Recherche, sujets (tags des flux RSS), favoris et filtres de contenu.
Sujets les plus fréquents des 3 derniers jours. Un article doit porter tous les sujets choisis.
304 articles conservés pour « security »
A PDF has two layers. There's the one you see, and there's a text layer underneath it that software reads. Most of the time they say the same thing. However, nothing forces them to, and you can write text into a PDF that a person will never see and a program will read every…
21 October 2026 was a long day for security teams. PHP patched two critical vulnerabilities, Oracle issued an out-of-band alert for Java, Node.js closed ten vulnerabilities and Railway disclosed access to customer secrets. The day before, OVHcloud's command-line tool had been…
The Eiliko robot toy. | Photo by Sean Hollister / The Verge Eiliko, a cute robot charm you can hang on your bag with built-in AI conversations, turned out to be a security nightmare . It told owners that "your secrets are safe with me," but hackers could easily read complete…
Welcome back to PWNED, the column where we talk about companies and organizations that leave the doors wide open to attackers. This week’s sad story involves a major American pharmacy chain that couldn’t fill a prescription for password security. Have a story about someone…
TVL Trend Analysis & Liquidity Risk Assessment: Aave V3 Target Protocol : Aave V3 (TVL: $17046.1M) Technical Security & Audit Report TVL Trend Analysis & Liquidity Risk Assessment – Aave V3 Protocol: Aave V3 (Ethereum + L2s) – Current TVL: $17,046.1 M Prepared by: [Your Company…
I stopped treating controller middleware as the outer edge of a Laravel app after I mapped what actually happens to an HTTP request. Form Requests, CSRF tokens, authentication, policies, and the query builder all run after PHP has already accepted the connection. A web…
A Laravel application can validate input, escape output, and reject some bad requests inside controllers. That still leaves a gap. Hostile HTTP traffic reaches PHP before those checks run. If you are working through how to protect a Laravel app with a WAF, treat the job as a…
Indian certification authority eMudhra has defended the laughably weak private keys it used to sign some digital certificates it issued, and suggested others should share the blame for the incident. In case you’re coming to this one late, news broke yesterday that private keys…
TL;DR: PHP2Shell has been the target of widespread attack attempts since its disclosure on October 21, 2026, with first attempts seen as early as October 17 according to Amazon. A login does not protect you, and there are no official updates for PHP 8.1 and older. In industrial…
If you are moving AI agents from a toy script into production with enterprise clients, you quickly encounter a harsh reality: Traditional cybersecurity firewalls know nothing about probabilistic LLMs. When your agent has access to tools (like SQL databases, web scrapers, shell…
CCTV Storage Math: H.265+ Compression Ratios, Bitrate Bitmaps & NVR HDD Sizing By Gary Pearce — Lead Electronic Security Engineer at ADI Communications (Direct: 07860 244 274) When deploying a multi-channel 4K commercial or domestic CCTV system, sizing the NVR's surveillance…
The moment usually goes like this: a customer emails "can you sign our DPA and send your SOC 2 report?" — and everyone on the team goes quiet. Big companies answer that email with a compliance department and a platform that costs more than your server bill. Small teams answer it…
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.
I got sick of spinning up Burp plus a browser plus some SCA tool just to poke at my own stuff. So I shoved it in one box and made it free for personal use docker compose up -d You get a proxy, a Chromium already sitting on that proxy, and a request history. Paste a GitHub repo…
PHP2Shell, a pair of unauthenticated php remote code execution flaws in PHP's core, leaked online a day ahead of its planned disclosure, and PHP's own security team has confirmed that the interim workaround circulating since the leak doesn't actually close both bugs.…
While updating PHP packages on Debian 12 (Bookworm), I encountered this APT error: E: Release file for https://packages.sury.org/php/dists/bookworm/InRelease is not valid yet. At first, it looked like a problem with the PHP repository. However, the actual cause was the system…
Quando acessamos um site, nosso navegador pode compartilhar mais informações do que imaginamos. Sistema operacional, resolução da tela, idioma, fuso horário e até características da renderização gráfica são alguns exemplos. Individualmente, essas informações podem parecer pouco…
PHP developers have accused software supply chain security shop Chainguard of effectively revealing critical bugs in the open-source scripting language ahead of a planned official disclosure. On Wednesday, just hours after releasing emergency patches for the two bugs…
The Sqlmap tool is an open-source tool that automates SQL injection testing. It can handle what's done manually with a few commands. SQL injection: simply put, if a web application sends the input it takes from the user straight to the database without filtering it, you can…
When people talked about AI , the focus in most places was on things like model quality, speed, context window . As of today, the topics being discussed have changed a bit. Now these are the questions being asked more often: What does it have access to? What can it do on its…
Smart Contract Vulnerability Surface Analysis: Polygon Bridge Target Protocol : Polygon Bridge (TVL: $2713.6M) Polygon Bridge – Smart Contract Vulnerability Surface Analysis TVL (Ethereum + Polygon L2): ≈ $2.71 B Date: 21 Oct 2026 Prepared by: [Your Name], Senior DeFi Security…
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia , and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the…
Written by: Josh Greenwell Staff Applied AI Engineer This blog article is a condensed version of our whitepaper on securing AI agents against prompt injection. The full paper includes the appendices on prompt-injection defenses and the complete reference list. You can download…
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.
Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night,…
TVL Trend Analysis & Liquidity Risk Assessment: Uniswap V4 Target Protocol : Uniswap V4 (TVL: $1516.7M) Technical Security & Liquidity‑Risk Assessment Report Subject: TVL Trend Analysis & Liquidity Risk Assessment – Uniswap V4 Date: 21 Oct 2026 Prepared by: Senior DeFi Security…
Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and…
This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
Make sure you don’t say anything mean or secret after hanging up a call on Signal, as a bug in the encrypted messaging app’s calling library could prevent a call from ending properly, potentially leaving audio and possibly video active. The vulnerability, CVE-2026-113380, was…
Updated October 21, 2026: re-tested on the latest releases, Cursor 3.26.13 and Postman 12.33.2 (first tested on Cursor 3.1.15 and Postman 11.93.0). The results did not change. Three popular desktop apps run on the same framework, Electron, but lock it down very differently. On…
PHP developers have released emergency updates for two critical vulnerabilities after cybersecurity authorities warned organizations to patch immediately or consider taking exposed applications offline. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 address CVE-2026-109618 and…
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
OpenAI disclosed a pair of safety incidents that involved AI agents weakening their safety monitoring systems during internal coding tasks. In one incident, OpenAI says its GPT-6 Astra agent disabled its safety monitor when copying reference code - and then lied about it. "The…
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,” according to operational technology (OT) security…
This PHP issue sounds like a pretty huge problem. | Illustration by Carlo Cadenas / The Verge Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that…
The European Commission has opened an investigation under the Digital Services Act into whether Booking.com is doing enough to stop fraudsters running scams, phishing and smishing on its platform. Officials told The Register the probe, which opened Wednesday, covers a very large…
The solicitation The US Army has opened the solicitation for ECHOTRIBBLE, a framework of offensive autonomous agents (Source: helpnetsecurity.com, theintercept.com). The document describes what they do and it boggles the mind: they infiltrate, copy themselves to other machines,…
Three Ways Session-Key Modules Leak Permissions For teams shipping session keys, agent wallets, or any "limited" key that can move money: the policy is the product. These are the first three patterns I check in every review — because each one turns a carefully scoped session…
You connect your wallet to a decentralized exchange, approve a token, complete a swap, and leave the website. Everything seems fine, so you move on. But there is a detail many crypto users overlook: disconnecting your wallet from a website does not necessarily revoke the…
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.
The US Department of Homeland Security has formally ordered all federal civilian agencies to strip products developed by DeepSeek and its affiliates from their IT systems and to stop procuring DeepSeek technology, in the broadest government ban yet against a Chinese AI…
I have spent most of my career building financial systems: a multi-tenant SACCO platform, an insurance broker portal, POS software. None of that was "AI safety." But when I started wiring LLMs into document workflows, I noticed the threat model felt familiar. An LLM agent with…
Short answer: A phone left running as a camera keeps running on whatever the platform has changed underneath it. Unlike a Medicare plan, nothing mails you a letter listing those changes. Once a year, stand in front of the device and check five things: whether the camera…
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
Your AI feature works and the demo looks great. One question before you share the link: where does your AI API key live? If you built your app with Cursor, Claude Code, Lovable, Bolt, Replit or v0, there is a real chance the answer is "in the browser". That means anyone who…
Originally published on The Daily Flare . Key takeaways The OpenCode breach highlights the challenge of protecting AI tools while keeping them useful to defenders. Broad safety filters can block legitimate security work as well as harmful requests. Organizations still need…
Most small encryption tools fail in boring places, not in the cipher. They fail on what happens with a wrong password, a doctored header, a rolled-back state file, or a corrupted chunk. I spent a long time on those boring places for ATLOCK v5, and this post walks through the…
A GitHub Actions security gate for Node.js is a single workflow that runs on every pull request. It scans the new commits for leaked API keys, checks new dependencies for known vulnerabilities and confirms the lockfile is honest. If any of those checks finds something real, it…