Aggregator

Мессенджеры работают через VPN, но не напрямую. В чем же дело?

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  

• CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Progress is being made, but too many network devices still remain difficult to investigate after compromise

Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,

Russian intelligence-linked hackers have shifted tactics to target Signal users’ backup recovery keys, enabling full account takeover and access to historical message archives without breaking Signal’s end-to-end encryption. The FBI and CISA are warning that this evolving phishing campaign focuses on high-value targets worldwide and abuses user trust in “support” messaging inside the app. These […]

The post Russian Intelligence Hackers Target Signal Backup Recovery Keys in Account Takeover Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Разработчик? В основном он спал.

NVIDIA has revealed a significant security vulnerability in its BlueField data processing units (DPUs) that could allow virtual machine (VM) users to execute arbitrary code through specially crafted network messages. This raises serious concerns for cloud and virtualized infrastructure environments. The vulnerability, designated as CVE-2026-65094, impacts NVIDIA VIRTIO-Net implementations on BlueField-3 platforms and has a […]

The post NVIDIA BlueField Flaw Lets VM Users Execute Code via Crafted Messages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A threat actor has reportedly claimed to possess and sell a large dataset allegedly linked to the fintech company Revolut, purportedly affecting more than 757 million users. This claim, circulated by the CyberWatch threat intelligence account on X, suggests that the dataset contains sensitive customer and account-related information. However, the dataset has not been independently […]

The post Threat Actor Claims Revolut Data Breach Exposes Financial Records of 75 Million Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

MIND has announced MIND AI DLP Agents with capabilities focused on classification, investigation, policies, remediation and exception management. MIND also includes a Model Context Protocol (MCP) interface that enables security teams to direct data security work through any MCP-connected client using natural language. AI has fundamentally changed the speed and scale at which sensitive data moves. GenAI applications, Agentic AI and autonomous workflows create and move data faster than security teams can manually govern it. … More →

The post MIND AI DLP Agents automate DLP classification, investigations and remediation appeared first on Help Net Security.

Что будет с трафиком россиян после отказа Fingrid обслуживать опоры ЛЭП.

Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

Buying a new computer in 2026 is a unique experience. Rather than deal with incredibly high tech prices, more shoppers are opting for high-quality refurbished tech. This ASUS Chromebook CM30 refurb is in near-mint condition with a grade "A" rating, but it still only costs $144.97 (reg. $369.99) on sale. [...]

把 AI 视频生成变成一种轻量的社交动作。

既是交付最后端，也是输入信息的最前端。

Contrast Security has announced Contrast CVE Shield, designed to help organisations defend against the growing number of exploits generated with advanced AI models such as Claude Mythos. Contrast CVE Shield runs inside the application, where it detects, monitors and blocks attempts to exploit known vulnerabilities. Applications continue to function normally while security teams gain visibility into which vulnerabilities are present, which are being targeted and which exploitation attempts have been prevented. Using a runtime microsandbox … More →

The post Contrast CVE Shield aims to protect applications while security teams deploy patches appeared first on Help Net Security.

CISA, in collaboration with the Australian Signals Directorate’s Australian Cyber Security Center (ASD’s ACSC), the FBI, and international partners, has released new joint guidance titled “CI Fortify – Advice for Isolating Vital Systems.” This guidance aims to strengthen the resilience of critical infrastructure (CI) environments against escalating cyber threats. Published on July 28, 2026, it […]

The post CISA Urges Critical Infrastructure Operators to Isolate Vital OT Systems During Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Свежий инцидент едва не оставил жителей без запасов питьевой воды.

OpenAI confirmed its AI exploited an Artifactory zero-day to escape its test environment before breaching Hugging Face. Two weeks after Hugging Face disclosed an autonomous AI system had breached it, the picture just got a lot more specific. OpenAI has published an update confirming the models responsible didn’t just wander into Hugging Face’s systems. They […]

关键词漏洞自托管 Git 平台 Gitea 修复了一个严重的远程代码执行漏洞，任何拥有仓库写权限的用户都可以通

关键词AIOpenAI 披露了一起令人震惊的安全事件：其 AI 模型在内部安全测试中自主突破了密封的测试环境，