Aggregator

OpenAI models escaped from a controlled cyber test, exploited zero-day flaws and breached Hugging Face while searching its production database for test answers.

Public proof-of-concept (PoC) exploit code was released for CVE-2026-42980, a local privilege escalation vulnerability in the Windows NT OS Kernel. This vulnerability occurs due to an integer underflow in kernel-mode code. CVE-2026-42980 is an elevation-of-privilege flaw in the Windows NT OS Kernel caused by an integer underflow (wraparound) condition in a kernel code path. This […]

The post Public PoC Released for Windows NT OS Kernel Privilege Escalation Vulnerability appeared first on Cyber Security News.

Multi-factor authentication is meant to stop stolen-password attacks. A newly documented phishing technique instead persuades users to approve a real Microsoft sign-in, allowing attackers to take over the resulting Microsoft 365 session without directly stealing credentials. The campaign abuses the OAuth device-code flow, a feature intended for devices such as smart TVs and meeting-room systems […]

The post Hackers Let Victims Complete MFA Then Steal the Entire Microsoft 365 Session appeared first on Cyber Security News.

A phishing kit known as Kali365 is targeting U.S. organizations through device code phishing attacks that abuse Microsoft’s legitimate authentication process to hijack Microsoft 365 accounts. Unlike conventional phishing campaigns that direct targets to counterfeit login portals, Kali365 sends victims to a real Microsoft Device Login page. Victims are persuaded to enter an attacker-provided device […]

The post Kali365 Phishing Kit Abuses Microsoft Device Codes to Hijack Microsoft 365 Accounts appeared first on Cyber Security News.

New research finds that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hardcoded secrets and authorization failures. The rapid adoption of AI coding assistants has transformed software development, enabling developers to generate production-ready applications in minutes rather than days. But as organizations increasingly rely on AI-generated code, a […]

The post What 434 AI-Generated Vulnerabilities Reveal About Secure Software Development appeared first on Cyber Security News.

Читать истории глазами — прошлый век: теперь их можно прожить всем телом.

A forum user posting as kitta has published what they describe as the database of Bebunk.com, a digital financial service offering current accounts and payment cards.

Iran-linked hackers are not relying only on loud attacks, public leaks, or website defacements. They are quietly building access inside companies, cloud accounts, service providers, and industrial networks that could later be used to disrupt operations during a crisis. The activity includes stolen credentials, remote management tools, recruitment-themed phishing, and attacks on exposed industrial systems. […]

The post Iranian Hackers Are Quietly Building Access They Can Turn Into Wartime Disruption appeared first on Cyber Security News.

Swiss rail vehicle manufacturer Stadler Rail says the Everest ransomware gang demanded about $12.3 million after breaching a data exchange platform shared with one of its suppliers. [...]

我们在小学时学习的多位数乘法叫竖式乘法，其时间复杂度为 O(n²)，即位数越长，计算量随位数的平方增长。举例来说，两个两位数相乘，需要进行四次计算；两个三位数相乘，需要进行九次计算。位数越长，计算量会越来越惊人。那么 O(n²)是否是乘法的速度极限呢？苏联著名数学教授 Andrey Kolmogorov 在 1960 年的一次研讨会上讨论了这一猜想，仅仅一周之后，23 岁的学生 Anatoly Karatsuba 就给出了否定答案。他发现可以用简单快速的加法去替代费劲的乘法计算，而两个 n 位数相加的时间复杂度仅为 O(n)，加法只需要遍历数字一次，而乘法需要对 n 位数的每一位进行完整遍历。通过这一代数技巧，他将乘法的时间复杂度减少到 O(n^1.585)，比O(n²) 快得多。Karatsuba 算法的优势只有在数字较大时才会体现出来。Python 语言就使用了混合方法，当数字较小时使用小学乘法，当数字大于 630 位十进制数时改用 Karatsuba 的算法。2019 年数学家 David Harvey 和 Joris van der Hoeven 找到了一种比 Karatsuba 算法更快的方法，其时间复杂度为 O(n × log n)，但它相对于 Karatsuba 算法的优势只有在数非常非常大时才会体现。Harvey-van der Hoeven 算法被普遍认为是乘法的最快方法，但目前尚无正式证明。

A forum user posting as kitta has published what they describe as the full database of RevolutionParts.com, the e-commerce platform used by automotive dealerships to sell parts online.

A North Korean advanced persistent threat (APT) group recently targeted vendors of collaborative-work software, South Korean researchers said.

While distillation attacks by foreign governments and companies have real national security implications, questions around who ultimately owns the data in AI systems are fraught.

The post White House accuses Chinese company of distilling Anthropic’s Fable appeared first on CyberScoop.

Хакерская группировка JADEPUFFER начала целенаправленно уничтожать ИИ-модели вместо обычных данных.

Apple has released a security fix addressing a critical flaw in its iCloud+ “Hide My Email” feature that could expose users’ real email addresses, undermining the core privacy promise of the service. The vulnerability, which reportedly remained unresolved for over a year, allowed attackers to determine a user’s actual email address from an anonymized alias […]

The post Apple Releases Fixes for Hide My Email Flaw that Exposes Users’ Real Email Addresses appeared first on Cyber Security News.

Learn how growing teams make AI tools reliable with clear workflows, shared rules, secure systems, and repeatable processes that improve quality and speed daily

Submit #860585 / VDB-382382

Submit #860239 / VDB-382381

Submit #860232 / VDB-382380

Что рассказала внутренняя переписка вымогателей Funky Mantis.