Recherche, sujets (tags des flux RSS), favoris et filtres de contenu.
Sujets les plus fréquents des 3 derniers jours. Un article doit porter tous les sujets choisis.
304 articles conservés pour « security »
As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix. The PHP Foundation on Friday told The Register that it…
Remember Popcorn Time , the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA's least-favorite app of the 2010s has been abandoned for years , but the "Netflix of Piracy" software is still installed on millions of…
The New York Knicks organization sent employees a phishing email promising free championship rings in a test of its staff's ability to detect scams, The New York Times reported yesterday. “Congratulations, your Employee Championship Ring is here,” the email sent in late…
Online accounts contain some of our most valuable personal information, from private messages and photos to financial details and work documents. Losing access to an account can be stressful, but a few simple security habits can significantly reduce the risk. Here are ten…
A backup plugin with wrong file permissions turns shared hosting into root CVE-2026-87886 is a local privilege escalation caused by insecure file permissions in Acronis backup integrations for three hosting control panels. NVD records a CVSS 3.0 base score of 7.8 with the vector…
🚨 PHP2SHELL: STOP SPREADING MISINFORMATION ABOUT PHP! Recently, there's been a lot of discussion about the critical PHP2Shell vulnerabilities, and unfortunately, some people are spreading fear and misinformation. I've seen statements suggesting that PHP is no longer secure,…
Originally published at hamzaahmadaslam.com . How this article was made: drafted with AI assistance from a researched brief, then checked against primary documentation before publishing. The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23…
Encryption hides what a message says. Steganography hides the fact that there's a message at all. I'm Muhammad Ali Mughal, and I built PixelValut , a browser-based tool for hiding text inside images. While building it, I learned that most people get two things wrong about…
Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.
Coolify: 70,210 titles against 3 fingerprints, and the port that explains the gap Self-hosted platforms that deploy other software hold deploy keys, environment variables, and database passwords. Coolify is one of them, and its public footprint on 23 October 2026 produced the…
On October 22, 2026, 1Password announced 1Password for Agents , a way for AI agents to sign in to websites on a user's behalf without the credential ever passing through the agent. How the flow works, according to the announcement: Explicit approval: when an agent hits a login…
Two security events landed side by side this week, PHP2Shell and the eMudhra certificate compromise. Both reached the same place, the foundation their applications are built on. PHP2Shell is a pair of critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619.…
Workflow write access is secret read access whenever the workflow you can write executes with access to those secrets. That condition is the whole argument, and it is narrower than the headline. Someone who can change a workflow file does not automatically hold every repository,…
An AI coding agent can read a repository, run shell commands, install packages, and send network requests. That is useful until a tool call reaches the wrong file, leaks a token, or downloads code that behaves differently than expected. Two projects now aim to put a boundary…
Автор: Александр Зайцев, директор по развитию ГК «Умные решения» Российский ИТ-рынок в 2026 году отказался от культа технологий. Компании больше не вкладываются в оборудование, облака, киберзащиту и ИИ как в самоцель. Им нужны надежность, рост эффективности и гибкость. Поэтому…
You know the experience: you sign up, switch to your inbox, refresh twice, finally see the verification email... and discover the link has expired. It's frustrating because the product is telling you to complete a task and then punishing you for not completing it quickly enough.…
OpenAI explains how we strengthened containment for frontier model training and evaluation, including offline environments and high-compute red-teaming.
AI Governance Frameworks: NIST, ISO, EU AI Act & More Compared Dev Stack Hub Dev Stack Hub Dev Stack Hub Follow Oct 22 AI Governance Frameworks: NIST, ISO, EU AI Act & More Compared #discuss #ai #security #devdiscuss 11 reactions Add Comment 12 min read
Recent cybersecurity reports made this question much more real. Major U.S. banks are now reportedly detecting unauthorized third-party AI agents inside customer accounts, with some agent activity appearing to go beyond the user's original instructions. That exposes a fundamental…
The Definitive Guide to JWT Security in 2026: HS256 vs RS256 vs ES256, The alg: none Exploit, kid Parameter Attacks, and Token Rotation Architecture JSON Web Tokens (RFC 7519) are the de facto industry standard for stateless identity assertion, powering microservice…
Five NGINX CVEs are conditional. Here is how to measure the conditions, not just the version NGINX 1.31.7 and 1.30.6 fix five defects, and every one of them requires a particular directive to be active. For an exposure assessment, that is a gift: the vulnerable population is…
This is article 2 of 10 in Beyond Kubernetes Defaults . Read article 1: When Kubernetes Primitives Aren’t Enough first. This article is cross-published from Zen Mesh . Kubernetes already garbage-collects resources. That makes “we built a Kubernetes garbage collector” sound…
Two critical PHP bugs came out this week. Both can let an attacker run code on a server. No login needed. Today I got an email from Hetzner. The message was simple: you run your own server, so the update is your job. So I checked my own setup. My sites run WordPress on managed…
Smart Contract Vulnerability Surface Analysis: Bitkub Target Protocol : Bitkub (TVL: $1480.6M) Smart Contract Vulnerability Surface Analysis Protocol: Bitkub – Decentralised Finance (DeFi) Platform TVL: ≈ $1.48 B (Ethereum + Layer‑2) Date: 22 Oct 2026 1. Executive Summary Bitkub…
On October 21 and 22, I spent two long days patching our own servers. PHP had announced an emergency release for two critical remote code execution bugs, now known as "PHP2Shell". We run seven RunCloud servers with about 30 WordPress sites, and several of them are on PHP…
Researchers have developed a new exploit that shows how even Address Space Layout Randomization (ASLR) on an x86-64 server cannot stop the PHP2Shell vulnerability. VulnCheck, which made it available to only the company’s Initial Access Intelligence customers, also warned that…
eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business. V. Srinivasan, chairman of India-based…
GitLab on Wednesday patched a maximum-severity flaw that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. Affected software releases date back a full 12 years - so upgrade to a fixed version now. The integer…
Summary On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 , commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back…
As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team is excited to spotlight another top-performing security researcher from the GitHub Security Bug Bounty Program: @r31n ! As home to the world’s developers, GitHub is dedicated to the security and reliability…
Short answer The IBM Granite Guardrails Catalog comprises 10 officially published, production-ready AI safety guardrails—developed and maintained by IBM—for detecting and mitigating risks in generative AI outputs. These guardrails are open, auditable, and designed for…
After embarrassing reports revealed weak private keys, one of which was just a single digit, Indian certification authority eMudhra has decided to take the L and get out of the global SSL/TLS cert game entirely. eMudhra announced Thursday that it was abandoning that arm of its…
Hackers attempted to exploit the PHP flaws impacting sites across the web days before they were patched, according to a report from Amazon Threat Intelligence . CJ Moses, Amazon chief information security officer, writes that the company's security team found a PHP2Shell exploit…
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. The figures were disclosed in the House of Lords on Thursday, where…
As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins. — Armin Ronacher Tags: security , generative-ai , armin-ronacher , ai , ai-security-research , llms
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday…
Most small-business websites don't go down because of a clever attack. They go down because of something boring that nobody was watching: a certificate that expired on a Sunday, a domain renewal that failed because the card on file changed, or invoices that land in spam for…
Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger . By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including…
In a world full of cyber risk, account takeover has emerged as one of the most insidious of all threats. If an attacker can successfully compromise a legitimate email account, they are then able to pose as a trusted individual or organization without triggering any warnings.…
TL;DR what: The private keys for eight eMudhra emSign intermediate CA certificates were generated with too little randomness, so anyone could compute them from the public certificates. impact: Anyone holding the keys could issue TLS certificates for any website, or code-signing…
An agent that can reach a real system usually carries that system's key, and the key outlives every rotation policy you wrote. This article builds the opposite: an operations assistant that reaches an order service, a ticketing function and a CRM through one AgentCore Gateway,…
The connector page says Connected . The collector VM is running. The Azure Monitor Agent (AMA) is installed. And CommonSecurityLog is as empty as an office on a Friday afternoon. Or worse, every event shows up twice. Rebuilt in my lab tenant with made-up data, checked against…
Defender for Cloud has a lot of plans. Every plan has its own toggle, its own scope rules and its own idea of who's allowed to touch it. My readiness notes for this topic were mostly question marks. So I did what I always do: rebuilt it in my lab and checked every answer against…
The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.
1Password is introducing a new feature that allows AI agents to sign into your accounts without actually seeing or handling your passwords. The aptly named 1Password for Agents doesn't give bots free reign to access all of your connected accounts - you'll still need to grant…
On a KVM host that attaches guests through virtio-net, the host networking stack is part of the guest isolation boundary, whether or not the isolation design drew it that way. CVE-2026-99999, published on October 15 and fixed upstream in commit 6785011f8b16, is the clearest…
On October 21, 2026 the PHP project shipped emergency releases for two critical remote-code-execution bugs in the language runtime itself. The headline most outlets chose is "AI found it". The more useful part is what the PHP Foundation says about why it took so long to fix.…
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday. The hijacking began in late August, when, according to Tor volunteers , the…
China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing…