Aggregator

Key Takeaways●  Clean core extensibility is when we, as a design choice, decide to go that way per u

A vulnerability, which was classified as problematic, was found in authlib joserfc up to 1.7.4. Affected by this vulnerability is the function joserfc.jwe.decrypt_json of the file joserfc.jwe of the component Recipients Array. Such manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-119283. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability classified as critical has been found in Google Chrome. This vulnerability affects unknown code of the component DOM. Performing a manipulation results in memory corruption. This vulnerability is known as CVE-2026-119267. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Google Chrome. The affected element is an unknown function of the component Blink. The manipulation results in use after free. This vulnerability was named CVE-2026-119269. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Vulnerability / Web SecurityA malicious ChatGPT share link could run an attacker's code in the log

Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed.

The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.

前言欢迎来到「本月玩什么」，本栏目将从作者个人角度出发，独立挑选一些本月新发售的游戏作品/内容做简要介绍、评论，不保证收录覆盖面，且并非每一款都是笔者推荐游玩的，主要涵盖 PlayStation、Xb

Temporarily busy

Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI […]

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. [...]

本文记录了针对已归档 Python 包 langchain-experimental 的代码审计过程。在该包的 PythonAstREPLTool 组件中，发现其对大模型（LLM）输出内容的过滤机制较弱，且直接使用 exec/eval 执行输入。结合平台判定与最新下载量数据，本文客观分析了该组件在现阶段（已停止维护）存在的安全风险及修复建议。

France's potential role in AI rests on its ability to organise a chain of capabilities. Model develo

Threat Intelligence / Network SecurityThreat actors are launching about 8,226 network-layer distri

The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.

DuckDB vs Polars 对比性能对比具体数据记忆使用编程范式对比DuckDB（SQL 优先）Polars（DataFrame 优先）使用场景推荐Polar

环境异常 当前环境异常，完成验证后即可继续访问。 去验证