Aggregator

Submit #769827 / VDB-351083

A vulnerability, which was classified as problematic, was found in Radare2 5.9.9. This issue affects the function walk_exports_trie of the file libr/bin/format/mach0/mach0.c of the component Mach-O File Parser. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-4174. The attack can only be performed from a local environment. Furthermore, an exploit is available. The existence of this vulnerability is still disputed at present. You should upgrade the affected component. The code maintainer states that, "[he] wont consider this bug a DoS".

Submit #769799 / VDB-351081

A vulnerability, which was classified as critical, has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure of the file DMDBManage.java of the component Database Export Handler. This manipulation causes sql injection. The identification of this vulnerability is CVE-2026-4173. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #769775 / VDB-351080

Presenter: Stacey Higginbotham, Consumer Reports

Our thanks to USENIX Security '25 (Enigma Track) (USENIX '25 for publishing their Creators, Authors and Presenter’s tremendous USENIX Security '25 (Enigma Track) (USENIX '25 content on the Organizations' YouTube Channel.

Permalink

The post USENIX Security ’25 (Enigma Track) – Zombie Devices Are Running Amuck! appeared first on Security Boulevard.

Функция, которую запускали как шаг к приватности, не прижилась и теперь уйдет из сервиса вместе с частью защищенных переписок

Digg 重启版在运营两个月后关闭，CEO Justin Mezzell 将问题归咎于机器人账号泛滥。Digg 是在一月初上线了一个 Reddit 克隆版本，提供类似的基于兴趣的社区。但 Reddit 运营良好，Digg 难以吸引用户，同时还面临 AI 驱动的机器人和垃圾信息的冲击。Mezzell 在声明中称，有相当大一部分的互联网被先进的 AI 智能体和机器人账户所占据，Digg 封禁了数万账号，部署了内部工具，聘请了外部供应商，但都无济于事，如果用户看到的投票、评论和互动不是真实的，那么能让用户信任的社区就无法建立。

После долгих лет ожидания владельцы ARM64-устройств получат Chrome с синхронизацией, сервисами и привычной экосистемой

The AppsFlyer Web SDK was temporarily hijacked this week with malicious code used to steal cryptocurrency in a supply-chain attack. [...]

На кону оказалась репутация, которую бренд бережно выстраивал больше ста лет.

全同态加密（fully homomorphic encryption，FHE）允许对密文进行特定的代数运算得到仍然是加密的结果，与对明文进行同样的运算再将结果加密一样。这项技术可以在加密的数据中进行检索、比较等操作，整个处理过程中无需对数据进行解密。同态加密技术从根本上解决将数据及其操作委托给第三方时的保密问题。今天的文件通常是在传输和存储时加密，使用时解密，存在安全漏洞，FHE 可解决该问题。然而 FHE 在今天的普通 CPU 和 GPU 上执行运算的速度都非常慢，所需计算时间可能比直接处理解密后的数据要慢数千倍，甚至数万倍。创业公司和芯片巨头都在竞相推出 FHE 加速器。英特尔的方案就是 Heracles 芯片，使用 3 纳米 FinFET 工艺制造，相比其顶尖服务器 CPU 加速 5000 倍。在演示中，使用 Xeon 服务器 CPU 上执行一个 FHE 计算所需时间需要 15 毫秒，而 Heracles 仅只需要 14 微秒。Heracles 的核心是 64 个计算核心，排列成 8×8 的网格。计算核心旨在并行执行 FHE 计算中的多项式运算、数据处理等操作。

2026年3月11日，美国参议院老龄问题特别委员会召开了一场关于“外国依赖：我如何控制美国药品供应链”的听证

美国在全球拥有众多军事基地，但官方往往对其分布讳莫如深，给调查带来挑战。

真菌对生命至关重要，但长期以来它们一直被忽视，直到现在。全世界的真菌种类至少有 220 万种，最多可能有 1200 万种，但只有 15.5 万种为人所知，大量物种未被发现和描述。2020 年畅销书《Entangled Life》作者、真菌学家 Merlin Sheldrake 在书中写道：没有真菌网络树就不会存在，没有类似的真菌网络任何植物都无法存在，包括人类在内的陆地动物都无法存在。真菌学家 Giuliana Furci 指出，每个生物体都依赖于一种真菌成分，它们是地球生命的基石。举例来说，内生真菌（Endophytic fungi）存在于几乎所有维管植物的细胞之间和内部，对植物的生长、抵抗力和生存至关重要。它们会释放天然抗生素分子，保护植物抵抗疾病侵害。它们帮助驱赶食草动物和昆虫。它们还能促进磷、氮等营养物质的吸收，改善水分保持，帮助植物忍受压力。真菌对数量庞大的产品至关重要，包括青霉素、氨苄青霉素、他汀类药物和抗真菌药物等药品，以及营养保健品、发酵食品、奶酪、啤酒、葡萄酒、烈酒、色素、化妆品和肥料。近期的一篇论文估计，所有类型真菌的价值接近 55 万亿美元。真菌学家称真菌为生态系统工程师，多项研究表明，约八成的陆生植物物种与真菌存在共生关系。研究人员估计，菌根每年在土壤中固碳 130 亿吨，这一数字相当于全球化石燃料排放量的三分之一。

A vulnerability classified as critical was found in TRENDnet TEW-632BRP 1.010B32. This affects an unknown part of the file /ping_response.cgi of the component HTTP POST Request Handler. The manipulation of the argument ping_ipaddr results in stack-based buffer overflow. This vulnerability was named CVE-2026-4172. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-4171. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.