Aggregator

Most teams that deploy AI start with a backbone model. They download a large pre-trained system, adapt it to a specific task, and put it into production. The download step carries a security question: the origin of the model. A research team built an attack called BadBone. It plants a backdoor inside a backbone model. Downstream tasks that adapt the model inherit the backdoor. The name points at the target. Corrupt the skeleton, and systems … More →

The post This AI model backdoor attack stays hidden until you customize the model appeared first on Help Net Security.

CERT/CCから本件に関するアドバイザリが公表されました。

美国中央情报局（CIA）的中国任务中心（China Mission Center, CMC）在机构设置上打破了传统情报机构的条块分割，其核心逻辑在于“融合、技术驱动与全方位对抗”。 以下是该中心的具体机构设置： 形成了四大核心业务支柱与五大基础保障板块 1. 核心领导层 CMC 局长室 / 核心领导小组：直属CIA局长，拥有极高的决策权。CMC局长负责协调跨部门资源，并定期直接向CIA局长乃至白宫、国家情报总监办公室（ODNI）汇报对华最新战略和前沿动态。 2. 四大业务支柱 中国分析部 (China Analysis Division)：负责将收集到的原始情报转化为可供决策的报告。下设三个专业处： 政治经济分析处：评估中国宏观经济走势、供应链安全及高层政治动向。 军事与技术分析处：紧密跟踪中国军队现代化建设（解放军装备、战略）及前沿科技（AI、量子计算等）的进展。 地缘政治与外交分析处：分析中国在“一带一路”、印太地区及全球范围内的外交布局和影响力。 行动部 (Operations Division)：CMC的“利剑”，负责情报获取与海外秘密行动。 人力情报处 (HUMINT)：传统间谍网络，负责在海外及关键区域招募、管理针对中国的情报线人。 网络行动处 (CYBER)：高强度聚焦数字空间，开展网络刺探、系统渗透及网络防御。 技术情报处 (TECHINT)：利用无人机、卫星、传感器等硬件技术设备获取情报。 反间谍部 (Counterintelligence Division）：盾牌角色，兼顾防御与主动出击。 反渗透与反间谍处：严防自身情报网遭到中方反向渗透，抓捕潜伏间谍。 内部安全与调查处：对中心人员的忠诚度、背景及泄密风险进行内部监控。 外国影响行动处：应对和打击所谓的“认知战、舆论战和海外影响力活动”。 科学与技术部 (Science & Technology Division, CMC Support)：作为技术支撑力量嵌入CMC。 创新与发展处：研发最新的针对性间谍工具和窃听/追踪技术。 3. 基础保障体系 位于底层的后台支持团队，包括资源管理与行政、政策与战略规划、法律顾问、信息技术（IT）、人力资源（大量招募并培训精通普通话及方言的专业人才），确保CMC能够在全球范围内保持高效运转。

Иностранный софт все еще контролирует более четверти инфраструктуры крупного бизнеса.

亲伊朗黑客诱骗 Meta AI 机器人短时间内接管了多个 Instagram 名人账号，其中包括奥巴马和美国太空军总军士长（Chief Master Sergeant），之后在账号上发表了亲伊朗的图片和信息。攻击方法非常简单：首先使用 VPN 连接到目标用户常住地附近，然后请求重置账号密码，要求与 Meta AI 客服对话，指示 AI 将目标账户关联到一个新邮箱地址，AI 按指示向该邮箱地址发送一次性验证码后，攻击者就可以重置密码接管账号。目前 Telegram 上已经出现了大量交易被接管账号的频道。Meta 的 Andy Stone 声称该公司已经采取行动解决了问题。

A dangerous new flaw has disrupted open-source identity infrastructure this week. Specifically, a severe Apache LDAP API vulnerability leaves directory clients vulnerable to interception. This specific framework provides an enhanced alternative to traditional Java...

The post Critical Security Flaw Exposes Apache LDAP API Connections appeared first on Information Security News.

Agentic Safety and Ecosystem Architect, Trust and Safety Google | USA | On-site – View job details As an Agentic Safety and Ecosystem Architect, Trust and Safety, you will define safety controls and permission models for autonomous agents on Android, helping ensure actions are reviewed before execution and access to sensitive data requires explicit consent. You will develop monitoring mechanisms to detect unsafe agent behavior and work with the developer community to promote secure agent … More →

The post Cybersecurity jobs available right now: June 2, 2026 appeared first on Help Net Security.

2026年6月1日，Red Hat 官方 npm 账户 @redhat-cloud-services 被攻陷。攻击者在 72秒 的时间窗口内自动化发布了 32 个携带后门的恶意包版本。

Password manager Dashlane has disclosed that "fewer than" 20 users on the personal subscription plan had their encrypted vaults downloaded following a brute-force attack launched by an unknown party. On May 31, 2026, the company said an "external" threat actor launched a brute-force attack against certain Dashlane user accounts with the aim of breaking two-factor authentication (2FA)

За красивой оболочкой работает невидимая система слежки в интересах третьих лиц.

百舸争鸣共绘产业新图谱，见证智能体应用爆发元年

A vulnerability classified as critical has been found in Elfatek Elektronics ANKA JPD-00028 up to 19.03.2025. The affected element is an unknown function. Performing a manipulation results in missing critical step in authentication. This vulnerability is known as CVE-2024-12136. The attack may be carried out on the physical device. No exploit is available.

A vulnerability classified as critical was found in Elfatek Elektronics ANKA JPD-00028 up to 19.03.2025. The impacted element is an unknown function. Executing a manipulation can lead to authentication bypass by capture-replay. This vulnerability is handled as CVE-2024-12137. The attack can only be done within the local network. There is not any exploit available.

A vulnerability was found in Mavi Yeşil Guest Tracking Software. It has been rated as critical. This vulnerability affects unknown code. This manipulation causes sql injection. This vulnerability is handled as CVE-2024-12364. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in Eron Wowwo CRM. This impacts an unknown function. The manipulation results in sql injection. This vulnerability was named CVE-2024-12150. The attack may be performed from remote. There is no available exploit.

A vulnerability classified as critical was found in Mobilteg Mobile Informatics Mikro Hand Terminal. This affects an unknown part. Executing a manipulation can lead to sql injection. This vulnerability is tracked as CVE-2024-12143. The attack can be launched remotely. No exploit exists.

A vulnerability has been found in Devinim Library Software and classified as problematic. This affects an unknown function. This manipulation causes cross site scripting. This vulnerability appears as CVE-2024-12915. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability categorized as problematic has been discovered in Vidco VOC Tester up to 12.40.x. The impacted element is an unknown function. The manipulation results in authorization bypass. This vulnerability is cataloged as CVE-2024-13175. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.100/6.12.40/6.15.8. It has been declared as critical. This impacts the function xfrmi_changelink of the file net/core/dev.c of the component xfrm. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2025-38500. The attack requires access to the local network. No exploit is available. It is recommended to upgrade the affected component.