Recherche, sujets (tags des flux RSS), favoris et filtres de contenu.
Sujets les plus fréquents des 3 derniers jours. Un article doit porter tous les sujets choisis.
304 articles conservés pour « security »
Windows Server 2016 sits on the 14393 build family, and that number never moves. A machine patched last week and one that has been untouched since 2017 report the exact same build — which is why "what version are we on?" is the wrong first question. Before a migration plan can…
Disclosure: this account is run by members of the VIDRAFT team, and the work discussed below is VIDRAFT's own result. It is not an independent review. TL;DR Adapting a model usually means sending data to rented GPUs. VIDRAFT pretrained a 325M model from scratch on a Rebellions…
ISC2 offers two certifications that people often weigh against each other: Certified in Cybersecurity (CC), its entry-level exam, and the CISSP, its certification for experienced security leaders. They use the same adaptive exam style, but they sit at opposite ends of a security…
Security Audit Report: Reentrancy & Access Control Review: Gate Target Protocol : Gate (TVL: $7468.0M) Security Audit Report – Reentrancy & Access‑Control Review Protocol: Gate (TVL ≈ $7.47 B across Ethereum + L2s) Audit Window: 2024‑10‑01 → 2024‑10‑20 Auditors: Senior DeFi…
Managing user data deletion requests for an OAuth integration backed by key-value storage requires clear boundaries between what your application controls and what belongs to the external provider. When a user or platform requests data removal, developers must coordinate local…
Security Audit Report: Reentrancy & Access Control Review: Bitget Target Protocol : Bitget (TVL: $6870.0M) Security Audit Report Reentrancy & Access‑Control Review – Bitget Protocol: Bitget (TVL ≈ $6.87 B on Ethereum & L2s) Date: 26 Oct 2026 Prepared by: [Your Name] – Senior…
Design trade-offs from building a guarded banking assistant on MCP Here's the 5½-minute walkthrough, with live attacks: Most chat assistant demos let the model act. Ask it to send money and it calls send_money . That's a fine demo and a poor design for anything that matters. A…
On Monday, October 20, 2026, the secret got out early. Details of two critical PHP flaws leaked before the planned disclosure. The PHP team moved its security release up a day and shipped the fixes on Wednesday, October 21. That rushed week has a name now: PHP2Shell. It is not a…
Oracle Manipulation Risk Report: Uniswap V4 Target Protocol : Uniswap V4 (TVL: $1534.9M) Oracle Manipulation Risk Report – Uniswap V4 Protocol: Uniswap V4 (TVL ≈ $1.534 B across Ethereum L1 & L2s) Date: 25 Oct 2026 Prepared by: Senior DeFi Security Researcher – Smart‑Contract…
Security header checkers hand out letter grades, and it is tempting to read a low grade as an SEO problem. Mostly it is not. As far as Google has published in Search Central, HTTP security headers are not direct ranking signals. But a few response headers do change how crawlers…
If you built your app with Lovable, Bolt, Cursor or another AI tool, here's a question worth asking before you share it: can people see your source code? Short answer: some of it, always. Most of it, if you ship source maps. Your front-end code is always public Every web app…
Darkwaar40 — Breach commence avec trois portails ouverts. Situés à la périphérie d’un donjon circulaire, ils font sans cesse apparaître des entités hostiles : des logiciels malveillants courants, des exploits plus rapides et des failles « zero-day » plus tenaces. Au centre se…
When an Ethereum private key or seed phrase leaks, automated sweeper bots monitor the address and drain any incoming ETH within milliseconds—long before you can broadcast a standard transfer or revoke transaction. Since the May 2025 Pectra upgrade ( EIP-7702 , transaction type…
The Plex transcode path that accepts arbitrary hosts, and what that means for internal networks Transcoding is the busiest part of a media server, and it is also where Plex Media Server before 1.43.3.10861 accepts a host the caller chooses. CVE-2026-96655 records that an…
Protocol Upgrade Compatibility Review: EigenCloud Target Protocol : EigenCloud (TVL: $6109.2M) EigenCloud Protocol Upgrade Compatibility Review TVL: ≈ $6.11 B (Ethereum + L2) Date: 25 Oct 2026 Prepared by: [Your Name], Senior DeFi Security Researcher & Smart‑Contract Auditor 1.…
Still maintaining legacy PHP applications? I built php2shell-migration , an open-source AI agent skill that helps developers modernize outdated PHP apps more safely. 🔗 GitHub: https://github.com/Ademking/php2shell-migration Why I built it PHP2Shell is the name for two critical…
Connecting to guest Wi-Fi networks in hotels, cafes, and offices has become ubiquitous through Wi-Fi QR codes. However, standard smartphone cameras often parse these codes silently without displaying the raw credentials, and many mobile scanning apps aggressively monetize or…
Security headers are the cheapest hardening a website can get: a handful of response headers that tell the browser to stay on HTTPS, refuse to run injected scripts, refuse to be framed by another site and stop guessing content types. They're also easy to forget, and they quietly…
Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action. Seven agents were hit, including Claude Code, Cursor, and Codex. Eight findings. Four were…
Governance Attack Surface Review: Bitkub Target Protocol : Bitkub (TVL: $1463.9M) Governance Attack Surface Review – Bitkub Protocol: Bitkub (TVL: $1.463 B on Ethereum & L2) Date: 24 Oct 2026 Prepared by: [Your Name], Senior DeFi Security Researcher & Smart‑Contract Auditor 1.…
Originally published at scouthub.dev . LinkGuard is a tool for checking suspicious links before you open them. You paste the link, and the tool follows the chain of redirects behind it, asks five global threat-intelligence sources at the same time, then gives you a risk score…
Book: Prompt Engineering Pocket Guide The series: Pocket Guides for Developers — 8 short books on agents, RAG, prompts, observability, events, databases and system design — the whole series My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and…
The moment you realize the internet is "held together by glue and dreams."
Every month you patch, rescan and send the client a report. And every month the report shows a long list of what is still wrong, while the work your team did is invisible. Proof of fix changes that. Varaxon Scan Hub reports now open with a Since the last scan section that names…
I was halfway through a coffee yesterday evening when the PHP security advisory landed in my feed, and the coffee did not survive the next ten minutes. Two critical remote code execution bugs, unauthenticated, and the PHP team's own wording was "update immediately". No "consider…
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet — and it's unlikely to be the last major software scare.
Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path Two Ivanti advisories landed in October 2026 that an appliance owner should read as one package, even though they concern different products. CVE-2026-111357 concerns Ivanti Connect Secure…
Four of the most-used stacks on the internet got hit in the same week . PHP, Node.js, GitLab and LiteLLM all shipped critical fixes or suffered a serious incident between Oct 12 and Oct 22, 2026 . If you run a PHP site, a Node.js backend, a self-hosted GitLab or anything that…
Crims built an AI agent designed to hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval. The Symantec Threat Hunter Team uncovered the agent's full instruction set over the summer, trapping it…
Key takeaways Set a non-root numeric USER; container root is one bug from host root. Deleting a secret in a later layer doesn't remove it; use BuildKit secret mounts. Pin base images by version and digest, and install from lockfiles. Never pipe curl into a shell; verify…
Book: Prompt Engineering Pocket Guide Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools Me: xgabriel.com |…
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
The vulnerability scanner stores what it finds ZoomEye returned 15,868 matches for app="Nessus" and 17,876 for title="Nessus" on 23 October 2026. The title search found more hosts than the application fingerprint, which is the opposite of what a scan engine's own marketing would…
Before I pick up a question about an order, I'd want to see what we've told the customer so far. I wouldn't want to ask the customer for something they've already sent. The message in front of me might be their second or third attempt to get an answer. I'd want the assistant to…
AI agent workspace isolation doesnt have to be complicated. Sometimes the simplest solution is the best. The drive letter approach Map a folder to a drive letter. That drive is the agents entire world. Why it works Windows enforces the boundary Every tool understands drive…
I built TenantLint, an open-source Roslyn analyzer that catches cross-tenant data leaks in .NET at build time: in your IDE, in CI, and inside your AI agent's build loop. The most dangerous bug in a multi-tenant SaaS doesn't crash anything. There's no exception, no failing test,…
Q1 (web flag): THM{ok_you_f0und_w3b_fl4g_6cbe2bc} Q2 (encryption key): THM{Traditional_Own_Crypto_is_Always_Surprising!_and_this_hopefully_is_not_easy_to_crack_e41d20b5b0989cac65ed4a090cace944bf30e6d3ab88f9d447f52fd2140525b9} A PHP app rolls its own "military-grade" cookie…
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady This month already has a name: Black October . In three weeks, npm releases shipped with malware (one of them a worm), a poisoned LiteLLM release on PyPI carried a credential stealer, and…
AI agents are moving beyond simple chat interfaces. They can interact with APIs, use tools, process sensitive information, and execute multi-step workflows. But as their capabilities grow, so does their attack surface. For developers building AI-powered applications, security…
OpenAI's Agents Escaped Their Sandboxes. Here's the Containment Checklist I'm Stealing for My Own Agents. OpenAI just admitted its AI agents broke out of test environments — repeatedly — and that its most powerful models now train with zero internet access. The wildest detail:…
โดย Nokka (นก-กา) | ตอนที่ 7 จาก 7 ของชุด "สร้างซอฟต์แวร์ด้วย AI" | ตรวจสอบข้อมูล ณ 23 ต.ค. 2026 บทความนี้เขียนโดย AI (deepseek-v4.1-flash · ผู้ให้บริการโมเดล: ollama-cloud) ผ่าน Hermes Agent ภายใต้การควบคุมและตรวจสอบคุณภาพโดยมนุษย์ - Nokka (นก-กา)…
A public DNS resolver can look like a tiny settings change: replace one IP address with another and get on with the day. But the resolver is also a policy decision. It can validate DNSSEC, block domains classified as malicious, filter other categories, or resolve names without…
An expired SSL certificate is one of the most avoidable outages on the web. The site is fine, the server is fine, but every visitor gets a full-page browser warning and most of them leave. Less dramatic certificate problems, like a missing intermediate certificate, are worse in…
You build a Slack agent that pulls GitHub issues, creates Jira tickets, and sends Stripe invoices. Ten people use it. Each person signs in with their own account. The agent uses a single service credential. Who is allowed to see which issues? Who can create invoices? When the…
Signature-based detection has an obvious weakness against adware: the families rebuild constantly. A new package name, a new signing key, a slightly different payload, and the app is "unknown" again. Meanwhile the user is still getting a full-screen ad every few minutes. While…
Autonomous DevOps is an operating model in which agents continuously observe cloud and pipeline telemetry, decide what needs changing, and act inside declared boundaries without a human approving each instance, while the system stays observable, auditable and reversible. Humans…
A canary credential, or AWS honeytoken, is a real AWS access key that can do nothing and that nobody legitimate will ever use. You plant it where an attacker looks for credentials. When someone uses it, CloudTrail records the call and you get an alert that carries very little…
Originally published at GeekCoding101 . Reverse Engineering Meets AI Reverse engineering is slow, careful work. You open a stripped binary in Ghidra , stare at FUN_100000db8 , read the decompiled C, guess what it does, rename it, add a comment, and repeat a few hundred times.…
A face-recognition gate I built rejects printed photos, screen replays, and looped video. Last night I found out it was doing it for the wrong reason, and the wrong reason looks identical to the right one from the outside. Here is the whole thing, measured. The gate Two…
On October 21, Node.js shipped security releases for a flaw that deserves your immediate attention: CVE-2026-111497 , nicknamed Node2Shell . It is an out-of-bounds write in the Brotli decoder bundled with Node.js, scored 9.2 Critical under CVSS v4.0. One day after disclosure,…