Aggregator

Your Mac comes with a built-in firewall, but it’s probably not something you’ve given much tho

Defense contractors in the US are doubting their own self-assessment scores under CMMC Phase I, even as those scores hit an all-time high

Один кристалл, два типа электронного порядка и два способа вернуться после разрушения.

Zyxel has released firmware updates for a high-severity command injection vulnerability, tracked as CVE-2026-6837, affecting 18 wireless access point models. The flaw exists in the export-cgi component and could allow an authenticated administrator to execute operating-system commands on vulnerable devices. The issue affects the PKCS#12 certificate export workflow. Security researcher Mina Nageh Salama reported that the certificate […]

The post Zyxel Patches Command Injection Flaw in 18 Access Points Allowing Root OS Command Execution appeared first on Cyber Security News.

AI现在挺会找漏洞，但写不出安全的代码。 攻防严重失衡：AI找零日漏洞越来越快。但让它写安全代码或打补丁，成功率只有两成多。近半数的代码里藏着基础漏洞。 为啥补不好：一是训练数据太杂，二是模型容易“顾头不顾腚”。它只盯着报错的那行改，旁边的同类漏洞全忘了。 单靠喂数据没用：得给AI配个“操作系统”。也就是把代码扫描、测试工具全接上。让它在这些关卡里反复修改，表现才能稳住。 人不能甩手：自动化检查能拦住不少错，但最终拍板的还得是人。企业现有的安全控制一样都不能少。 说白了，AI只是个放大器。底子好的团队用它如虎添翼，底子烂的只会死得更快。

Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. [...]

OpenAI has temporarily slowed the development of its latest frontier AI models after initial testing suggested that its upcoming Astra system may meet the company’s “Critical” cybersecurity capability threshold. This decision follows a recent security incident involving OpenAI and Hugging Face. It reflects growing concerns that advanced models could significantly increase the risks of cyber […]

The post OpenAI Slows AI Model Development as Astra Approaches Critical Cyber Capabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

我的博客（laruence.com）跑了十几年，对象缓存一直用的是 Memcached。稳定、经典，没出过什么问题，但每次读缓存都要走一次 localhost TCP：连接管理、协议编解码、

WordPress 的对象缓存用 Memcached每次读缓存都要走一次 localhost TCP。换成共享内存缓存 Yac，实测吞吐提升 19%，延迟降低 15%——省掉的不是缓存未命中，而是命中本身的代价。

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives exp

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.  

• CVE-2026-72529 TrueConf Server Missing Authentication for Critical Function Vulnerability  
• CVE-2026-72530 TrueConf Server Code Injection Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

ToxicPanda 2.0, an evolved Android banking Trojan that significantly expands its fraud, device control, and credential theft capabilities. The updated malware uses invisible overlays to capture PIN input from more than 140 banking and cryptocurrency applications, while its broader phishing framework targets 349 banking, financial, e-wallet, and crypto applications across 16 countries. ToxicPanda was previously […]

The post ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Ваш Wi-Fi теперь видит вас, даже если не видит.

Meta公司正以每年数亿美元的规模，通过微软Azure云服务大量采购人工智能模型，悄然跻身微软最大AI客户之列。据知情人士透露，Meta每周通过Azure平台消耗的AI算力高达数万亿个 token。与

Apple American Group LLC, a major Applebee’s franchise operator in the United States, has disclosed a data breach incident. The event has reportedly exposed sensitive personal information, including Social Security numbers, financial data, health records, and biometric information. The total number of affected people remains unclear, but state filings indicate that at least 8,447 people …

The post Largest Applebee’s franchisee says hackers stole sensitive data appeared first on CyberInsider.

Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files