Aggregator

A vulnerability classified as critical was found in headroomlabs-ai Headroom up to 0.34.x. The affected element is an unknown function of the component WebSocket Server. Executing a manipulation of the argument Origin can lead to improper authentication. This vulnerability is registered as CVE-2026-71416. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Threat actors are abusing trusted AI platforms to host malicious content, poison search results, and trick users into installing malware. Huntress examines campaigns targeting AI users through weaponized Claude Artifacts, shared AI conversations, sponsored search results, and ClickFix-style lures. [...]

Режим для тестирования приложений превратился в удобное укрытие от недовольных пользователей.

A vulnerability classified as critical has been found in Perforce Akana up to 2024.1.5/2025.1.1/2026.1. Impacted is an unknown function of the component JSON Handler. Performing a manipulation results in xml external entity reference. This vulnerability is cataloged as CVE-2026-89212. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen up to 4.2.0. This issue affects some unknown processing. Such manipulation leads to argument injection. This vulnerability is listed as CVE-2026-11765. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Red Hat Keycloak and Single Sign-On. This vulnerability affects unknown code of the component Dynamic Client Registration Service. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2026-89298. The attack is possible to be carried out remotely. No exploit exists.

A large email fraud campaign used fake CEO messages and invoices to push employees toward payments of nearly $50,000. The operation did not rely on a malicious attachment or software flaw. Instead, it used ordinary email to deliver a scam. The attackers sent over one million messages to users between August 3 and 5. Most […]

The post Hackers Impersonate CEOs in 1 Million Emails to Trick Employees Into $50,000 Payments appeared first on Cyber Security News.

Участник одной из самых прибыльных вымогательских операций хранил данные 12 жертв и писал вредоносный загрузчик.

KnowBe4 researchers observed a new phishing campaign leveraging Microsoft 365’s Direct Send to send malicious emails

Исследователи превратили интерференцию на поверхности воды в вычислительную систему для объезда препятствий.

Microsoft’s September 2026 security update KB5124008 is knocking some Windows 11 enterprise clients off Always On VPN after the Patch Tuesday package landed on September 8. Administrators who can reproduce the failure say certificate-based tunnels that worked immediately before the patch stop connecting afterward, then recover as soon as the cumulative update is removed and […]

The post Windows 11 Security Update KB5124008 Breaks Always-On VPN Connections appeared first on Cyber Security News.

月满中秋，桂香满怀。值此团圆佳节，VSRC 向每一位守护网络安全的白帽子道一声感谢——感谢你们一路以来的支持与陪伴。

A vulnerability labeled as critical has been found in Progress Chef Automate up to 4.13.515/4.13.519. This affects an unknown part of the component API Gateway. The manipulation results in improper privilege management. This vulnerability is identified as CVE-2026-80462. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention.

今年教师节，没写人民教师issy的段子，补个短的。

《BMJ Case Reports》报告了一起奇特的病例，一名儿童因腹部皮肤出现奇怪斑痕而送去急症。医生查找许久未发现病因，因此开了抗生素让他回家，叮嘱父母如果病情变化立即来复诊。两周后，这名儿童再次入院，他的病情出现恶化。皮肤斑块变大，颜色变深，且有触痛。这名儿童透露了一个情况，他是在家上学，经常使用笔记本电脑，他习惯将笔电放在腹部，有时一用就是八个小时，还经常在电脑充电时使用。医生终于明白了他的病因，诊断他患有 Erythema ab igne（EAI），也被称为烤肤综合征（toasted skin syndrome），一种因反复、长时间接触低强度热源而引发的皮肤病，多见于成年人，常见诱因包括因慢性疼痛使用电热垫或热水袋，以及长时间近距离靠近取暖器。EAI 发病机制不完全清楚，研究人员推测，长期受热会导致浅表血管受损及红细胞渗出，从而形成典型的红色网状斑纹。好消息是 EAI 是良性且可逆的，只要移除热源即可。其父母几个月后反馈称皮肤斑块消失了。