Aggregator

Cybercriminals have set their sights on Android users through a well-crafted phishing scheme that disguises malicious applications as beta-testing opportunities for ChatGPT and Meta advertising tools. What appears to be a legitimate app-testing invitation turns out to be a carefully planned attempt to steal Facebook credentials and seize full control of user accounts. This campaign […]

The post Hackers Attacking Android Users With Fake ChatGPT Invites to Deploy Malware appeared first on Cyber Security News.

Как новые шпионские программы обходят защиту iPhone.

好的，我现在需要帮用户总结一篇关于OpenAI的文章，控制在100字以内。首先，我得通读文章，抓住主要信息。 文章提到OpenAI在财务文件中指出对微软的依赖是潜在风险。他们正在寻求额外融资，目标100亿美元，预计三月底完成。此外，他们希望减少对微软的依赖，寻找其他合作伙伴。 接下来，我需要将这些信息浓缩成一句话。要确保涵盖关键点：OpenAI、微软依赖、风险、融资目标、时间点以及寻找其他合作。 最后，检查字数是否在限制内，并确保语句通顺。这样用户就能快速了解文章的核心内容了。 OpenAI在财务文件中指出对微软的依赖可能构成风险，并寻求额外100亿美元融资以减少对其依赖。

Most organizations have invested heavily in security products over the past decade. The assumption embedded in that spending is that more tools equal better protection. Tim Nan, CEO of digiDations, says that assumption is the most persistent misconception he encounters when working with security leaders across industries. “Adversaries don’t operate on averages,” Nan says. “They only need one path that works. The issue isn’t whether your defenses work most of the time. It’s whether they … More →

The post Measuring security performance in real-time, not once a quarter appeared first on Help Net Security.

Sparks, Nevada — March 6, 2026  NAKIVO Inc. announced the release of NAKIVO Backup & Replication v11.2, offering expanded platform support, enhanced security and faster disaster recovery for organizations worldwide. This version is the product of a focused engineering roadmap, while NAKIVO’s international growth reflects deepening market demand for reliable, cost-effective data protection.  What v11.2 Delivers  The update […]

The post NAKIVO Backup & Replication Launches v11.2 with Automated Real-Time Replication and VMware vSphere 9 Support  appeared first on Cyber Security News.

Reddit CEO Steve Huffman 透露该社交网站正探索不同方法去验证用户是真人还是机器人。他说，最简单的方法是使用 Face ID 或 Touch ID 之类的生物识别技术，这些方法都需要真人参与；更复杂的方法包括了身份识别验证。Huffman 说，我们对用户的承诺是，我们不知道你的名字，但我们希望知道你是个人。他表示将会采取循序渐进的方法，每个平台都要找到恰当的平衡点。

A vulnerability has been found in Google Chrome and classified as critical. The impacted element is an unknown function of the component WebGL. This manipulation causes heap-based buffer overflow. The identification of this vulnerability is CVE-2026-4675. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_time of the file libdeuteron_modules.so of the component NTP Service. The manipulation results in os command injection. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2026-4627. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Google Chrome. This issue affects some unknown processing of the component Fonts. The manipulation results in external control of assumed-immutable web parameter. This vulnerability is known as CVE-2026-4679. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability was found in itsourcecode Online Enrollment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. This vulnerability appears as CVE-2026-4632. The attack may be performed from remote. In addition, an exploit is available.

Предприимчивый мужчина целых 5 лет обманывал педофилов, подсовывая им пустые архивы.

好，我现在要帮用户总结这篇文章。用户的要求是用中文，控制在100字以内，不需要特定的开头，直接描述内容。首先，我需要仔细阅读文章内容。 文章主要讲美国两位参议员提出了一项新法案，禁止在受美国商品期货交易委员会监管的预测市场交易所进行体育博彩。涉及的平台包括Kalshi和Polymarket。法案还禁止赌场式游戏，如老虎机、视频扑克等。民主党参议员亚当·希夫认为CFTC在推动这些市场的增长，国会需要介入以保护消费者权益和部落主权，并指出这些活动没有带来公共收入。 接下来，我要提取关键信息：法案由两党提出，禁止体育博彩和赌场游戏在预测市场交易，涉及Kalshi和Polymarket等平台。同时提到希夫的观点，强调保护消费者和部落主权。 现在要将这些信息浓缩到100字以内。需要注意用词简洁明了，涵盖主要点：法案内容、涉及平台、两党合作、希夫的观点。 最后检查字数是否符合要求，并确保表达清晰。 美国两党参议员提出新法案，禁止受监管的预测市场交易所如Kalshi和Polymarket提供体育博彩相关合约，并禁止赌场式游戏。该法案旨在堵住监管漏洞，保护消费者权益及部落主权。

攻击者通过鱼叉邮件传播VBS脚本，最终投递远控木马AsyncRAT，实现键盘记录、凭证窃取与远程控制。

二者的区别仅在于macOS与Windows系统（PowerShell、命令提示符）下的安装指令，伪造指令会从攻击者控制的服务器端下载恶意程序。

Exploits remain the leading entry point for attackers for the sixth consecutive year, according to Mandiant’s M-Trends 2026 report, which draws on more than 500,000 hours of incident response work conducted in 2025. The data shows attackers speeding up their internal hand-offs, shifting away from email phishing, and targeting backup and virtualization infrastructure with greater precision. Initial infection vector 2025 (Source: Mandiant) Voice phishing surges as email phishing continues to decline Voice phishing climbed to … More →

The post Attackers are handing off access in 22 seconds, Mandiant finds appeared first on Help Net Security.

Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could be exploited to leak sensitive data from the application. The vulnerabilities are listed below - CVE-2026-3055 (CVSS score: 9.3) - Insufficient input validation leading to memory overread CVE-2026-4368 (CVSS score: 7.7) - Race condition leading to user

好的，用户让我总结一篇文章的内容，控制在100字以内，而且不需要用“文章内容总结”之类的开头。首先，我需要通读整篇文章，抓住主要信息。 文章讲的是Citrix发布了安全更新，修复了NetScaler ADC和Gateway中的两个漏洞。一个是CVE-2026-3055，CVSS评分9.3，属于严重漏洞，可能导致内存溢出读取，进而泄露敏感数据。另一个是CVE-2026-4368，评分7.7，涉及竞态条件导致用户会话混乱。 接下来，Rapid7指出CVE-2026-3055可以让未认证的远程攻击者读取内存中的敏感信息。但只有当设备配置为SAML身份提供商时才受影响，默认配置没问题。而CVE-2026-4368则需要设备作为网关或AAA服务器。 漏洞影响了多个版本的NetScaler产品，建议用户尽快更新。虽然目前没有被利用的证据，但过去Citrix设备曾多次被攻击者利用，所以这次也需要重视。 最后，专家警告说这个漏洞类似于之前的Citrix Bleed事件，可能很快被利用，必须立即修补。 总结的时候要简洁明了，涵盖漏洞名称、影响、配置要求和建议措施。控制在100字以内。 Citrix修复了NetScaler ADC和Gateway中的两个安全漏洞：CVE-2026-3055（CVSS 9.3）可能导致内存溢出读取敏感数据；CVE-2026-4368（CVSS 7.7）可能导致用户会话混乱。前者需设备配置为SAML身份提供商，默认配置不受影响；后者需设备作为网关或AAA服务器。建议用户尽快更新以防范潜在攻击。

A vulnerability was found in Google Chrome. It has been classified as problematic. This impacts an unknown function of the component CSS. Performing a manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-4674. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, has been found in Google Chrome. Impacted is an unknown function of the component WebAudio. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-4673. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.