Posts of last few hours

Microsoft Releases Emergency Patch to Fix RDS Vulnerability
Microsoft has been forced to issue an out-of-band fix for several issues stemming from this month’s Patch Tuesday
https://www.infosecurity-magazine.com/news/microsoft-releases-emergency-patch/
Akuity gives AI agents operational context to safely ship software

Akuity has introduced its Agentic Control Plane and MCP Server. Akuity’s Agentic Control Plane lets AI agents accelerate software delivery by giving them the operational context and permissions to act, all governed by the same controls Akuity already enforces across the pipeline. That governance is what gives engineering leadership the confidence to let agents into production, with real control over what agents can touch. Agentic engineering is driving teams to write more code than ever … More →

The post Akuity gives AI agents operational context to safely ship software appeared first on Help Net Security.

https://www.helpnetsecurity.com/2026/09/15/akuity-agentic-control-plane/
Root из ничего. Исследователь показал универсальный взлом флагманов Samsung, Xiaomi, Oppo и OnePlus
Защита Android не спасла флагманы от полного захвата системы.
https://www.securitylab.ru/news/577409.php
Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy send path. This vulnerability could let an unprivileged local attacker gain root privileges. It is tracked as CVE-2026-43502 and is referred to as “ZcopyReaper.” NebuSec researcher Yuan Tan reported the issue in a disclosure […]

The post Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

https://gbhackers.com/linux-kernel-zcopyreaper-vulnerability/
诚邀渠道合作伙伴共启新征程
https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247537496&idx=2&sn=fb35a0a25037c93f6159f0129c4df3fe
采购文件暗藏杀机——PureRAT木马针对电商定向窃密
采购文件暗藏杀机——PureRAT木马针对电商定向窃密
https://mp.weixin.qq.com/s?__biz=MzI3NjYzMDM1Mg==&mid=2247537496&idx=1&sn=8d47c16e350caf59e3306701ea2a21c8
美国军方首次证实在太空部署了武器
美国空军部长 Troy Meink 周一在 Air and Space Forces Association 的《Air, Space & Cyber Conference》会议上首次公开宣传，美国已在轨道上部署了太空控制武器。他没有披露太空武器的任何细节，但披露其存在这一事实，凸显了五角大楼在轨道战思维上的重大转变——直到几年前，还没有任何美国军方高级官员愿意公开讨论这一话题。如今军方官员已开始公开讨论轨道作战、卫星防御性反制措施，以及一种旨在瘫痪敌方在轨卫星的新型陆基武器。Meink 也未说明这些太空武器是何时部署的。

https://www.solidot.org/story?sid=85382
《AI 时代，白帽进阶：补天沙龙成都站议题精华抢先看!》
https://mp.weixin.qq.com/s?__biz=MzI2NzY5MDI3NQ==&mid=2247511045&idx=1&sn=9ef0ff8a0241ce57b4a196a8fbcecff7
Hive0117 вооружилась FMVT RAT и устроила бизнесу месяц дорогих атак
Группировка провела около 100 успешных взломов со средним ущербом 10–12 млн рублей.
https://www.securitylab.ru/news/577407.php
Cyclops Blink 卷土重来：沉寂四年后再升级，Sandworm 模块化植入体现身 Cisco 防火墙管理中心
Cyclops Blink沉寂四年后再升级：新增主动网络扫描与可编程数据包监控两大模块，从“针对特定防火墙品牌的定向工具”演变为“面向任意 Linux 网络边界设备的通用情报收集平台”。
https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247520420&idx=1&sn=fa97b272ba8e38d318ef6721a59c5b10
Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps
A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak. Security researchers Denis and Aleksander Rostilov of ExPatch found a stored cross-site scripting flaw in the […]
https://securityaffairs.com/199076/security/telegram-desktop-flaw-could-turn-old-chat-exports-into-data-theft-traps.html
Cisco patches Secure Email Gateway zero-day exploited in attacks
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]
https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/
科学家演示水下太阳能电池
西南联合研究生院与云南大学研究员研究员张文华与合作者研究表明，太阳能电池可在南海海面下 10 米处正常运行，可在水下工作两小时，可产生 324 兆瓦时的电能，足以给锂离子电池充电；若持续置于 10 米水深的环境中，其运行寿命可达约 5.5 年。这些发现表明，水下太阳能电池有望为远离陆地的水下传感器、摄像头和通信系统提供动力。尽管太阳能电池早已能够为陆地上的各类技术提供绿色能源，但由于阳光在水下短距离内就会迅速衰减，研究人员一直难以在海底收集太阳能，用于水产养殖监测及其他用途。为克服这一难题，张文华团队首先开发了一套定制化的实验室系统，配备定制的光学滤光片，以模拟不同水深下的光照条件。研究人员开发的高效宽能带隙浸没式太阳能电池，能够吸收从蓝光到橙光的光谱。将电池在充满氮气的手套箱中储存 300 天后，其效率仍保留了初始值的约 96%。此外，在模拟 10米 水深条件下运行 1160 小时后，电池几乎未出现性能衰减，表明其在水下具有卓越的耐久性。研究团队将钙钛矿太阳能电池与水下机器人集成，并将其部署在南海涠洲岛附近 10 米水深处，以测试其实际应用性能。

https://www.solidot.org/story?sid=85381
37 молекул и 900 манипуляций за 25 часов. ИИ в одиночку построил работающую кристаллическую решетку
Алгоритм впервые взял на себя почти всю атомную сборку от поиска деталей до проверки результата.
https://www.securitylab.ru/news/577378.php
Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk
Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11. Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public […]
https://securityaffairs.com/199090/security/non-zero-day-vpn-flaw-left-japan-government-shared-network-platform-exposed-246000-records-at-risk.html
直播预热：ASIC芯片的硬核极致打磨之路
网安圆桌派|山石芯声系列 第三期 匠心铸芯·安全落地 山石网科ASIC芯片的硬核极致打磨之路
https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247543905&idx=2&sn=cf9b292b35fc2a72b1272f920049f4ac
Debian 13.7 修复 92 项安全公告涉及问题，更新 106 个软件包
Debian 是全球最具影响力的开源 Linux 发行版项目之一，一口气更新106个软件包。
https://mp.weixin.qq.com/s?__biz=MzkxNzA3MTgyNg==&mid=2247543905&idx=1&sn=074bf9ce52a52f1aa52fa2cf51d0bccc
Steam Frame 起售价 1059 美元
Valve 正式发售了新 VR 设备 Steam Frame，即日起开放排队预购，起售价 1059 美元（捆绑《Half-Life: Alyx》）。Steam Frame 重 440g，其一大创新是后置的电池模组与前置的镜片模组分离，用户体验到的前部重量感要轻得多，整个设备的重量主要集中在脑后面的电池上，这一设计的缺点是如果用户想要头向后靠在头枕上，那么电池可能会成为障碍。Steam Frame 运行基于 Arch 的 SteamOS 3，桌面环境是 KDE Plasma，它是一款 Linux VR 设备。

https://www.solidot.org/story?sid=85380
ИИ окончательно разрушает «безопасность через неясность»
Секретная архитектура больше не спасает системы от чужого анализа.
https://www.securitylab.ru/news/577366.php
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned in an advisory published on September 14. On such servers, many customers' sites run on a single machine, and an attacker with one of those hosting accounts could exploit the flaw to access or alter other sites and the server itself,
https://thehackernews.com/2026/09/litespeed-enterprise-flaw-could-let-one.html

Managed ad