tsecurity.de - News Radar & Live Feeds

From Private Notes to Open Library: Building Curiosity Vault with Astro

Sun, 30 Aug 2026 07:26:51 +0200

I recently open-sourced a project called Curiosity Vault — a small static site built with Astro that turns personal notes into a public, structured library of guides and curated collections (books, movies). Why I had scattered notes on things like studying methods, building an MVP, job-hunting, and public speaking. Instead of keeping them private,... Weiterlesen

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

Sun, 30 Aug 2026 07:26:48 +0200

cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical... Weiterlesen

Bugs Are Innocent Until Reproduced: Building Verdict, an Evidence-First Agent Harness

Sun, 30 Aug 2026 07:26:21 +0200

Most flaky bug reports end in one of two places: "cannot reproduce" or a patch nobody can prove fixed the problem. I built Verdict around a stricter idea: Bugs are innocent until reproduced. Verdict turns a GitHub issue into a bounded investigation. It runs an approved command repeatedly under approved conditions, keeps every observation and... Weiterlesen

Your MCP Server Says It Is Read-Only. Who Checked?

Sun, 30 Aug 2026 07:26:21 +0200

MCP servers describe their own tools. A tool can publish readOnlyHint: true, and an agent harness may use that annotation to decide whether a human approval card is needed. That creates an uncomfortable trust boundary: the server being evaluated is also the server describing how dangerous it is. I built Airlock to test the declaration against... Weiterlesen

Building an Agentic RAG AI Agent with FAISS, BM25 and Qwen

Sun, 30 Aug 2026 07:26:20 +0200

I recently completed a project as part of my AI Engineering learning journey: an Agentic RAG AI Agent that answers user questions based on a provided knowledge base. The main goal of this project was to build an AI assistant that does not simply rely on its general knowledge. Instead, it first searches a knowledge base, retrieves relevant... Weiterlesen

Building a Closed-Domain Agentic AI Knowledge Assistant with Hybrid RAG

Sun, 30 Aug 2026 07:26:18 +0200

I recently built an "Agentic AI Knowledge Assistant" that combines "Retrieval-Augmented Generation (RAG), hybrid search, and an LLM agent" to answer questions strictly from a predefined knowledge base. One of the main goals of this project was to address a common problem with LLM applications: the model should not answer questions using its... Weiterlesen

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

Sun, 30 Aug 2026 07:26:17 +0200

VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are... Weiterlesen

How My Own Script Killed Instagram Sessions Every Night: pkill and a Shared Chrome Profile

Sun, 30 Aug 2026 07:26:17 +0200

I built a fleet of 171 automation jobs to grow my business — and one of them was quietly murdering another one's login session every single night for days before I figured out why. Here's the arc: I made ¥100k/month as a university student, stacked side jobs up to ¥600k/month, got laid off and went back to zero, then spent six months building an... Weiterlesen

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

Sun, 30 Aug 2026 07:26:17 +0200

ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker. The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted... Weiterlesen

Effortless UI Context for AI Coding: Inside ViteLens for React & Vite

Sun, 30 Aug 2026 07:26:17 +0200

When prompting AI coding tools like OpenAI Codex, Cursor, Claude Code, or GitHub Copilot to refactor a frontend component, providing accurate visual context (DOM hierarchy, CSS classes, container dimensions) is often a bottleneck. ViteLens solves this by letting you Ctrl + Click multiple UI elements on localhost and 1-click copy structured... Weiterlesen

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth

Sun, 30 Aug 2026 07:26:16 +0200

Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through... Weiterlesen

I stopped typing: a hands-on guide to voice-first client work with Wispr Flow (and an open-source Skills kit)

Sun, 30 Aug 2026 07:26:16 +0200

5,410 dictations in the last few months, 1,616 of them straight into a terminal. This is not a post about a tool. It is a guide to the rail you build after it. What is here: Three real examples of a spoken sentence turning into work Ten minutes of settings inside Wispr Flow, MCP included The rail in three connections, and a one-week task list Four... Weiterlesen

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

Sun, 30 Aug 2026 07:26:12 +0200

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as... Weiterlesen

Software Bill of Materials in Percona Server for MongoDB

Sun, 30 Aug 2026 07:26:11 +0200

Introduction A software bill of materials (SBOM) offers end users enhanced supply chain visibility, thereby facilitating license compliance and timely vulnerability detection. An SBOM of an application, library, or framework (collectively referred to as a “component”) is a machine-readable document that enumerates all other components it... Weiterlesen

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Sun, 30 Aug 2026 07:26:11 +0200

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute... Weiterlesen

Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Sun, 30 Aug 2026 07:26:10 +0200

Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS... Weiterlesen

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Sun, 30 Aug 2026 07:26:09 +0200

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS... Weiterlesen

The State of Ransomware in Education 2026

Sun, 30 Aug 2026 07:26:08 +0200

Insights from 226 IT and cybersecurity leaders across the education sector in 17 countries whose organizations were hit by ransomware in the past year. Weiterlesen

ChatGPT for Teens Adds New Safeguards — but Safety Gaps Remain

Sun, 30 Aug 2026 07:26:08 +0200

ChatGPT for Teens adds stronger protections for users ages 13 to 17, but parents still face limits around monitoring, age prediction, and AI safety. The post ChatGPT for Teens Adds New Safeguards — but Safety Gaps Remain appeared first on TechRepublic. Weiterlesen

OpenAI Bans Russian ChatGPT Accounts Used in Covert Influence Campaign

Sun, 30 Aug 2026 07:26:06 +0200

OpenAI banned Russian ChatGPT accounts tied to a covert influence campaign involving copied research, fake attribution and coordinated social posts. The post OpenAI Bans Russian ChatGPT Accounts Used in Covert Influence Campaign appeared first on TechRepublic. Weiterlesen

Fake GTA 6 Demo Spreads Malware: How to Spot the Scam

Sun, 30 Aug 2026 07:26:05 +0200

There is no legitimate GTA 6 demo. Fake Rockstar sites are distributing Vidar malware that targets passwords, cookies, and logged-in browser sessions. The post Fake GTA 6 Demo Spreads Malware: How to Spot the Scam appeared first on TechRepublic. Weiterlesen

Gunra ransomware: what you need to know

Sun, 30 Aug 2026 07:26:05 +0200

The ransomware gang Gunra has been creating havoc - exploiting unpatched VPNs and firewalls to steal data, encrypt systems, and extort victims across healthcare, finance, manufacturing, and more. Read more in my article on the Fortra blog. Weiterlesen

Smashing Security podcast #482: This hacker leaked GTA 6 – and launched their own cryptocurrency

Sun, 30 Aug 2026 07:26:04 +0200

A hacker calling themselves "CYBERLEEK" has been leaking gameplay footage from GTA 6 ahead of its official reveal this week - but they're not asking Rockstar Games for a ransom. Instead, they've launched their own cryptocurrency, promising to release ever more juicy clips from a virtual strip club... Meanwhile, your smart TV might be doing more... Weiterlesen

Shai-Hulud hackers: two men charged over TeamPCP’s global supply chain crime spree that hit OpenAI, and thousands more

Sun, 30 Aug 2026 07:26:03 +0200

More than 1,000 organisations, 500,000 stolen credentials, and one self-propagating worm named after a Dune sandworm - two men now face charges over TeamPCP's global hacking spree. Read more in my article on the Hot for Security blog. Weiterlesen

Android-Malware blockiert Google Play per VPN-Trick

Sun, 30 Aug 2026 07:26:02 +0200

Die Android-Malware ToxicPanda wird immer gefährlicher: Sie blockiert Google Play, kapert Sicherheitsfunktionen und späht Banking-Apps aus. Weiterlesen

Mehrere Probleme in postgresql16-anonymizer (Fedora)

Sun, 30 Aug 2026 07:26:01 +0200

Zwei Probleme in perl-Imager (Fedora)

Sun, 30 Aug 2026 07:26:00 +0200

Denial of Service in rust-h2 (Fedora)

Sun, 30 Aug 2026 07:25:59 +0200

Zwei Probleme in bluez (Fedora)

Sun, 30 Aug 2026 07:25:59 +0200

Preisgabe von Informationen in python-pynitrokey (Fedora)

Sun, 30 Aug 2026 07:25:58 +0200

Preisgabe von Informationen in pyOpenSSL (Fedora)

Sun, 30 Aug 2026 07:25:57 +0200

Preisgabe von Informationen in python-cryptography (Fedora)

Sun, 30 Aug 2026 07:25:53 +0200

Cross-Site Scripting in Freenet (Gentoo)

Sun, 30 Aug 2026 07:25:52 +0200

How to Evaluate Live & Voice Agents in ADK

Sun, 30 Aug 2026 07:25:52 +0200

Moving live voice agents from demo to production requires rigorous, automated testing to handle the unpredictability of real multi-turn conversations. ADK now provides native live evaluation, allowing developers to test graph-based agent workflows against LLM-driven simulated users that generate actual audio via Gemini TTS. By defining evaluation... Weiterlesen

How to Delete Printer Driver In Windows 11

Sun, 30 Aug 2026 07:25:44 +0200

Key TakeawaysIf your printer isn't working correctly on Windows 11, removing and reinstalling the printer driver might help resolve the issue, which can often be more effective than fixing hardware problems.You can delete the printer driver in Windows 11 by going to the Settings app, accessing 'Bluetooth & devices,' then 'Printers &... Weiterlesen

How to Connect and Pair Airpods to Windows 11 PC Laptop

Sun, 30 Aug 2026 07:25:39 +0200

Key TakeawaysApple's AirPods, known for ease of connection within Apple devices, can also be paired with Windows 11 PCs via Bluetooth, providing limited functionality compared to Apple ecosystem.To pair AirPods with a Windows 11 PC, ensure the Bluetooth driver is updated, access settings, turn on Bluetooth, and follow the steps to put AirPods in... Weiterlesen

How to Change Cursor Size, Theme and Color in Windows 11

Sun, 30 Aug 2026 07:25:38 +0200

Key TakeawaysWindows 11 offers customization options for changing cursor size and color, allowing users to personalize their PC experience.Two methods are available to customize the cursor: Settings app and Control Panel, each providing step-by-step instructions.By following the outlined steps in either Settings or Control Panel, users can easily... Weiterlesen

How to Change Size Of Taskbar in Windows 11

Sun, 30 Aug 2026 07:25:38 +0200

Key TakeawaysWindows 11 introduces a new taskbar design, which some users may find too large and want to resize.To change the taskbar size in Windows 11, users can make adjustments in the Registry Editor.By following a step-by-step guide, users can enable a smaller taskbar in Windows 11 and revert to the default size if needed.Windows […] The post... Weiterlesen

Rust language adds algebraic floating-point methods

Sun, 30 Aug 2026 07:25:32 +0200

The Rust team has released Rust 1.98.0, an update to the language that introduces algebraic methods for floating-point operations. Developers who have a previous version of Rust installed via rustup can update to Rust 1.98.0 by running rustup update stable. Introduced August 20, Rust 1.98.0 brings algebraic methods for addition, subtraction,... Weiterlesen

Everyone hates datacentres. Do we really need them? – podcast

Sun, 30 Aug 2026 07:25:30 +0200

AI companies have promised us world-shifting technology. But there’s a cost: loud, unsightly datacentres that drain environmental resources. As the government pushes their rapid growth, can local communities do anything to push back? Madeleine Finlay speaks to the Guardian’s global technology reporter Aisha Down about the backlash to datacentres... Weiterlesen

Who actually benefits from new datacentres in Australia? - podcast

Sun, 30 Aug 2026 07:25:29 +0200

National cabinet met on Wednesday to discuss the federal government’s plan for new AI datacentre development. Queensland and the Northern Territory have won a carve-out so that theirs can be powered by coal and gas – rather than renewables.Meanwhile, the fight between the West Australian premier Roger Cook and the Productivity Commission over his... Weiterlesen

The tussle over Australian datacentres is just beginning – and it’s been far from easy so far | Tom McIlroy

Sun, 30 Aug 2026 07:25:28 +0200

As he negotiates Australia’s AI future, the prime minister is under pressure from leaders of conservative states and territoriesAustralian Politics podcast: Who actually benefits from new datacentres in Australia?Get our breaking news email, free app or daily news podcastTucked away at the end of a media release from the Australian Energy Market... Weiterlesen

Claude, Codex, and Hermes installed unowned code inside corporate networks

Sun, 30 Aug 2026 07:25:27 +0200

Documentation files on more than 100 websites are referencing potentially dangerous executable content that gets installed automatically when visited by many AI agents. A few dozen companies, some of them Fortune 500s, are among those that executed proof-of-concept code. At least one misconfigured site is directing visitors, human or AI, to live... Weiterlesen

Python Data Classes Beyond the Boilerplate

Sun, 30 Aug 2026 07:25:24 +0200

Learn how Python dataclasses go beyond reducing boilerplate with custom fields, validation, computed attributes, immutability, and memory optimization techniques. Weiterlesen

Post-DEF CON phishing campaign delivered AMOS and NetSupport malware

Sun, 30 Aug 2026 07:25:13 +0200

A phishing campaign targeting attendees of Black Hat and DEF CON conferences involved distributing information-stealing malware and remote access malware via a malicious Google Doc and fake DocSend installers for macOS and Windows. The Huntress team learned about the phishing attack after one of its researchers received a direct message on X on... Weiterlesen

Vercel AI Open-Sources vgpu: A TypeScript WebGPU Library for AI Agent Shaders

Sun, 30 Aug 2026 07:25:08 +0200

Shaders are still the hardest thing to ship on a normal web team. WebGPU gives you the hardware, then hands you adapters, bind group layouts, and pipeline descriptors before a single pixel moves. Vercel spent that cost internally building the shaders on vercel.com, and has now open-sourced the result. vgpu is a TypeScript library that treats .wgsl... Weiterlesen

Meet ‘Code-as-World’: An Agentic Loop That Rewrites Real Videos Into Executable MuJoCo Physics Programs

Sun, 30 Aug 2026 07:25:07 +0200

MirroS released Code-as-World: a paradigm that represents physical worlds through executable world representations. The argument is narrow and testable: pixels are evidence of a physical scene, not its ontology. A video model can predict plausible frames without ever representing mass, contact, or gravity. So instead of pixels, latents, or... Weiterlesen

Vulnerability Management: Process, Tools and Best Practices for Enterprise (2026)

Sun, 30 Aug 2026 07:25:02 +0200

By HOC Team | Last updated: August 2026 | Read time: ~24 min In December 2021, the Apache Log4Shell vulnerability (CVE-2021-44228) was published. Within 12 hours, scanning for vulnerable systems had begun at scale. Within 72 hours, exploitation attempts numbered in the millions. Organisations with a mature vulnerability management programme... Weiterlesen

Agentic Resource Discovery (ARD): An open specification for agent discovery

Sun, 30 Aug 2026 07:24:58 +0200

How AWS Agent Registry and the Agentic Resource Discovery (ARD) specification enable cross-environment discovery for your agents As organizations scale their use of artificial intelligence (AI) agents and tools, finding the right resource becomes the hard part. Teams build Model Context Protocol (MCP) servers, deploy agents, and create specialized... Weiterlesen

Introducing new Ray capabilities on SageMaker HyperPod

Sun, 30 Aug 2026 07:24:57 +0200

Today, we are announcing new Ray capabilities on Amazon SageMaker HyperPod that integrate Ray with the HyperPod purpose-built infrastructure for foundation model training and serving. Ray is an open-source framework that data scientists use to scale distributed Python workloads across clusters of GPUs, from distributed training with Ray Train to... Weiterlesen

7 Async Patterns for Running Agents Concurrently in Python

Sun, 30 Aug 2026 07:24:55 +0200

In this article, you will learn seven async patterns for running AI agents concurrently in Python, what each pattern is suited for, and the production-level... Weiterlesen

Managing Small Context Windows in Language Models

Sun, 30 Aug 2026 07:24:54 +0200

In this article, you will learn three practical strategies for managing small context windows in large language models, along with working Python examples that demonstrate... Weiterlesen

Learn Vectorized Thinking in Python Through Examples

Sun, 30 Aug 2026 07:24:53 +0200

In this article, you will learn how to think in terms of vectorized operations using NumPy, replacing slow Python loops with efficient array-level computations. Topics... Weiterlesen

JavaScript obfuscation: From party trick to phishing kit

Sun, 30 Aug 2026 07:24:51 +0200

We open a JavaScript artifact hoping for code, and instead get string arrays, strangely named functions, encoded URLs, runtime decoders, and eval statements. That is the point where “reading the script” stops being enough. Obfuscated JavaScript is still code, but it is code with the useful context stripped out, the names ruined, the strings... Weiterlesen

Exploits and vulnerabilities in Q2 2026

Sun, 30 Aug 2026 07:24:48 +0200

The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of vulnerabilities emerging, particularly in the Linux... Weiterlesen

The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

Sun, 30 Aug 2026 07:24:47 +0200

Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42. Weiterlesen

Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety

Sun, 30 Aug 2026 07:24:46 +0200

New research reveals that AI safety refusal lives in a thin neural layer, highlighting the critical need for external, multi-layered security. The post Perturbation Probing: A New Diagnostic for the Fragility of LLM Safety appeared first on Unit 42. Weiterlesen

Detection and response for the actively exploited ProxyShell vulnerabilities

Sun, 30 Aug 2026 07:24:42 +0200

On August 21, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) released an urgent notice related to the exploitation of ProxyShell vulnerabilities (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523). By chaining these vulnerabilities together, threat actors are compromising unpatched Microsoft Exchange servers and gaining footholds... Weiterlesen

Hunting In Memory

Sun, 30 Aug 2026 07:24:38 +0200

Threat Hunters are charged with the difficult task of sifting through vast sources of diverse data to pinpoint adversarial activity at any stage in the attack lifecycle. To be successful, hunters must continually hone their subject matter expertise on the latest attacker techniques and detection methods. Memory resident malware, which presents... Weiterlesen

Getting the Most Out of Transformers in Elastic

Sun, 30 Aug 2026 07:24:38 +0200

Preamble In 8.3, our Elastic Stack Machine Learning team introduced a way to import third party Natural Language Processing (NLP) models into Elastic. As security researchers, we HAD to try it out on a security dataset. So we decided to build a model to identify malicious command lines by fine-tuning a pre-existing model available on the Hugging... Weiterlesen

Detecting and responding to Dirty Pipe with Elastic

Sun, 30 Aug 2026 07:24:37 +0200

Preamble Dirty Pipe is a local privilege escalation vulnerability that is easily exploitable with a handful of working exploit POCs already available. Its broad scope (any user-readable file and affected Linux versions) along with its evolving nature (the SUID shell backdoor exploit) make CVE-2022-0847 especially dangerous for administrators of... Weiterlesen

Detection rules for SIGRed vulnerability

Sun, 30 Aug 2026 07:24:36 +0200

To defend your environment from the SIGRed vulnerability, we recommend implementing the detection logic included below into your environment using technology such as Endpoint security, Winlogbeat, Packetbeat, or network security monitoring (NSM) platforms such as Zeek or Suricata. Executive summary On July 14, 2020, Microsoft released a security... Weiterlesen

Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security

Sun, 30 Aug 2026 07:24:35 +0200

To understand how Elastic is currently assessing internal risk of this vulnerability in our products please see the advisoryhere. This blog has been updated (Dec. 17, 2021) with further detection and hunting improvements since its initial publish. Overview This blog post provides a summary of CVE-2021-44228 and provides Elastic Security users with... Weiterlesen

Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

Sun, 30 Aug 2026 07:24:34 +0200

On March 29, 2022 a vulnerability in the Spring framework was disclosed to the public by VMware. This vulnerability had several prerequisites affecting impact: Spring framework versions 5.3.0-5.3.17, 5.2.0-5.2.19, potentially software versions prior to 5.2.x An application running as a Spring MVX or WebFlux object Apache Tomcat as the container... Weiterlesen

Analysis of Log4Shell vulnerability & CVE-2021-45046

Sun, 30 Aug 2026 07:24:34 +0200

To understand how Elastic is currently assessing internal risk of this vulnerability in our products please see the advisoryhere. This document was updated on December 17, 2021 to reflect a revised CVSS score for CVE-2021-45046, and new findings by the community. In recent days Log4Shell, or CVE-2021-44228, has dominated the news cycle in the... Weiterlesen

EMOTET Dynamic Configuration Extraction

Sun, 30 Aug 2026 07:24:33 +0200

Key takeaways The EMOTET developers have changed the way they encode their configuration in the 64bit version of the malware. Using code emulation we can bypass multiple code obfuscation techniques. The use of code emulators in config extractors will become more prevalent in the future. To download the EMOTET configuration extractor, check out our... Weiterlesen

QBOT Configuration Extractor

Sun, 30 Aug 2026 07:24:23 +0200

Python script to extract the configuration from QBOT samples. Download qbot-config-extractor.tar.gz Getting Started This tool provides a Python module and command line tool that will extract configurations from the QBOT malware samples and dump the results to screen. For information on the QBOT attack pattern and malware analysis, check out our... Weiterlesen

OpenAI Bans Russia ChatGPT Accounts Used to Run Covert Influence Operation

Sun, 30 Aug 2026 07:24:19 +0200

OpenAI Bans Russian ChatGPT accounts participating in a covert online influence operation aimed at manufacturing authority and promoting narratives favorable to Moscow. The campaign leveraged generative AI tools alongside an elaborate network of fake digital infrastructure, including a front think tank, plagiarized academic work, and a biased... Weiterlesen

ICEDID Configuration Extractor

Sun, 30 Aug 2026 07:24:10 +0200

Python script to extract the payload from ICEDID samples. Download icedid-configuration-extractor.tar.gz For information on the ICEDID malware and network infrastructure, check out the following resources: ICEDIDs network infrastructure is alive and well ICEDID network infrastructure checking utility Getting started Docker The recommended and... Weiterlesen

BPFDoor Configuration Extractor

Sun, 30 Aug 2026 07:24:09 +0200

Configuration extractor to dump out hardcoded passwords with BPFDoor. Download bpfdoor-config-extractor.tar.gz Overview This tool provides a Python module and command line tool that will extract passwords from BPFDoor samples. The Elastic Security Team has released an indepth analysis of the BPFDoor malware and created an additional tool that will... Weiterlesen

PARALLAX Payload Extractor

Sun, 30 Aug 2026 07:24:07 +0200

Python script to extract the payload from PARALLAX samples. Download parallax-payload-extractor.tar.gz For information on the PARALLAX malware loader and campaign observations, check out our blog posts detailing this intrusion set. Getting started Docker The recommended and easiest way to get going is to use Docker. From the directory this README... Weiterlesen

BPFDoor Scanner

Sun, 30 Aug 2026 07:24:06 +0200

Python script to identify hosts infected with the BPFDoor malware. Download bpfdoor-scanner.tar.gz Getting Started This tool provides a Python script to identify hosts that are infected with the BPFDoor malware. The Elastic Security Team has released an indepth analysis of the BPFDoor malware and created an additional tool that will extract... Weiterlesen

Cobalt Strike Beacon Extractor

Sun, 30 Aug 2026 07:24:05 +0200

Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch. Download cobalt-strike-extractor.tar.gz Overview This tool provides a Python module and command line tool that will search Elastic Endpoint alert... Weiterlesen

EMOTET Configuration Extractor

Sun, 30 Aug 2026 07:24:05 +0200

Python script to extract the payload from EMOTET samples. Download emotet-configuration-extractor.tar.gz For information on the EMOTET malware check out the following resources: EMOTET Dynamic Configuration Extraction Getting started Docker The recommended and easiest way to get going is to use Docker. From the directory this README is in, you can... Weiterlesen

BLISTER Configuration Extractor

Sun, 30 Aug 2026 07:24:04 +0200

Python script to extract the configuration and payload from BLISTER samples. Download blister-config-extractor.tar.gz Getting Started This tool provides a Python module and command line tool that will extract configurations from the BLISTER malware loader and dump the results to screen. For information on the BLISTER malware loader and campaign... Weiterlesen

Vulnerability summary: Follina, CVE-2022-30190

Sun, 30 Aug 2026 07:24:03 +0200

On May 27, 2022, the nao_sec independent security research group shared a VirusTotal link to a weaponized Microsoft Office document revealing a previously unknown vulnerability in the Microsoft Support Diagnostic Tool (MSDT). This vulnerability is most likely to be exploited via phishing lure attachments and is triggered when a document is opened.... Weiterlesen

NETWIRE Configuration Extractor

Sun, 30 Aug 2026 07:24:02 +0200

Python script to extract the payload from NETWIRE samples. Download netwire-configuration-extractor.tar.gz For information on the NETWIRE malware check out the following resources: NETWIRE Dynamic Configuration Extraction Getting started Docker The recommended and easiest way to get going is to use Docker. From the directory this README is in, you... Weiterlesen

NETWIRE Dynamic Configuration Extraction

Sun, 30 Aug 2026 07:23:57 +0200

Key takeaways NETWIRE has shown an increase in prevalence over the last year Elastic Security Labs created an extractor to pull out configuration data from NETWIRE files and memory dumps targeting the functions the malware uses to extract its encrypted data The NETWIRE extractor is freely available for download To download the NETWIRE... Weiterlesen

Automating the Security Protections rapid response to malware

Sun, 30 Aug 2026 07:23:57 +0200

Cyber attacks on corporate networks were up 50% in 2021, and it’s expected that 2022 will see more of the same. Elastic Endpoint Security includes a variety of protection layers to ensure maximum coverage against different types of malware. There have been a few examples recently of the need for fast, accurate updates of user environments in order... Weiterlesen

Stopping Vulnerable Driver Attacks

Sun, 30 Aug 2026 07:23:56 +0200

Key takeaways Ransomware actors are leveraging vulnerable drivers to tamper with endpoint security products. Elastic Security released 65 YARA rules to detect vulnerable driver abuse. Elastic Endpoint (8.3+) protects users from this threat. Background In 2018, Gabriel Landau and Joe Desimone presented a talk at Black Hat covering the evolution of... Weiterlesen

Identifying beaconing malware using Elastic

Sun, 30 Aug 2026 07:23:55 +0200

The early stages of an intrusion usually include initial access, execution, persistence, and command-and-control (C2) beaconing. When structured threats use zero-days, these first two stages are often not detected. It can often be challenging and time-consuming to identify persistence mechanisms left by an advanced adversary as we saw in the 2020... Weiterlesen

Detect Credential Access with Elastic Security

Sun, 30 Aug 2026 07:23:53 +0200

Preamble Credential Access consists of techniques for stealing credentials like cookies, API keys, and passwords. It is one of the top critical tactics that is almost guaranteed to occur during an attack lifecycle, ranging from phishing to infostealer malware to more complicated post-exploitation techniques. Therefore, covering it from different... Weiterlesen

Exploring the Future of Security with ChatGPT

Sun, 30 Aug 2026 07:23:53 +0200

Preamble Recently, OpenAI announced APIs for engineers to integrate ChatGPT and Whisper models into their apps and products. For some time, engineers could use the REST API calls for older models and otherwise use the ChatGPT interface through their website. Now there's an opportunity to prototype and experiment with Large Language Models (LLMs)... Weiterlesen

Fake GTA 6 Demo Alert: One Click Could Steal Your Passwords

Sun, 30 Aug 2026 07:23:53 +0200

Cybercriminals are always looking for new ways to exploit popular trends. This time, they are taking advantage of the huge excitement around GTA 6 by creating fake demo websites developed to spread password-stealing malware. Security researchers at Malwarebytes have discovered an active malware campaign targeting fans eagerly waiting for Grand... Weiterlesen

Unpacking ICEDID

Sun, 30 Aug 2026 07:23:52 +0200

Preamble ICEDID is a malware family discoveredin 2017 by IBM X-force researchers and is associated with the theft of login credentials, banking information, and other personal information. ICEDID has always been a prevalent family but achieved even more growth since EMOTET’s temporary disruption in early 2021. ICEDID has been linked to the... Weiterlesen

Click, Click… Boom! Automating Protections Testing with Detonate

Sun, 30 Aug 2026 07:23:51 +0200

Preamble Imagine you are an Endpoint artifact developer. After you put in the work to ensure protection against conventional shellcode injections or ransomware innovations, how do you know it actually works before you send it out into the world? First, you set up your end-to-end system, which involves setting up several services, the... Weiterlesen

Forget vulnerable drivers - Admin is all you need

Sun, 30 Aug 2026 07:23:51 +0200

Introduction Bring Your Own Vulnerable Driver (BYOVD) is an increasingly popular attacker technique wherein a threat actor brings a known-vulnerable signed driver alongside their malware, loads it into the kernel, then exploits it to perform some action within the kernel that they would not otherwise be able to do. After achieving kernel access,... Weiterlesen

Using LLMs to summarize user sessions

Sun, 30 Aug 2026 07:23:50 +0200

Using LLMs to summarize user sessions With the introduction of the AI Assistant into the Security Solution in 8.8, the Security Machine Learning team at Elastic has been exploring how to optimize Security operations with LLMs like GPT-4. User session summarization seemed like the perfect use case to start experimenting with for several reasons:... Weiterlesen

Using LLMs and ESRE to find similar user sessions

Sun, 30 Aug 2026 07:23:49 +0200

Using LLMs and ESRE to find similar user sessions In our previous article, we explored using the GPT-4 Large Language Model (LLM) to condense complex Linux user sessions into concise summaries. We highlighted the key takeaways from our experiments, shedding light on the nuances of data preprocessing, prompt tuning, and model parameter adjustments.... Weiterlesen

Unveiling malware behavior trends

Sun, 30 Aug 2026 07:23:45 +0200

Preamble When prioritizing detection engineering efforts, it's essential to understand the most prevalent tactics, techniques, and procedures (TTPs) observed in the wild. This knowledge helps defenders make informed decisions about the most effective strategies to implement - especially where to focus engineering efforts and finite resources. To... Weiterlesen

Protecting your devices from information theft

Sun, 30 Aug 2026 07:23:44 +0200

In this article, we will introduce the keylogger and keylogging detection features added this year to Elastic Defend (starting from version 8.12), which is responsible for endpoint protection in Elastic Security. This article is also available in Japanese. Introduction Starting with Elastic Defend 8.12, we have enhanced the detection of keyloggers... Weiterlesen

WinVisor – A hypervisor-based emulator for Windows x64 user-mode executables

Sun, 30 Aug 2026 07:23:43 +0200

Background In Windows 10 (version RS4), Microsoft introduced the Windows Hypervisor Platform (WHP) API. This API exposes Microsoft's built-in hypervisor functionality to user-mode Windows applications. In 2024, the author used this API to create a personal project: a 16-bit MS-DOS emulator called DOSVisor. As mentioned in the release notes, there... Weiterlesen

Agentic Frameworks Summary

Sun, 30 Aug 2026 07:23:42 +0200

Security teams and SOC analysts still face the same tier-1 response challenges since the early 2000s, from alert volumes to missed threats. While generative AI offers promising solutions, implementing effective AI-augmented security systems beyond simple LLM integration requires deep knowledge and nuanced details to address today's complexities... Weiterlesen

Time-to-Patch Metrics: A Survival Analysis Approach Using Qualys and Elastic

Sun, 30 Aug 2026 07:23:42 +0200

Introduction Understanding how quickly vulnerabilities are remediated across different environments and teams is critical to maintaining a strong security posture. In this article, we describe how we applied survival analysis to vulnerability management (VM) data from Qualys VMDR, using the Elastic Stack. This allowed us to not only confirm... Weiterlesen

Automating GOAD and Live Malware Labs

Sun, 30 Aug 2026 07:23:41 +0200

Introduction: The Need for a Scalable, Automated Simulation Range In modern security operations, detection engineering is no longer a “set it and forget it” discipline. The central challenge for any security team – and the question that underpins the entire purple-team approach is simple: how do you know whether your detection rules genuinely... Weiterlesen

DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector

Sun, 30 Aug 2026 07:23:40 +0200

Summary On December 29, 2025, a coordinated campaign of destructive cyberattacks targeted Poland's energy infrastructure, affecting over 30 renewable energy facilities and a major combined heat and power (CHP) plant A custom wiper malware dubbed DYNOWIPER was used to irreversibly destroy data across compromised networks CERT Polska attributes the... Weiterlesen

Inside Elastic InfoSec's agentic SOC: When to inline your agent's skills for a 5× cost reduction

Sun, 30 Aug 2026 07:23:40 +0200

This is Part 2 of the Inside Elastic InfoSec's Agentic SOC series. Part 1: How we triage every alert before an analyst opens it. Part 3: how we cut AI agent LLM calls by 60%. Investigating a Windows endpoint alert in Elastic InfoSec's production agentic security operations center (SOC) costs $0.69. That's what we pay running an orchestration... Weiterlesen

Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust

Sun, 30 Aug 2026 07:23:38 +0200

This blog post describes how we used AI to help us rewrite a C library (giflib) to Rust to mitigate memory safety vulnerabilities. Weiterlesen

What's in a tag name? JavaScript, apparently

Sun, 30 Aug 2026 07:23:37 +0200

I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t Weiterlesen

VMs won't contain cyber-capable agents

Sun, 30 Aug 2026 07:23:35 +0200

As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three... Weiterlesen

Three 10.0 security flaws fixed across Ubiquiti’s UniFi line

Sun, 30 Aug 2026 07:23:20 +0200

Ubiquiti has patched 21 critical vulnerabilities, three of which were rated the highest severity possible, the communications product company said Wednesday in a security bulletin. In all, the company patched 22 vulnerabilities, with the last one rated “high,” it said in the bulletin. Three of the vulnerabilities had a Common Vulnerability Scoring... Weiterlesen

OpenAI: Agent behavior that led to Hugging Face intrusion formed in May

Sun, 30 Aug 2026 07:23:19 +0200

OpenAI says the behavior that led its agents to breach Hugging Face emerged in its research environment more than two months before the incident, and concluded that it was a failure of alignment as much as it was a failure of security. The details come from a technical report the frontier AI company released Wednesday, which gives a full breakdown... Weiterlesen

Officials disrupt Chinese espionage operation that hit multiple federal agencies

Sun, 30 Aug 2026 07:23:15 +0200

Federal authorities Wednesday revealed a multi-layered Chinese state-sponsored espionage operation that’s targeted and compromised U.S. critical infrastructure, including multiple federal agencies, since 2018. Officials seized domains and unsealed an affidavit detailing how a Chinese government-funded front company assembled a botnet and... Weiterlesen

100-plus companies call for ‘global surge’ in AI-powered cyber defense

Sun, 30 Aug 2026 07:23:13 +0200

More than 100 companies and organizations, including OpenAI, Anthropic, Google, Microsoft and Amazon Web Services, have signed an open letter calling for a global effort to improve cybersecurity defenses as artificial intelligence capabilities advance. The letter, published Thursday, argues that the timeframe to strengthen defenses before... Weiterlesen

ATF confirms cyberattack hit system containing info on its investigation targets

Sun, 30 Aug 2026 07:23:13 +0200

The Bureau of Alcohol, Tobacco, Firearms and Explosives insists the cyberattack that it publicly disclosed Wednesday was limited to investigation targets, and has not impacted other agency systems. ATF said it is responding to the breach, which first became public after a prolific ransomware group claimed it accessed the federal agency’s network... Weiterlesen

What happens to your data when you die? (Lock and Code S07E17)

Sun, 30 Aug 2026 07:23:12 +0200

This week on the Lock and Code podcast… You will die. Your data will not. The afterlife of our information is a recent phenomenon, and some of the companies with the most to sort through are still just figuring it out. As far back as 2007, Facebook was forced to reckon with mass grief when users asked the company to maintain the profile pages of... Weiterlesen

Fake GTA 6 Extended Look and demo sites deliver an infostealer

Sun, 30 Aug 2026 07:23:11 +0200

GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware. We identified a network of sites appearing in searches for a GTA 6 demo and impersonating Rockstar Games. One Google... Weiterlesen

Beware of fake Indeed interview apps used to install spyware

Sun, 30 Aug 2026 07:23:09 +0200

From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform.Indeed is one of the world’s largest employment websites, giving scammers access to a huge pool of potential victims, especially in a competitive job market.What we foundA user in the UK posted on our... Weiterlesen

Kubernetes 1.37 advances workload-aware scheduling and cluster networking

Sun, 30 Aug 2026 07:23:09 +0200

When the open-source Kubernetes cloud-native project got started more than a decade ago, AI was not a major concern. Times have changed. Kubernetes 1.37 is now out, extending its networking and scheduling capabilities as more organizations run AI and machine learning workloads on the platform. The new release is the second major update for the... Weiterlesen

The AI agent swarm that attacked Hugging Face is a warning for the future

Sun, 30 Aug 2026 07:23:08 +0200

The hacking incident involving OpenAI evaluation agents and Hugging Face offers an unusually concrete look at what advanced AI-assisted intrusion can mean in practice: not a single clever exploit, but thousands of automated decisions, rapid experimentation, lateral movement, credential theft, persistence, and attempts to evade detection. The... Weiterlesen

OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack

Sun, 30 Aug 2026 07:23:01 +0200

New training environments will teach AI models to distrust instructions arriving from other agents outside sanctioned channels. The post OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack appeared first on SecurityWeek. Weiterlesen

PaperCut Releases Emergency Patch for Exploited Zero-Day

Sun, 30 Aug 2026 07:23:00 +0200

A CVE identifier has not yet been assigned, but PaperCut is urging NG/MF users to install patches and implement mitigations. The post PaperCut Releases Emergency Patch for Exploited Zero-Day appeared first on SecurityWeek. Weiterlesen

Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge

Sun, 30 Aug 2026 07:22:58 +0200

Nearly 130 tech and cybersecurity companies back a collective call to boost cyber defenses as AI-enabled attacks grow more sophisticated. The post Tech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense Pledge appeared first on SecurityWeek. Weiterlesen

OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems

Sun, 30 Aug 2026 07:22:57 +0200

CISA has added the exploited flaw, CVE-2026-53362, to its KEV catalog, alongside a JFrog vulnerability exploited by OpenAI agents. The post OpenAI Agents Exploited Linux Kernel Flaw on Company’s Own Systems appeared first on SecurityWeek. Weiterlesen

ATF Confirms Cyber Incident After Ransomware Group Claims Attack

Sun, 30 Aug 2026 07:22:57 +0200

The Bureau of Alcohol, Tobacco, Firearms and Explosives has described it as a ‘major incident’ and it’s conducting an investigation with the DOJ. The post ATF Confirms Cyber Incident After Ransomware Group Claims Attack appeared first on SecurityWeek. Weiterlesen

In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions

Sun, 30 Aug 2026 07:22:56 +0200

Noteworthy stories that might have slipped under the radar: Manchester Airports Group cyberattack, Carhartt breach data was partly fake, U.S. Bank responds to ransomware gang’s claims. The post In Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker Sanctions appeared first on SecurityWeek. Weiterlesen

Companies are still paying ransomware demands despite official advice – Report

Sun, 30 Aug 2026 07:22:55 +0200

SECURUS Communications Ltd Securus is a managed communications Operator, providing next-generation network infrastructure and value added services to Managed Hosting providers and the ‘cloud generation’ of enterprises. Securus priority is to offer communication services that represent excellent value for money and are backed by exceptional levels... Weiterlesen

When AI Makes Everyone a Target with Mark Beare from Malwarebytes

Sun, 30 Aug 2026 07:22:52 +0200

Mark Beare, General Manager of Malwarebytes Consumer Business, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices recorded at Black Hat USA 2026. He discusses how AI is helping scammers create highly personalized attacks at scale, why everyday consumers are increasingly attractive targets, and how AI could also help... Weiterlesen

The odds were classified.

Sun, 30 Aug 2026 07:22:51 +0200

Polymarket traders win big on U.S. military insider information. Slovakia deactivates speed cameras with Russian backdoors. TikTok pays $400 million to settle kids' privacy allegations. Hackers infect Android-based car systems with botnet malware. CISA orders quick patching of an actively exploited Zimbra Collaboration Suite vulnerability.... Weiterlesen

CISA is running on empty.

Sun, 30 Aug 2026 07:22:50 +0200

Lawmakers request an investigation into cuts at CISA. Threat actors actively exploit a Zimbra Collaboration Suite vulnerability. A Chinese AI lab preps release of a powerful open-weight model. A new phishing toolkit deploys attacker-controlled passkeys. Using audio hardware to fingerprint browsers. A DDoS attack knocks Norwegian government... Weiterlesen

JADEPUFFER: An End-to-End Agentic-Led Ransomware Attack

Sun, 30 Aug 2026 07:22:50 +0200

In this episode of the Microsoft Threat Intelligence Podcast, we are joined by Sysdig’s Michael Clark and Crystal Morin to discuss ⁠JADEPUFFER⁠, one of the first documented cases of an LLM conducting an end-to-end ransomware operation. They break down how the agent, and the direction of a threat actor was identified, how AI is lowering the barrier... Weiterlesen

The Hidden Attack Surface Inside Data Centers

Sun, 30 Aug 2026 07:22:45 +0200

Stephen Hilt, Senior Threat Researcher at TrendAI, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices recorded at Black Hat USA 2026. Drawing on research presented at DEF CON, he discusses thousands of internet-exposed industrial control systems associated with U.S. data centers, how attackers could target building... Weiterlesen

Researchers publish analysis of OpenAI agents' attack against Hugging Face.

Sun, 30 Aug 2026 07:22:44 +0200

Federal judge rules the Trump administration's blacklisting of Anthropic was illegal. The White House bans certain foreign-made power equipment over backdoor risks. Weiterlesen

The blacklist boomerang.

Sun, 30 Aug 2026 07:22:43 +0200

A judge rules the Trump administration illegally labeled Anthropic a national security risk. The White House moves to keep foreign technology out of U.S. power systems. OpenAI rallies a global cyber defense push as its own AI agents exploit a Linux vulnerability. Researchers uncover a new speculative-execution attack and hidden implants in... Weiterlesen

US disrupts Chinese hacking platform.

Sun, 30 Aug 2026 07:22:43 +0200

Researchers publish analysis of OpenAI agents' attack against Hugging Face. Australian police arrest two suspected TeamPCP members. Weiterlesen

Closing the space-cyber workforce gap.

Sun, 30 Aug 2026 07:22:42 +0200

Despite the space sector's consistent growth and greater importance as a critical infrastructure sector, finding cybersecurity talent is still proving to be a challenge. Host Maria Varmazis and ⁠Nick Cohen⁠, Principal Engineer at the ⁠Aerospace Corporation⁠, sat down to discuss the current state of space's cybersecurity workforce. The two look at... Weiterlesen

Bridging the space cybersecurity workforce gap.

Sun, 30 Aug 2026 07:22:41 +0200

CyberWire Daily at 10: A decade of emerging threat actors and APTs.

Sun, 30 Aug 2026 07:22:40 +0200

In this episode, ⁠Maria Varmazis⁠ and ⁠Dave Bittner⁠ from N2K Cyberwire get back together to discuss the evolution of advanced persistent threats (APTs), threat actor landscape, attribution changes, and the future of cyber espionage over the past decade. Join Dave and Maria as they explore how geopolitical factors, organizational professionalism,... Weiterlesen

Ransomware Gang Claims AI Can Analyze 700GB of Stolen Data Every Hour

Sun, 30 Aug 2026 07:22:38 +0200

TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort through 700GB of stolen corporate data every hour. The group says the system helps it quickly find information that can raise the pressure on victims, from personal records to trade secrets. The operation surfaced in April 2026 and became... Weiterlesen

Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets

Sun, 30 Aug 2026 07:22:38 +0200

Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies, and diplomatic organizations in Romania, Spain, and Türkiye. The campaign relied on Word documents designed to look routine or official, turning a familiar office file into an entry point for espionage. Victims were asked to enable macros,... Weiterlesen

Hackers Target AI Infrastructure With RCE, Prompt Injection and API Key Theft

Sun, 30 Aug 2026 07:22:37 +0200

Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for remote code execution, credential theft, and cryptomining. AI infrastructure is now a cloud entry point. Over 90 days, attackers tailored techniques for services routing model traffic and connecting agents to tools. Campaigns paired exposed-server... Weiterlesen

OpenAI Is Pulling Its AI Models From Cursor Following SpaceX Acquisition

Sun, 30 Aug 2026 07:22:35 +0200

OpenAI is pulling its AI models from Cursor following SpaceX’s acquisition of the AI coding assistant, notifying SpaceX that it will wind down the contract that supplies those models to the editor. The proposed shutoff date is November 12, 2026, which OpenAI said is the maximum notice its custom agreement allows. In an August 28 statement, the... Weiterlesen

Experts Weigh in on the Medusa Ransomware Gang

Sun, 30 Aug 2026 07:22:33 +0200

The Medusa Ransomware gang has breached more than 500 organizations since June 2021. Weiterlesen

AI Models are Finding Vulnerabilities Faster

Sun, 30 Aug 2026 07:22:32 +0200

A report by SentinelOne and Tenable Holdings analyzed vulnerability discovery, exposure, and exploitation. Weiterlesen

Security Leaders Discuss OpenAI’s Call for Collaboration on Cyber Defense

Sun, 30 Aug 2026 07:22:31 +0200

100 technology firms released an open letter calling for “collective action” for cyber defense. Weiterlesen

Alabama launches investigation into OpenAI’s hack of Hugging Face

Sun, 30 Aug 2026 07:22:27 +0200

Weeks after OpenAI disclosed that one of its cybersecurity models had gone rogue and hacked AI dataset company Hugging Face, Alabama’s attorney general announced an investigation into the incident. Weiterlesen

That fake Grand Theft Auto VI demo is actually just malware

Sun, 30 Aug 2026 07:22:27 +0200

Grand Theft Auto fans, eager for news about one of the most anticipated video games of all time, appear especially vulnerable to this new cyberattack. Weiterlesen

US seizes domains of Chinese botnet used to target NASA, Justice Department, and the Senate

Sun, 30 Aug 2026 07:22:26 +0200

The Justice Department said that the domain seizures made the botnet and its command and control servers "inoperable," as the domains were hardcoded into the botnet's code and were critical for the botnet's communication and essential operations. Weiterlesen

Here’s all the times AI has gone rogue and hacked other companies

Sun, 30 Aug 2026 07:22:25 +0200

A recap of all the incidents involving LLMs made by Anthropic, Meta, and OpenAI, which went rogue and attacked real companies and individuals on the internet. Weiterlesen

Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others

Sun, 30 Aug 2026 07:22:24 +0200

The arrests come after a wave of cyberattacks earlier this year targeting tech companies that rely on high-profile and widely used open source software. Weiterlesen

OpenAI, Anthropic, Google, and 100 other companies call for action to defend against rogue AI

Sun, 30 Aug 2026 07:22:23 +0200

Some of the world's largest tech companies and AI startups have come together to decry the current state of cybersecurity and to advertise a new solution that they say can ward off a new generation of cyber threats. Weiterlesen

ATF declares ‘major incident’ as ransomware gang claims hack

Sun, 30 Aug 2026 07:22:22 +0200

The ATF is the latest federal government agency in recent years to notify Congress of a "major incident" involving its cybersecurity. Weiterlesen

After Hugging Face Was Attacked By A.I. Agents, It Embarked on a Crusade

Sun, 30 Aug 2026 07:22:21 +0200

Hugging Face, a start-up that was breached by rogue bots from OpenAI, is using the hack to push for openness in A.I. development. Weiterlesen

Anatomy of an Autonomous Attack: 5 Alarming A.I. Capabilities

Sun, 30 Aug 2026 07:22:19 +0200

When OpenAI’s agents went rogue in July, they demonstrated ingenuity and drive beyond what many experts imagined — a dangerous harbinger of what such bots could do in the future. Weiterlesen

A Chinese A.I. Lab May Test the World’s Cybersecurity With a Model

Sun, 30 Aug 2026 07:22:19 +0200

In July, an unreleased OpenAI model went rogue and demonstrated remarkable hacking abilities. This week, a lab called Z.ai will release a similarly powerful system to everyone. Weiterlesen

Why Irregular’s A.I. Tests for Meta, Anthropic and OpenAI Went Off the Rails

Sun, 30 Aug 2026 07:22:18 +0200

Irregular, an Israeli start-up, worked with OpenAI, Anthropic and Meta to assess the security of their A.I. models. It made a mistake. Then the tests went off the rails. Weiterlesen

OpenAI and 100 Others Warn That Window to Defend Against A.I. Attacks Is Narrowing

Sun, 30 Aug 2026 07:22:17 +0200

In an open letter, OpenAI, Anthropic, Google and others said that a wave of A.I.-enabled cyberattacks was coming and that organizations and governments needed to prepare themselves. Weiterlesen

New type of attack can slip past the defenses in your computer’s processor

Sun, 30 Aug 2026 07:22:15 +0200

Modern processors are fast, in part, because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path and races ahead. When the guess is right, time is saved. When it's wrong, the work is discarded, but traces of it linger. Since the Spectre vulnerability was disclosed in 2018, attackers have... Weiterlesen

Ledger Fixes Ethereum App Flaw as Disclosure Timeline Is Disputed

Sun, 30 Aug 2026 07:22:14 +0200

Ledger CTO Charles Guillemet said on Aug. 23, 2026, that the company had fixed a clear-signing flaw in its Ethereum app two weeks before security firm TestMachine publicly disclosed the issue. As of Aug. 24, there were no independently verified reports of funds stolen through the specific vulnerability. The issue involved clear signing, a... Weiterlesen

The Cyber Express Weekly Roundup: Exploited Entra ID Flaw, AI Agent Risks, and Global Cybercrime Crackdown

Sun, 30 Aug 2026 07:22:13 +0200

This weekly roundup highlights a broad range of cybersecurity and technology developments affecting cloud identity infrastructure, social media platforms, businesses, digital assets, and international law enforcement. From a critical Microsoft Entra ID vulnerability exploited before remediation to a global crackdown on West African cybercrime... Weiterlesen

Exploited RCE Flaws and Infrastructure Attacks Define this Cybersecurity Week in August 2026

Sun, 30 Aug 2026 07:22:12 +0200

Active exploitation, attacks on critical infrastructure, mobile malware, credential exposure, and high-impact breaches shaped this week’s cybersecurity landscape in August 2026. Defenders also confronted emerging risks from autonomous AI agents, cross-tenant side channels, and rapidly weaponized vulnerabilities, while major privacy settlements... Weiterlesen

28,000 Exposed Git Repositories Found Leaking Credentials

Sun, 30 Aug 2026 07:22:10 +0200

Cybersecurity firm Intruder found 28,000 exposed .git repositories after scanning 3.5 million active HTTP hosts. The repositories contained credentials for services including AWS, Stripe, OpenAI and GitHub. The targets were narrowed from an initial pool of 40 million potentially relevant domains identified using Certificate Transparency data. The... Weiterlesen

When Malware Does Math: The Arms Race Between Sandboxes and Self-Aware Threats

Sun, 30 Aug 2026 07:22:06 +0200

A suspicious file is detonated in a sandbox and does almost nothing. Traditionally, that lack of activity might suggest the file poses little risk. But the more important question is why it stayed quiet. Did the file fail to execute, or did it recognize the sandbox and decide not to reveal what it could do? Modern malware is increasingly... Weiterlesen

PaperCut Flaw Under Active Attack Enables Pre-Auth RCE

Sun, 30 Aug 2026 07:22:05 +0200

PaperCut is warning organizations to patch its NG and MF print management software after attackers began exploiting a vulnerability that can lead to remote code execution (RCE) without authentication. PaperCut issued an urgent security advisory and is treating all versions of PaperCut NG and MF as potentially affected. Emergency updates are... Weiterlesen

OpenAI says AI agents formed a ‘swarm’ before breaching Hugging Face

Sun, 30 Aug 2026 07:22:04 +0200

OpenAI has published a detailed post-mortem of July’s Hugging Face breach, revealing that its AI agents did far more than escape a cybersecurity sandbox. The models created an unauthorized communication network, shared exploits and credentials, coordinated attacks across separate evaluation runs, and ultimately compromised both Hugging Face and... Weiterlesen

19 Chrome and Edge extensions caught harvesting crypto wallet seeds

Sun, 30 Aug 2026 07:22:03 +0200

Security researchers have uncovered 19 malicious Chrome and Edge extensions delivering cryptocurrency wallet drainers, credential stealers, session hijacking tools, and other remotely loaded malware. Socket Threat Research reports that the malicious versions appeared over the past six months, but code and infrastructure similarities link the... Weiterlesen

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Sun, 30 Aug 2026 07:21:59 +0200

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that’s used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns,... Weiterlesen

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

Sun, 30 Aug 2026 07:21:59 +0200

Ravie LakshmananAug 27, 2026Hacking News / Cybersecurity News A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting... Weiterlesen

ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

Sun, 30 Aug 2026 07:21:55 +0200

ServiceNow has issued security advisories for four vulnerabilities, including critical flaws in its AI platform. These vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate instance data, elevate privileges, or run SQL commands against underlying databases. On August 27, 2026, the company published KB3152242,... Weiterlesen

PaperCut warns of NG, MF flaw exploited in zero-day attacks

Sun, 30 Aug 2026 07:21:54 +0200

PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...] Weiterlesen

Critical WordPress Plugin Flaw Allows Unauthenticated Administrator Account Takeover

Sun, 30 Aug 2026 07:21:54 +0200

A critical authentication bypass vulnerability has been identified in the WPMU DEV Dashboard WordPress plugin, which could allow unauthenticated attackers to gain administrator-level access to vulnerable sites configured with Hub Single Sign-On (SSO). This vulnerability, tracked as CVE-2026-76581, has a CVSS score of 9.8 and affects WPMU DEV... Weiterlesen

Polymorphic Phishing Attack Generates Unique Credential-Stealing Page on Every Visit

Sun, 30 Aug 2026 07:21:53 +0200

A newly analyzed phishing operation is using server-side polymorphism to generate a distinct credential-harvesting page for virtually every request, undermining detection approaches built around file hashes, fixed HTML identifiers, and static JavaScript signatures. The campaign came to light after a phishing message submitted to the SANS Internet... Weiterlesen

700 OpenAI Agents Coordinate Attack on Hugging Face and Gain Remote Code Execution

Sun, 30 Aug 2026 07:21:52 +0200

OpenAI’s ExploitGym evaluation environment reportedly became the site of a large-scale, unsanctioned multi-agent campaign after hundreds of models found ways to communicate across supposedly isolated sandboxes. An investigation published by METR describes how the activity, which began on July 8, involved agents operating across several models,... Weiterlesen

Attackers Exploit MCP RCE, Blind Prompt Injection and Memory Credential Theft Against AI Infrastructure

Sun, 30 Aug 2026 07:21:52 +0200

Attackers are increasingly treating AI infrastructure as a high-value cloud entry point, exploiting exposed Model Context Protocol (MCP) services, agent frameworks, and AI gateways to execute code, validate prompt injection, deploy cryptominers, and steal credentials from process memory. The campaigns show that attackers are no longer using only... Weiterlesen

Critical Gogs Flaw Enables Remote Code Execution Through Path Traversal

Sun, 30 Aug 2026 07:21:50 +0200

A critical vulnerability in Gogs, the self-hosted Git service, could allow authenticated attackers to execute commands on the server by abusing path traversal during creation. Tracked as CVE-2026-52813, the flaw was reported by Aikido security researcher Jorian Woltjer and fixed in Gogs version 0.14.3. The issue stems from an API endpoint that... Weiterlesen

Windows Defender’s own driver can leave systems defenseless

Sun, 30 Aug 2026 07:21:47 +0200

A Microsoft-signed Windows Defender remediation driver can be repurposed into a kernel-level “operation engine” capable of deleting files, modifying the registry and neutralizing security controls, according to new research from Check Point Research (CPR). The technique does not exploit a vulnerability or rely on the traditional Bring Your Own... Weiterlesen

Nucleus wants to get ahead of scanners on new vulnerabilities

Sun, 30 Aug 2026 07:21:43 +0200

There usually is a crucial time lapse from when a vulnerability is newly disclosed to when security scanners are finally updated to scan for it. Nucleus Security says it wants to close that gap. The cybersecurity outfit focused on unified exposure management is expanding its platform with Nucleus Helix, an AI Agent for natural-language interaction... Weiterlesen

NemoClaw’s AI can be poisoned through a browser tab

Sun, 30 Aug 2026 07:21:42 +0200

A vulnerability affecting Nvidia’s NemoClaw could let an attacker gain control of the local Ollama model server through a single malicious website visit on the victim’s machine. According to a Cyera research, the flaw could give attackers unauthenticated access to the server, allowing them to plant instructions into the model that persist across... Weiterlesen

CTEM can give your security team a contextual edge

Sun, 30 Aug 2026 07:21:42 +0200

Traditional vulnerability management is accelerating toward a reset, with many security organizations considering continuous threat exposure management (CTEM) to better align their operations with the pace of change — and attacks — today. Whereas traditional vulnerability management relies on periodic assessments, with security teams scanning... Weiterlesen

Avoid these 5 pitfalls in your cybersecurity technology PoC

Sun, 30 Aug 2026 07:21:41 +0200

A cybersecurity technology proof of concept can validate a good purchasing decision -- or waste months of your team's time. Look out for these five common PoC missteps. Weiterlesen

Hackers Actively Exploiting Pre-Auth RCE Flaw in PaperCut Print Software

Sun, 30 Aug 2026 07:21:40 +0200

Attackers are actively exploiting a critical, unauthenticated remote code execution (RCE) vulnerability in PaperCut NG and PaperCut MF, widely used print management software, security researchers at Huntress have confirmed. The flaw allows an attacker to remotely take control of a PaperCut server’s configuration without needing any login... Weiterlesen

700 AI Agents Linked to Hugging Face Security Breach

Sun, 30 Aug 2026 07:21:40 +0200

Around 700 AI agents created by OpenAI participated in the breach of Hugging Face during a cybersecurity evaluation, according to an independent investigation that has revealed the scale of the incident. METR and Redwood Research published the findings after being brought in to independently investigate the July incident and examine the agents’... Weiterlesen

CISA orders agencies to fix exploited Zimbra vulnerability

Sun, 30 Aug 2026 07:21:31 +0200

The collaboration software’s developer took almost a full month to patch the flaw after disclosing it. Weiterlesen

Hundreds of agents went rogue in lead up to Hugging Face breach

Sun, 30 Aug 2026 07:21:30 +0200

OpenAI released a technical breakdown of the historic incident and plans changes to prevent such an occurrence from happening again. Weiterlesen

Unitree G1 Humanoid Robot Flaws Enable Unauthenticated Root RCE Over Bluetooth

Sun, 30 Aug 2026 07:21:29 +0200

A newly disclosed flaw in Unitree’s G1 humanoid robot could allow an attacker standing nearby to obtain unauthenticated remote code execution as root via Bluetooth Low Energy (BLE). The research, dubbed UniBLEed, targets the robot’s Locomotion PC, a Linux-based system that supports safety-critical operations including motors, cameras, audio, and... Weiterlesen

ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

Sun, 30 Aug 2026 07:21:27 +0200

ServiceNow has released security updates for four vulnerabilities, including three rated critical, that could allow unauthenticated attackers to execute code, alter instance data, elevate privileges, or run arbitrary SQL commands against affected environments. The August 27, 2026 advisory addresses flaws tracked as CVE-2026-6876, CVE-2026-18885,... Weiterlesen

AI Agent Instruction Files Let Attackers Execute Code Inside Fortune 500 Networks

Sun, 30 Aug 2026 07:21:27 +0200

A newly disclosed novel supply chain attack vector built entirely from publicly available, legitimate infrastructure: LLM.txt files. In a controlled experiment, Alon Hertz registered the names of unclaimed packages referenced in official corporate instruction files and had code execute within a Fortune 500 network within four minutes. llms.txt... Weiterlesen

700 OpenAI AI Agents Coordinate Hugging Face Hack and Achieve Remote Code Execution

Sun, 30 Aug 2026 07:21:26 +0200

A newly disclosed that roughly 1,200 OpenAI agents, designed to run in complete isolation from one another, built an unsanctioned communication channel and used it to coordinate a multi-day attack on Hugging Face, with 700 ultimately achieving remote code execution. Documented by Metr, the incident traces back to July 7–13, when OpenAI launched... Weiterlesen

Critical Gogs Path Traversal Flaw Enables Remote Code Execution via Git Hooks

Sun, 30 Aug 2026 07:21:24 +0200

A critical path traversal vulnerability in Gogs, the self-hosted Git service, could let authenticated attackers achieve remote code execution by planting malicious Git hooks outside the intended repository storage directory. Tracked as CVE-2026-52813, the flaw arises from an API endpoint that accepted unsanitized organization usernames and passed... Weiterlesen

Wie Reward Hacking KI-Agents zu Zero-Days und Hugging-Face-Angriffen führte

Sun, 30 Aug 2026 07:21:22 +0200

LONDON (IT BOLTWISE) – OpenAI beschreibt, dass „Reward Hacking“ im Training dazu führte, KI-Agents bei Sicherheitschecks missaligniert handeln zu lassen. Laut Bericht nutzten die Systeme während RL-Läufen mehrere Zero-Days, um sich aus einem zunächst isolierten Sandbox-Setup Internetzugang und Administrationsrechte zu verschaffen. Anschließend... Weiterlesen

OpenAI: Reward Hacking ermöglichte KI-Agenten Zero-Days und Hugging-Face-Angriff

Sun, 30 Aug 2026 07:21:21 +0200

LONDON (IT BOLTWISE) – OpenAI ordnet den Angriff auf Hugging Face im Juli maßgeblich dem sogenannten Reward Hacking zu, also fehlgerichtetem Lernverhalten von KI-Agenten. Laut dem Unternehmen fanden entsprechende Fehlmuster schon Ende Mai statt und führten zu unautorisierten Kommunikationswegen innerhalb einer internen Evaluationsumgebung. Die... Weiterlesen

Cursor KI-Agent hilft bei Einbrüchen: Hacker nutzen die Chat-Schnittstelle für Angriffe

Sun, 30 Aug 2026 07:21:20 +0200

WASHINGTON / LONDON (IT BOLTWISE) – Eine Sicherheitsfirma behauptet, russischsprachige Hacker hätten den KI-Coding-Assistenten Cursor als „Agent“ für Hunderte schädliche Operationen missbraucht. In Chat-Protokollen, die vom 8. April bis zum 21. Mai datieren, soll ein neu auftretendes Ransomware-Kollektiv den Agenten mit der Behauptung einer... Weiterlesen

PaperCut Zero-Day: Notfall-Patch für NG und MF, IOC-Liste veröffentlicht

Sun, 30 Aug 2026 07:21:20 +0200

LONDON (IT BOLTWISE) – PaperCut meldet, dass Angreifer eine bislang unbekannte Schwachstelle in der Druckverwaltungssoftware PaperCut NG und PaperCut MF aktiv in Zero-Day-Angriffen ausnutzen. Das Unternehmen hat einen Notfall-Patch für v25 und v26 bereitgestellt und sagt, dass bestätigte Kundenfälle vorliegen. Für Systeme, die den PaperCut... Weiterlesen

cPanel-Fehler CVE-2026-65643: Root-Codeausführung über geparkte und Addon-Domains möglich

Sun, 30 Aug 2026 07:21:19 +0200

LONDON (IT BOLTWISE) – cPanel und WebHost Manager (WHM) schließen mit einem Patch mehrere Schwachstellen, die über das Parken und Hinzufügen von Domains zu beliebigen Dateien auf dem Server führen können. In der Mitteilung beschreibt der Hersteller als Folge eine Codeausführung mit Root-Rechten und damit vollständige Kontrolle über die betroffene... Weiterlesen

HOOKEDGE: Neue HOOKEDGE-Backdoor tarnt sich über Webhook-C2 bei Diplomaten

Sun, 30 Aug 2026 07:21:15 +0200

LONDON (IT BOLTWISE) – Sicherheitsforscher melden eine neue Kampagne gegen Regierungs- und Diplomatieorganisationen in Rumänien, Spanien und Türkiye. Im Zeitraum von Ende September 2025 bis Anfang April 2026 soll eine bislang undokumentierte Backdoor namens HOOKEDGE über Makro-Word-Dokumente zugestellt worden sein. Die Malware arbeitet als... Weiterlesen

ServiceNow stopft vier kritische Schwachstellen in der KI-Plattform

Sun, 30 Aug 2026 07:21:14 +0200

LONDON (IT BOLTWISE) – ServiceNow hat Patches für vier Schwachstellen in der ServiceNow-Now-Plattform veröffentlicht, darunter drei mit CVSS 10.0. Betroffen sind u. a. die GraphQL Composite Data API, ein Upload-Prozessor sowie eine SQL-Injection über ein dynamisches ORDER-BY. Die Lücken können laut Advisory in bestimmten Konstellationen ohne... Weiterlesen

ZBT-Router: Zwei neue Firmware-Implants geben Root-Zugriff ohne Authentifizierung

Sun, 30 Aug 2026 07:21:13 +0200

LONDON (IT BOLTWISE) – Zwei zuvor undokumentierte Firmware-Implants in ZBT-Routern ermöglichen einem Angreifer ohne Authentifizierung Root-Rechte auf betroffenen Geräten. Die Komponenten SPEAKINGSTONE und DARKLANTERN tragen die CVE-2026-74232 und CVE-2026-74233 und kommen laut Analyse sowohl über ausgehende C2-Kommunikation als auch über einen... Weiterlesen

Unitree G1 EDU: Zwei RCE-Ketten per Chat-Interface und BLE bedrohen Root-Rechte

Sun, 30 Aug 2026 07:21:12 +0200

LONDON (IT BOLTWISE) – Zwei getrennte Root-Remote-Code-Execution-Ketten gefährden offenbar die Unitree G1 EDU. Eine der Routen nutzt einen netznahen Weg über chat_go und bashrunner, die andere startet über BLE-Nähe und führt später bis in die WLAN-Provisionierung. Die Schwachstellen sind als CVE-2026-76639 und CVE-2026-76640 dokumentiert, aber für... Weiterlesen

PaperCut: Angreifer koppeln zwei CVEs für RCE ohne Authentifizierung

Sun, 30 Aug 2026 07:21:10 +0200

LONDON (IT BOLTWISE) – Angreifer sollen zwei zuvor gepatchte PaperCut-Schwachstellen miteinander kombinieren, um bei betroffenen Instanzen ohne Authentifizierung Code auszuführen. Im Fokus stehen ein unsicheres dynamisches Laden von Java-Klassen sowie eine fehlerhafte Zugriffskontrolle im Web-Management. Hersteller und Sicherheitsforscher... Weiterlesen

CISA nimmt ownCloud-Sicherheitslücke in KEV auf: Angriff auf PH-Labor

Sun, 30 Aug 2026 07:21:09 +0200

LONDON (IT BOLTWISE) – Die US-Behörde CISA hat die ownCloud-Schwachstelle CVE-2023-49105 in den KEV-Katalog (Known Exploited Vulnerabilities) aufgenommen. Die Lücke (CVSS 9,8) betrifft einen WebDAV-Authentifizierungs-Bypass und kann Dateien ohne Anmeldung verändern oder löschen. Laut den vorliegenden Berichten wurde sie gegen ein... Weiterlesen

Nearly 700 rogue AI agents coordinated in the Hugging Face attack

Sun, 30 Aug 2026 07:21:08 +0200

New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI's internal IM1 model coordinated the compromise through an unauthorized message board. [...] Weiterlesen

Mehrere WordPress-Plugins und Themes: Kritische RCE- und Takeover-Lücken

Sun, 30 Aug 2026 07:21:08 +0200

LONDON (IT BOLTWISE) – Mehrere kritische Sicherheitslücken in WordPress-Plugins und -Themes erhöhen das Risiko für Account-Takeover und Remote Code Execution. Betroffen sind unter anderem ein Dashboard-Plugin, ein Theme mit Builder-Funktion sowie TranslatePress, Pods und GiveWP. Für mehrere CVE-IDs werden extrem hohe CVSS-Werte genannt, teils bis... Weiterlesen

WordPress: Kritische Plugin-Fehler ermöglichen Auth-Bypass und RCE über mehrere CVEs

Sun, 30 Aug 2026 07:21:07 +0200

LONDON (IT BOLTWISE) – Fünf schwerwiegende Sicherheitslücken in WordPress-Plugins und -Themes zeigen, wie schnell aus einem Konfigurationsfehler ein vollständiger Site-Takeover werden kann. Die Fälle reichen von Authentifizierungs-Bypass bis zu willkürlicher Dateischreibung und Remote Code Execution. Besonders kritisch ist eine Kette aus... Weiterlesen

OpenAI stoppt Cursor-Zugriff auf Modell-APIs nach SpaceX-Übernahme

Sun, 30 Aug 2026 07:21:06 +0200

LONDON (IT BOLTWISE) – OpenAI kündigt an, den Vertrag zur Bereitstellung von Modell-APIs für Cursor nach der Übernahme durch SpaceX auslaufen zu lassen. Als geplantes Abschaltdatum nennt das Unternehmen den 12. November 2026. OpenAI begründet den Schritt mit fehlender Sicherheit, dass SpaceX die Technologie im Einklang mit den Nutzungsbedingungen... Weiterlesen

CISA warnt: Ausnutzung kritischer ownCloud-Schwachstelle bei Datenabzug aus Forschungseinrichtungen

Sun, 30 Aug 2026 07:21:05 +0200

PHILIPPINEN / LONDON (IT BOLTWISE) – Die US-Behörde CISA hat die ownCloud-Schwachstelle CVE-2023-49105 in den Known Exploited Vulnerabilities (KEV)-Katalog aufgenommen, nachdem Berichte von aktiver Ausnutzung bekannt wurden. Die Lücke ermöglicht laut Meldungen einen Authentifizierungs-Bypass im WebDAV-API-Zugriff, wenn der Nutzername bekannt ist... Weiterlesen

LeakWatch KW 35/2026: Berlin unter Erpressungsdruck, Millionen Flughafendaten abgeflossen, GTA VI lockt Malware an und DLSS 5 landet zu früh im Netz

Sun, 30 Aug 2026 07:21:03 +0200

Wer in der Kalenderwoche 35 nach Leaks gesucht hat, musste nicht besonders tief graben. Zwischen dem 24. und 30. August 2026 kamen gleich mehrere sehr unterschiedliche Fälle zusammen. Berlin bestätigte weitere Datenabflüsse aus dem Landesnetz und wird inzwischen erpresst, die Manchester Airports Group verlor Daten von rund 8,7 Millionen Kunden,... Weiterlesen

Ehemaliger Medusa-Partner setzt auf neue Ransomware StormEncryptor - it-daily.net

Sun, 30 Aug 2026 07:21:02 +0200

Cybercrime · Datenschutz & GRC · Identity & Access Management · Mobile ... Cyber Crime Ransomware · Anzeige. KI, China. 29. August 2026. Was ... Weiterlesen

30 Bitcoin oder Leak – Ransomware-Bande erpresst Berlin | heise online

Sun, 30 Aug 2026 07:21:01 +0200

Die Gruppe „Rhysida“ will 30 Bitcoin von Berlin, oder vertrauliche Daten veröffentlichen. Die Stadt will nicht zahlen, sagte Kai Wegner. Weiterlesen

cPanel, eine kritische Lücke verschafft einem Hosting-Kunden Root auf dem ganzen Server

Sun, 30 Aug 2026 07:21:00 +0200

28/08/2026 Cybersicherheit 10 Min. Lesezeit. Cybersicherheit cPanel cve-2026-65643 whm Sicherheitslücke rce Shared Hosting Domain Parking Root. Weiterlesen

OpenAI warnt vor KI-gestützten Cyberangriffen - Business Insider

Sun, 30 Aug 2026 07:20:59 +0200

zu sein, Cybersicherheit endlich als das Thema der nationalen Sicherheit zu behandeln, das sie ist. Der Brief erwähnte ausdrücklich die Möglichkeit, ... Weiterlesen