Aggregator

加州民主党议员 Josh Lowenthal 今年初提出了法案 Assembly Bill 1709，禁止 16 岁以下儿童使用具有成瘾设计的社媒平台。在听取反馈之后，Lowenthal 修改了其提案，改为禁止社媒平台使用具有成瘾性质的设计，而所谓成瘾设计包括了无限滚动的信息流、自动播放、推荐算法和推送通知等常见的社媒功能。Lowenthal 表示其提案的初衷不是阻止访问，而是阻止掠夺性行为。提案要求社媒公司在 2028 年前调整其平台。Lowenthal 在听证会上表示无限滚动等是产品功能而不是言论。

Что уже успел сделать легендарный марсоход и какое будущее его ждёт?

Many vulnerabilities cannot be safely validated with live exploits, either because no exploit exists or the affected systems are too critical to test. Picus explains how TTP chaining helps organizations determine exploitability by validating the attack techniques an exploit depends on, without launching the exploit itself. [...]

Dutch intelligence officials report that at least one Russian agency is compromising internet-connected cameras across Europe to spy on military logistics and Ukrainian personnel.

Cybersecurity researchers have disclosed details of two access control-related flaws impacting the RabbitMQ message broker service that could allow attackers to leak OAuth client secrets, expose enterprise messaging infrastructure to takeover risks, and bypass tenant boundaries. Miggo's security team, which discovered and reported the flaws, said one "leaks the broker's confidential OAuth

Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal passwords, Keychain data, and cryptocurrency wallets. The malware was first spotted in May while it was still under development. By early July, Jamf was seeing in-the-wild detections, indicating it had moved into active use. “Unlike much of the commodity stealer activity on macOS, which is built on AppleScript droppers or thin Objective-C wrappers, CrashStealer is … More →

The post New macOS malware steals passwords by posing as Apple’s crash-reporting tool appeared first on Help Net Security.

阿里云先知- AI攻防安全专家（P6/P7）

ai半自动化漏洞分析

2026polarctf夏季赛Escape, escape!特辑

一个AI客服的/debug接口泄露了K8s地址，model参数能当SSRF打，顺着捅到集群Secrets直接拿到凭证——两小时，从API到K8s。

Four AsyncAPI packages previously affected by the Shai-Hulud: The Second Coming campaign have been compromised again, with new malicious releases delivering a RAT-focused build of the Miasma worm. The impacted versions are @asyncapi/generator 3.3.13.3.13.3.1, @asyncapi/generator-components 0.7.10.7.10.7.1, @asyncapi/generator-helpers 1.1.11.1.11.1.1, and @asyncapi/specs 6.11.26.11.26.11.2 and 6.11.2−alpha.16.11.2-alpha.16.11.2−alpha.1. Unlike the prior Miasma activity, the AsyncAPI packages do not use malicious […]

The post Miasma Worm Returns as RAT-First npm Attack With Automatic Propagation Disabled appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Да-да, тот самый, что содержится в малине и киви.

Anthropic、Google 和 OpenAI 等 AI 公司高管以及经济学家和计算机科学家联署发表公开信，呼吁就 AI 对经济和就业的影响立即采取行动。公开信称：“未来 10 年 AI 可能会变得强大得多。可能推动经济发生前所未有的转变，其规模超越工业革命，但速度却快得多。这可能带来风险，包括大规模就业岗位流失，同时也可能带来机遇，比如生活水平的大幅提升。”联署人之一的 Yoshua Bengio 认为，“我们必须有意识的做出集体、民主的选择，而不是任由市场力量发挥作用，从而冒着让大多数公民被抛在后面的风险，AI 极有可能彻底改变我们的经济。”AI 最近一段时间引发了更多人的反感，因此也有很多人认为 AI 泡沫濒临破裂，利益攸关者可能不想让泡沫太早破灭。

Специалист объяснил, почему современные телевизоры блокируются из-за незначительных неисправностей подсветки.

When a failed DNSSEC key rollover took down the .al TLD, we deployed a Negative Trust Anchor to restore resolution. This time, though, clients didn't have to take our word for it: 1.1.1.1 returned EDE 33, a new DNS error code that signals directly in the response that DNSSEC validation was bypassed.