوش مصنوعی، سیاست امنیتی Bitcoin Core را تغییر داد
توسعه‌دهندگان بیت‌کوین کور به دلیل تسهیل کشف آسیب‌پذیری‌ها با هوش مصنوعی، سازوکار افشای رخنه‌های امنیتی را به‌طور اساسی تغییر دادند.
The Hacker News
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
EFF
The Vulnerability Apocalypse and Why We Should Fund Open Source
If you use the internet at all, you may have noticed that a large percentage of sites suddenly went down earlier this week—and all your nerdiest friends were talking about "The Vulnerability Apocalypse” and this thing called PHP that powers nearly 70% of the websites on the internet. You may find yourself wondering: what is PHP, what just happened, what is the vulnerability apocalypse, and what do I need to do? To fi…
EFF
Computer Security Is About to Get a Lot Worse, Here’s What You Can Do
It is a commonly held truth among computer geeks that there is no such thing as bug free software, or a secure computer. Any piece of software that anyone actually uses will have a security vulnerability somewhere in the code. The more complex that software is, the more likely there will be a vulnerability. Fortunately for everyone, finding severe vulnerabilities was generally considered an expensive and difficult ta…
Wordfence Blog
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ...Read More The post Wordfence Intelligence Week…
زومیت
رازگشایی اخترشناسان از «شب پرستاره»؛ کشف صورت فلکی پنهان در شاهکار ون‌گوگ
اخترشناسان با کشف صورت فلکی واقعی در «شب پرستاره»، تصور رایج درباره زمان دقیق خلق شاهکار ونسان ون‌گوگ را به‌کلی تغییر داده‌اند.
Dark Reading
Trust Is Not What It Seems — and Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.
CyberInsider
Popcorn Time updater flaw exposed millions of devices to hijacking
Eye Research delivered more than two million update downloads in an operation to disable an abandoned Popcorn Time updater that could have allowed attackers to hijack Windows and macOS systems with full privileges. The vulnerability, tracked as CVE-2026-30612, affected the Time4Popcorn fork. Its update mechanism trusted unsigned executables delivered over unencrypted HTTP, including through domains … The post Popcorn…
SANS Internet Storm Center
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
AWS Security Bulletins
CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server
Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment. We identified CVE-2026-115845, an issue in the Python code validator of the run_script too…
Unit 42 (Palo Alto)
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) appeared first on Unit 42.
The Hacker News
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Flashpoint
The Flashpoint Threat Intelligence Brief: Middle East
Flashpoint’s weekly analysis tracks shifting kinetic and cyber threat radiuses, geopolitical disruptions, and provides critical operational forecasts for the ongoing Middle East conflict. The post The Flashpoint Threat Intelligence Brief: Middle East appeared first on Flashpoint.
Microsoft Security Blog
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog.
Security Affairs
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP […]
Cloudflare Blog
Bringing post-quantum cryptography to geographically fenced key management
Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.