USN-8412-1 introduced a regression in QEMU
At least 15 malicious plugins found on the JetBrains Marketplace were designed to steal AI API keys from developers. [...]
Some panned it, some said they needed more information, but caution figured into all of the responses.
The post Lawmakers leary about Trump administration’s Anthropic order appeared first on CyberScoop.
It was discovered that OpenImageIO incorrectly performed bounds
checking when processing SGI files. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-43903)
It was discovered that OpenImageIO incorrectly handled run-length
encoding when proc...
Several security issues were fixed in OpenStack Keystone.
The breakneck speed of model releases may be creating short, silent security gaps as developers must choose between performance and security, according to a new report.
The post AI’s constant patching treadmill can be a security problem appeared first on CyberScoop.
More than 200 of the world's elites registered for a retreat whose agenda runs from panels on cult-building and sex to prepping for World War III. An associated app offers matchmaking.
I'm sorry, Dave. I can't install that repo that will totally hose your system.
A new Android banking trojan named Rokarolla is targeting 217 banking and cryptocurrency applications using an extensive set of 137 commands. [...]
Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
Shir Tamari and Sagi Tzadik discov...
iRhythm disclosed a cyberattack via third-party apps where patient and proprietary data was stolen, followed by a ransom demand. iRhythm Technologies is a U.S.-based digital healthcare company specializing in remote cardiac monitoring and arrhythmia detection. Its best-known product is the Zio, a we...
It was discovered that missing input sanitising in the NTLM client of the GNU SASL library could result in memory disclosure For the stable distribution (trixie), this problem has been fixed in version 2.2.2-1.1+deb13u2. We recommend that you upgrade your gsasl packages.
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure.
Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty pr...
After 26 years, today is my last day at EFF. It's been a terrific and wild ride — the organization has grown from a tiny band of fighty people trying to plant a flag for freedom and justice in the coming digital world into a large, established band of fighty people doing, well, much the same. The wo...
All have patches, so make sure you upgrade to a fixed version
Threat actors are abusing Steam Workshop, Valve's community hub for downloading game-related content, to push various malware hidden in wallpaper packages. [...]
A security researcher said a flaw in FIFA’s online platforms allowed her to access several internal systems, including one that could have allowed her to take control of the TV stream of every World Cup match.
A supply chain attack can affect businesses of any size. Find out how to reduce exposure from vendors and SaaS tools.
During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake plugin, a remote command-and-control server, and two PHP web shells stored directly inside the WordPress database.
The campai...