Aggregator

流量红利消逝，中国企业出海可以靠 Agent 破局吗？

托管了众多知名开源项目的德国非盈利组织 Codeberg 在会员投票之后宣布了重大政策改变：首先是它承诺不会用用户的任何数据去训练大模型，其次是会员以 358 票赞成 144 票反对通过了

托管了众多知名开源项目的德国非盈利组织 Codeberg 在会员投票之后宣布了重大政策改变：首先是它承诺不会用用户的任何数据去训练大模型，其次是会员以 358 票赞成 144 票反对通过了提议，禁止 vibe-coded 项目。Codeberg 官方博客称，LLM 是一项成本昂贵的技术，且随着 AI 公司开始收回投资，成本还在不断攀升。这种成本不仅体现在云服务和订阅费用中，事实上每个人都深受影响。LLM 的成本如此之高以至于公司将成本转嫁给不使用 AI 的人和整个社会。硬件价格上涨、能源消耗增加以及环境破坏——我们所有人都在为此买单！AI 公司的爬虫让 Codeberg 的服务器不堪重负，而用户寥寥无几的 vibe-coded 项目消耗的资源甚至堪比大型的开源项目。LLM 的训练和部署大幅提高了硬件采购成本，尤其是 SSD 和内存。几年前采购一块硬盘只需要 700 欧元，如今相同的硬盘需要 3700 欧元，而且经常缺货，因此 Codeberg 托管代码的成本也越来越高。数据中心等基础设施、LLM 生成代码的版权和许可证问题，分享根据提示词通过 LLM 生成代码并称之为开源软件的举措并不会让世界变得更好，Codeberg 不想成为托管此类代码的平台，不希望浪费有限的资源，它将开始采取行动清理 vibe-coded 项目，偶尔使用 LLM 生成代码或维护者在不知情下接受了贡献者递交的 LLM 生成代码的项目预计不会受到影响。

Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls). “An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration,” the company said. The vulnerability is being exploited, they confirmed, and a “handful” … More →

The post Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) appeared first on Help Net Security.

Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. Once installed, the RAT process keeps all of … More →

The post Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process appeared first on Help Net Security.

Fortinet has found a new TrickBot variant hiding commands in DNS traffic and using scheduled tasks and added modules to maintain access on infected Windows PCs.

A new Windows-focused infostealer and remote access trojan (RAT) dubbed Dolphin X is being advertised on cybercrime forums with a clear pitch: automate the theft and triage of high-value corporate targets. Unlike commodity stealers that focus mainly on browser passwords, Dolphin X is positioned as an enterprise-adjacent data vacuum with a built-in AI-powered victim scoring […]

The post New Windows Stealer Uses AI Profiling to Identify High-Value Corporate Victims appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Белый дом заявил, что Moonshot AI получила доступ к ускорителям Nvidia GB300 в Таиланде для обучения ИИ.

A vulnerability labeled as problematic has been found in WP Compress Plugin up to 7.10.3 on WordPress. The affected element is an unknown function. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-9066. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, has been found in Red Hat nano. This affects an unknown function of the component Multi-buffer Error Message Handler. Performing a manipulation results in format string. This vulnerability is reported as CVE-2026-6390. The attack requires a local approach. No exploit exists.

A vulnerability, which was classified as problematic, was found in FormCraft Plugin up to 3.9.14 on WordPress. This impacts the function html_entity_decode of the file formcraft-main.php of the component Input Sanitization. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2026-7232. The attack may be performed from remote. There is no available exploit.

A vulnerability was found in Ricoh Company Printers and Multifunction Printers and classified as very critical. Affected by this vulnerability is an unknown functionality of the component SSH Port Forwarding. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-63226. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in FantasticPlugins SUMO Reward Points Plugin up to 32.7.0 on WordPress. It has been classified as problematic. Affected by this issue is the function SRP_REST_Earning_Controller.create_items/SRP_Master_Log.column_default of the file /wp-json/wc-srp/v1/earning of the component REST API Endpoint/Admin Pages. This manipulation of the argument Reason causes cross site scripting. This vulnerability is handled as CVE-2026-7534. The attack can be initiated remotely. There is not any exploit available.

A vulnerability identified as problematic has been detected in SELinuxProject SELinux up to 3.10. Impacted is an unknown function of the component seunshare. The manipulation leads to time-of-check time-of-use. This vulnerability is referenced as CVE-2026-59676. The attack can only be performed from a local environment. No exploit is available.

速修复

Dolphin X is a new infostealer that uses AI to sort and rank victims, giving cybercriminals a faster way to identify lucrative targets

欧盟委员会表示，谷歌公司因违反欧盟规则被处以总计8.9亿欧元的罚款。谷歌有60天的时间公平对待竞争对手，并允许应用开发者引导用户离开其应用商店。欧盟委员会当地时间周四表示，谷歌不公平地偏袒其自家搜索服

RAR encryption has an unusual reputation: in more than twen

Эта машина может ехать без дозаправки больше 700 километров — прямо по бездорожью.