Help Net Security سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۰۹:۳۰

Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign. Finding bugs is getting faster. Fixing them isn’t. HTTP2Shell shows why that gap matters, and how Sweet Virtual Patching protects r…

آسیب‌پذیری و روز صفر برنامه‌نویسی و زبان‌ها

خواندن متن کامل در Help Net Security درخواست حذف

این صفحه فقط عنوان و خلاصه کوتاه خبر را نمایش می‌دهد. متن کامل در منبع اصلی منتشر شده است.

خبرهای مرتبط

آرشیو کامل ←

CSO Online سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۱۱:۵۵

67% of security leaders say their teams struggle to meet business needs

AI, identity-based attacks, and expanding digital operations are putting pressure on already overstretched cybersecurity teams. Security vendor Barracuda’s Cybersecurity Skills Gap report also found that security teams are struggling to keep pace with expanding responsibilities. The vast majority of the 2,000 IT and security decision-makers surveyed report cybersecurity skills gaps. In particular, the most common cha…

آسیب‌پذیری و روز صفر فیشینگ امنیت ابری

منبع

The Hacker News سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۱۱:۱۳

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement

بدافزار و آلودگی آسیب‌پذیری و روز صفر باج‌افزار

منبع

Help Net Security سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۱۰:۰۰

What human hackers still do better than AI, according to HackerOne’s CEO

AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business. In this Help Net Security interview, Kara Sprague, CEO of HackerOne, talks about business logic bugs, what AI does to the crowd model, and why routine medium-severity findings may pay less. She also covers the growing pile of AI-assisted submissions, how programs sort useful reports from spam, and which…

آسیب‌پذیری و روز صفر تست نفوذ

منبع

Help Net Security سه‌شنبه ۱۲ آبان ۱۴۰۵ · ۰۹:۱۵

AI coding agents are installing MCP servers that will never be patched

When a developer tells an AI coding agent to “set up a GitHub MCP,” the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Source: Glow Security Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sess…

منبع