Aggregator

Mozilla закрыла проблемы, которые слишком легко недооценить по сухому описанию.

背景介绍2026年5月7日，XLab监测到一起针对重要客户Ghost CMS的投毒事件。

ИИ-модель OpenAI опровергла гипотезу Эрдёша о единичных расстояниях.

没有什么护城河是一定存在的，能构建的壁垒只有两个：速度和 AI 人才密度。

SpaceX 周三晚上向美国证券交易委员会（SEC）递交了招股说明书，首次披露了其财务状况。根据招股说明书，在合并了马斯克（Elon Musk）旗下的 xAI 和 X/Twitter 之后，SpaceX 最大的收入来源就是今年五月与 Anthropic 达成的为期三年的数据中心交易，租用 Colossus 1 园区的算力，每月支付 12.5 亿美元。但这笔交易并非是保障性，任何一方都可以提前 90 天通知终止交易。其它数据包括：2025 年营收 187 亿美元，营业亏损 26 亿美元，净亏损 49 亿美元。其中卫星宽带 Starlink / Connectivity 业务营收 114 亿美元营业利润 44 亿美元，太空发射业务营收 41 亿美元运营亏损 6.57 亿美元，AI 以及社媒业务营收 32 亿美元营业亏损 64 亿美元。招股书数百次提及 AI。马斯克持有 12.3% 的 A 类股和 93.6% 的 B 类股，B 类股投票权十倍于 A 类股，马斯克总共控制着公司 85.1% 的投票权。如果他出售任何 B 类股，它们将自动转换为 A 类股。

Organizations that handle sensitive data consistently face a dilemma: lock data down and lose productivity, or share it freely and lose control. Virtru unveiled Virtru Collaborate, a new offering that eliminates that tradeoff, a FedRAMP authorized space where sensitive files are encrypted and protected by the Trusted Data Format (TDF), and where that protection travels seamlessly with the data as teams work together across organizational boundaries. Virtru Collaborate is the first solution built on the … More →

The post Virtru centers file collaboration around data-level protection appeared first on Help Net Security.

A vulnerability was found in Mattermost up to 10.11.13/11.4.3/11.5.1. It has been classified as problematic. Impacted is an unknown function of the component Run Creation API. The manipulation leads to incorrect authorization. This vulnerability is referenced as CVE-2026-4055. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

ASAPP has launched Continuous Red Teaming, a new capability that integrates adversarial AI testing directly into ASAPP’s model evaluation framework. The new capability is built on Promptfoo, an AI security platform that helps enterprises detect and address vulnerabilities in AI systems during development. Promptfoo continuously runs automated tests across ASAPP’s AI systems, screening for more than 50 vulnerability types to give enterprise customers the real-time data they need to trust their AI in production. As … More →

The post ASAPP expands adversarial testing for enterprise AI systems appeared first on Help Net Security.

Производителей техники хотят обязать раскрывать сервисную документацию.

Tenable has announced the general availability of Tenable Hexa AI, the agentic AI engine of the Tenable One Exposure Management Platform. Tenable Hexa AI is an advanced agentic AI for cybersecurity solution, equipped with advanced multi-step reasoning and Model Context Protocol (MCP) support, enabling custom agent building and workflows that accelerate risk reduction at machine speed. LLMs and AI frontier models, such as Anthropic’s Mythos Preview, are accelerating the discovery of previously unknown vulnerabilities at … More →

The post Tenable Hexa AI automates remediation across attack surfaces appeared first on Help Net Security.

A newly disclosed zero-day remote code execution (RCE) vulnerability, dubbed nginx-poolslip, has been identified in NGINX version 1.31.0, the latest stable release of the widely deployed web server software. The discovery was made by security agent Vega, operating under the NebSec security team, and publicly disclosed via X (formerly Twitter) on May 21, 2026. Just […]

The post New NGINX 0-Day RCE “nginx-poolslip” Affects Millions of NGINX Servers appeared first on Cyber Security News.

Grafana Labs has confirmed a recent data breach was caused by the TanStack supply chain attack

On Wednesday, Microsoft started rolling out security patches for two Defender vulnerabilities that have been exploited in zero-day attacks. [...]

Riverbed has announced new capabilities for Aternity designed to support autonomous IT operations for digital experience management. The updates help digital workplace teams move toward prevention-focused operations through broader visibility, context-aware intelligence, and governance controls that support automated workflows. Organizations are measured by their ability to deliver frictionless digital experiences that keep employees productive and business workflows operating without interruption. While many IT initiatives focus on improving reactive operations, Riverbed is focused on enabling organizations … More →

The post Riverbed introduces new Aternity tools for autonomous IT operations appeared first on Help Net Security.

Google 的 AI 搜索非常容易被人为操纵。因为以前的搜索结果是第一页给你 10 个链接然后让用户判断，现在的 AI 搜索是给你一个答案，而答案的来源可能只有一个。BBC 科技记者通过个人网站上一篇热狗文章演示了这一操纵。专家表示此类操纵正大规模系统性地发生。操纵 AI 搜索向用户提供偏见或不准确信息可能会带来严重后果。这并非一个无关紧要的问题。在全球范围内，逾 10 亿人日常使用 AI 聊天机器人，每月有 25 亿人浏览 Google 的 AI overviews。如果你能操控此类工具就能获得巨大的权力。Google 等公司也注意到了该问题。, Google 上周更新了其政策，将试图操纵 AI 回复的行为视为违反公司规定。Google 威胁对涉嫌操纵行为的公司或网站从搜索结果中移除或降低排名。

Новый эксплойт лежит в открытом доступе и ждёт неосторожного администратора.

Forward has unveiled Forward Predict, a new capability that allows organizations to evaluate the impact of network changes before deployment. By testing proposed changes against a digital twin of the production network, Forward Predict helps identify potential issues before they reach live environments and supports safer network operations at scale. “When we founded Forward more than a decade ago, we set our sights on the future of autonomous networking,” said David Erickson, CEO of Forward. … More →

The post Forward launches Predict to test network changes before deployment appeared first on Help Net Security.

Cybersecurity researchers have disclosed details of a vulnerability in the Linux kernel that remained undetected for nine years. The vulnerability, tracked as CVE-2026-46333 (CVSS score: 5.5), is a case of improper privilege management that could permit an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major

A ransomware strain called WantToCry has been targeting businesses by abusing a widely used file-sharing protocol to encrypt files without dropping any malware on the victim’s system. The attacks mark a notable shift in how ransomware operators approach campaigns, serving as a warning to any organization that still has file-sharing services exposed to the open […]

The post WantToCry Ransomware Abuses SMB Services to Remotely Encrypt Files appeared first on Cyber Security News.