آرشیو ۹۰ روزه
جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحه اصلی خودش لینک دارد.
Not sure if a link is safe? Malwarebytes Scam Link Check scans suspicious links for signs of phishing, scams, malware, and other online threats before you click.
Key takeaways In the past year, 78 percent of organizations reported a confirmed or suspected AI-related security incident, according to Check Point’s 2026 Cloud Security Report. →No attacker required. Agents plan their own steps, and an agent trying to help can take one nobody asked for that deletes data, leaks it or widens someone’s access →Permissions and prompt screening miss the action itself. Least privilege ca…
Roughly 700 French supermarkets were hit by the cyberattacks, for which no group has claimed responsibility. The post Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers appeared first on SecurityWeek.
Platform points to Iran, Russia, and China but provides no public evidence for attribution
OpenAI می‌گوید نمایشگر هوشمند خانگی جدید اپل HomeView و دستگاه‌های دیگری که این شرکت به‌تازگی معرفی کرده، براساس همین اطلاعات ساخته شده‌اند. The post OpenAI کارمند سابق خود را به انتقال ۱۰۰ فایل محرمانه به مدیران اپل متهم کرد appeared first on دیجیاتو.
WhatsApp has introduced guest calling, letting people without an account join voice and video calls through a web browser. The feature supports individual and group calls with up to 32 participants, and requires host approval before guests can join. The update extends WhatsApp calling beyond registered users, removing the need for every participant to have … The post WhatsApp now lets people without accounts join cal…
A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild. The flaw affects the product’s Advanced Malware Protection (AMP) feature and stems from improper handling of email…
برای آلوده شدن به جاسوس‌افزار، همیشه لازم نیست روی لینکی مشکوک کلیک کنید یا برنامه‌ای ناشناس نصب کنید. گاهی نمایش یک تبلیغ اینترنتی هم می‌تواند شروع حمله باشد. پژوهشگران امنیتی دانشگاه تورنتو به شواهدی رسیده‌اند که نشان می‌دهد یک شرکت تبلیغاتی از زیرساخت نمایش آگهی برای شناسایی افراد مشخص و آلوده کردن دستگاه‌هایشان به جاسوس‌افزار استفاده کرده است.
اگر همین فردا دیگر چشم‌هایتان جایی را نبیند چطور باید با این موضوع کنار بیایید؟ چطور باید به قدم‌های بعدی ادامه دهید؟
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in
A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wi…
با ابزار سارا یوسفی، نام یا عبارت دلخواهتان را به خط بریل فارسی تبدیل کنید و تصویر آن را در استوری به اشتراک بگذارید؛ فرصتی برای آشنایی بیشتر با بریل.
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
سجاد موسوی، تیم‌لید سی‌اس‌آر اسنپ در یادداشتی برای زومیت از اقدامات اسنپ‌خودرو برای بهبود دسترس‌پذیری خدمات و کاهش موانع کاربران دارای معلولیت نوشت.
Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software <=5.18 (CVE-2026-107777) CVSS Vendor Equipment v3 6.5 Thermo Fisher Torrent Suite Software 1 Vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')…
The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versions of J4Care dcm4che are affected: dcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-1…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) EseeCloud Firmware <=4.9.86.0 (CVE-2026-107617, CVE-2026-97858, CVE-2026-105664) CVSS Vendor Equipment v3 9.8 Guangzhou Juan IoT Techn…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Eclipse Milo are affected: Eclipse Milo >=0.6.0| =1.0.0|<=1.1.4 (CVE-2026-62927, CVE-2026-58080, CVE-2026-61387) CVSS Vendor Equipment
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm <=v26.07.1 (CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335, CVE-2026-107334) Malcolm <=v26.08.0 (CVE-2026-107333, CVE-2026-107362) CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alt…
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04…
Amazon-owned Bee has launched its first new AI devices since its acquisition, including an updated wearable and a credit-card-sized recorder that attaches to smartphones. The devices can summarize conversations, create to-do lists, and integrate with Alexa and Amazon shopping, with prices starting at $74.99.
Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw “enables an authenticated attacker with network access to execute arbi…
ایرانسل، از ۲۳ تا ۲۹ مهر، ۲۰ درصد مبلغ خرید بسته مکالمه، اینترنت و شارژ را به کیف‌پول جیب‌جت مشترکان بازمی‌گرداند.
Improper restriction of XML external entity reference vulnerability (CVE-2026-88794) has been found in Sparx Systems Enterprise Architect software.
The FTC accuses Digital Forensics Corporation and affiliated companies of exploiting people seeking help with intimate-image blackmail.
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks
USN-8883-1 fixed a vulnerability in Go versions 1.18, 1.21, and 1.24. This update provides the corresponding fix for Go version 1.23. Original advisory details: It was discovered that the Go x/net/idna package incorrectly handled certain Punycode-encoded labels that decoded to ASCII-only labels. An attacker could possibly use this issue to bypass hostname-based access controls and escalate privileges.
