Aggregator

This publication updates and replaces the 2021 Minimum Elements for a Software Bill of Materials published by the United States’ National Telecommunications and Information Administration.

A vulnerability classified as problematic was found in Balbooa Gridbox Extension up to 2.20.1. This affects an unknown part of the component Admin Interface. Such manipulation leads to cross-site request forgery. This vulnerability is listed as CVE-2026-65947. The attack may be performed from remote. There is no available exploit.

A critical security flaw in the open-source AI orchestration platform Ruflo has been disclosed, allowing unauthenticated attackers to execute arbitrary commands and fully compromise AI agent environments. Assigned a maximum CVSS base score of 10.0, the vulnerability (tracked as CVE-2026-59726) was discovered by Noma Labs and affects Ruflo’s Model Context Protocol (MCP) Bridge, a core […]

The post Critical Ruflo MCP Bridge Flaw Lets Attackers Execute Commands and Hijack AI Agents appeared first on Cyber Security News.

A vulnerability classified as critical has been found in Balbooa Gridbox Extension up to 2.20.1. Affected by this issue is the function socialLogin. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2026-65888. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in CERT.PL MWDB Core up to 2.18.x. Affected by this vulnerability is an unknown functionality of the component Config/Blob Upload Endpoints. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-66724. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Google 发表研究报告《AI & Economy ATLAS》，它未发现有明确证据显示 AI 将导致大规模自动化以及能取代白领工作。报告是基于对 Gemini App、Google AI Mode 和 Gemini API 上 1500 万次匿名化 AI 交互的活动、任务、全景趋势和普及研究。研究发现，AI 应用仍停留在浅层，且主要以协作为主，端到端任务自动化的范围有限。计算机、金融、艺术和娱乐等领域的白领工作的 Gemini 普及率高于其它领域，金融/市场分析师、软件开发者和系统管理员是 AI 的高频用户，销售、运输工人以及食品加工/服务人员很少使用 AI。29% 的职业 AI 的影响微乎其微，另外 30% 的职业大部分工作仍然由人类负责。只有 3% 的职业会经常性的使用 AI，这些受 AI 影响最大的职业包括了软件 QA 分析师和测试人员、HR 专家以及文档管理专家。数据表明 AI 目前主要作为现有工作的补充，对某些职业中的部分任务有用，未被全面用于执行目前由人类完成的工作。员工外包给 AI 的认知任务绝大多数都不需要太多专业知识。

你有没有想过，在咖啡馆敲键盘、线上会议时打字，只通过声音就能被人还原出输入的完整文字？

TA488 returned with OWA half-click exploit deploying OWAReaper implant that survived re-imaging

JetBrains выпустила экстренное обновление. Тянуть с его установкой не стоит.

Доклад Airwars показал, где человек уже не при делах.

Russian intelligence-linked hackers are trying to seize Signal accounts by posing as support staff and asking targets for backup recovery keys. The campaign targets people with access to sensitive conversations, including officials, military personnel, political figures, journalists, and Ukrainian leaders. It relies on deception, not a break in Signal’s end-to-end encryption, but the possible loss […]

The post Russian Intelligence Hackers Phish Signal Backup Keys to Hijack Accounts and Messages appeared first on Cyber Security News.

Ruflo fixed a CVSS 10.0 flaw that exposed its MCP bridge without any authentication, putting AI provider keys, stored chats and persistent agent memory at risk.

The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities across the entire state after hackers targeted more than 30 community water systems in "a coordinated cyberattack." [...]

Researchers say the Russian state-linked hacking group tracked as Laundry Bear recently began exploiting a bug in Microsoft Outlook Web Access.

A fresh supply chain scare hit software teams after attackers slipped malware into trusted open source libraries. On July 28, 2026, malicious beta builds of two Joyfill packages appeared on the npm registry. The libraries, @joyfill/components and @joyfill/layouts, are used for forms and layout work in many web apps. Anyone who imported those beta builds […]

The post Hijacked Joyfill npm Packages Deploy Worm-Like RAT and Steal Developer Credentials appeared first on Cyber Security News.

Эти программы продвигались на платформе месяцами, а заметили кампанию только сейчас.

爱丁堡大学的研究人员在一年时间里跟踪了不同行业 45 名年龄在 50-66 岁之间的员工，收集了逾 1900 份自我报告的幸福感和工作场所评估数据，以及逾 5200 天的可穿戴传感器数据。结果显示，睡眠问题在参与者中间非常普遍。大多数参与者平均每晚睡眠时间为 6.5-8 小时，但九成参与者在整个研究期间都经历了睡眠障碍。研究结果表明，睡眠紊乱而非睡眠时间不足可能是许多人感觉休息不足的原因。在众多因素中，工作压力被认为与睡眠问题密切相关。