Aggregator

Anthropic trims action approval loop, lets Claude Code make the call

Help Net Security
2 weeks 1 day ago

Auto mode is a new permissions feature in the Claude Code system that allows the AI to make approval decisions on a user’s behalf while safeguards review actions before execution. The feature is available on Team plans and requires administrator approval before use, with support for Enterprise and API users expected soon. It runs on newer models such as Claude Sonnet 4.6 and Claude Opus 4.6, and excludes older versions and third party platforms. By … More →

The post Anthropic trims action approval loop, lets Claude Code make the call appeared first on Help Net Security.

Sinisa Markovic

Malicious LiteLLM versions linked to TeamPCP supply chain attack

Security Affairs
2 weeks 1 day ago
TeamPCP backdoored LiteLLM v1.82.7–1.82.8, likely via Trivy CI/CD, adding tools to steal credentials, move in Kubernetes, and keep persistent access. Threat actor TeamPCP compromised LiteLLM versions 1.82.7 and 1.82.8, likely through a Trivy CI/CD breach. LiteLLM, with over 95 million monthly downloads, helps developers route LLM requests via a single API. The malicious releases, now […]
Pierluigi Paganini

CVE-2026-32875 | UltraJSON up to 5.11.x on Python ujson.dumps integer overflow (ID 700 / Nessus ID 303240)

Vuldb Updates
2 weeks 1 day ago
A vulnerability was found in UltraJSON up to 5.11.x on Python and classified as problematic. Impacted is the function ujson.dumps. Executing a manipulation can lead to integer overflow. This vulnerability is handled as CVE-2026-32875. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-32811 | dadrus heimdall up to 0.17.10 Control Decision Service /mypath?foo=bar Query escape output (GHSA-r8x2-fhmf-6mxp)

Vuldb Updates
2 weeks 1 day ago
A vulnerability classified as critical has been found in dadrus heimdall up to 0.17.10. The affected element is an unknown function of the file /mypath?foo=bar of the component Control Decision Service. Performing a manipulation of the argument Query results in escaping of output. This vulnerability is cataloged as CVE-2026-32811. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-32873 | vshakitskiy ewe up to 3.0.4 handle_trailers expired pointer dereference (GHSA-4w98-xf39-23gp)

Vuldb Updates
2 weeks 1 day ago
A vulnerability described as problematic has been identified in vshakitskiy ewe up to 3.0.4. This affects the function handle_trailers. Executing a manipulation can lead to expired pointer dereference. This vulnerability is tracked as CVE-2026-32873. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-32881 | vshakitskiy ewe up to 3.0.4 set_header permissive list of allowed inputs (GHSA-9w88-79f8-m3vp)

Vuldb Updates
2 weeks 1 day ago
A vulnerability classified as problematic has been found in vshakitskiy ewe up to 3.0.4. This impacts the function set_header. The manipulation leads to permissive list of allowed inputs. This vulnerability is listed as CVE-2026-32881. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.
vuldb.com

火星首次发现红宝石

Solidot
2 weeks 1 day ago
美国洛斯阿拉莫斯国家实验室科学家首次在火星鹅卵石中发现宝石级矿物，其成分与地球上的红宝石相差无几。火星红宝石由名为刚玉的物质组成。刚玉的主要成分是氧化铝，硬度仅次于钻石。它本身无色透明，却因蕴藏不同元素而呈现不同面貌：混入微量铬，便成为艳丽的红宝石；含铁或钛，则成为深邃如海的蓝宝石；若不含致色元素，便是纯净的白刚玉。这些红色宝石，是“毅力号”火星车在探索杰泽罗陨石坑时意外发现的。在一次对名为“汉普登河”的岩石进行分析时，火星车搭载的激光仪器 SuperCam 使用了两种探测手段——用激光烧蚀岩石表层，或激发其发光，再通过两台相机捕捉光谱信息。两次检测均显示，其矿物成分与地球红宝石惊人相似，暗示其中可能藏有微小的刚玉颗粒。这是科学家首次在火星上发现宝石，其形成机制可能与地球截然不同。地球上，刚玉多与板块构造活动相关，需要低硅高铝的特殊环境。而火星并无板块运动，科学家推测，这些刚玉或由远古陨石撞击产生——在撞击瞬间，巨大热量与压力加热或压缩火星表面的尘埃，孕育出这些微小珍宝。

Managed ad