Search
17 stories found
A logic flaw in how OpenSSH checks passwords on musl-based systems lets an attacker log into accounts that have no password by sending a very long one. OpenSSH 10.6p2 and Alpine's backported packages fix it; anyone running sshd on Alpine hosts or containers should update or switch off password logins today.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
DeepSeek's Harness team published an MIT-licensed research prototype that watches a GitHub repo, takes authorized requests and answers with pull requests. It passed 11,000 stars within days — but DeepSeek itself says it is not production-ready and runs with full user access.
Synology says attackers are exploiting a DSM flaw it patched in December 2024 to plant C3RB3R ransomware, which also encrypts backups on the same device. Researchers disagree about the entry point, so the safe move is the latest build for your DSM branch plus a few quick checks.
A CVSS 10 missing-authentication flaw in Siemens' SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is now being exploited, according to threat-intel firm VulnCheck. The attack is a single request to Node-RED's admin API, so any Node-RED instance left without a password is exposed in the same way.
NOIR, a new MIT-licensed desktop tool, scans an Android phone over USB debugging and links each app's sensitive permissions to the tracking and ad domains hard-coded in its code. It went from zero to about 1,800 GitHub stars in four days. It's a useful map of risk, but its findings show what apps can do, not proof of what they actually sent.
A plugin that watches what your agent does, compresses it into searchable memories in a local SQLite database, and feeds the relevant bits back into your next session. How it works and what to watch out for.
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
SonicWall disclosed two flaws in its Global Management System on November 3, including CVE-2026-109593, an unauthenticated file-disclosure bug rated CVSS 9.1. GMS reached end of support on September 30, and SonicWall says no fix will be released, so the only remedy is to isolate it and move to NSM.
The FBI says North Korea's TraderTraitor group stole more than $6 billion from Binance's hot wallets on October 29, likely the biggest crypto theft on record. Binance says it is covering the loss and has restarted withdrawals, while fake 'compensation' offers circulate.
Marvell agreed to buy optical-component maker Lumentum in an all-stock deal valued at about $115 billion, one of the largest tech acquisitions ever. The filing shows a $3.2 billion regulatory break fee and a close that could slip into late 2028.
Attackers are using a flaw in Cisco's Secure Firewall remote-access SSL VPN to reboot firewalls without logging in. Only devices with secondary authentication on a tunnel group are exposed, so a two-minute config check tells you how urgent this is.
agent-desktop, an Apache-2.0 Rust CLI from Vercel Labs, gives coding agents structured, ref-based control of native desktop apps without a vision model. It added about 2,300 stars in a day and was GitHub's top trending repo on November 3.
A detailed bug report shows Postman 12.33.4 auto-installed its AI agent plugins into Codex and Claude Code for an existing user, added a startup hook that steers API work through Postman, and ran installer code that pre-approves that hook. Postman says it will make opt-in clearer. If you use Postman and a coding agent, check four files.
CISA has added CVE-2026-97229 to its exploited-vulnerabilities list after an attack on Alpine Linux's GitLab server. The flaw lives in Ruby's regex engine, so self-built and custom GitLab images can stay vulnerable even on a "fixed" version number.
With the 27.3 betas, Apple opened a Siri AI Developer Preview that lets any app expose actions, content and multi-step "skills" to its new assistant. You can build and test now. You can't ship to the App Store until spring, iPhone users in the EU can't use Siri AI yet, and server-side usage has daily limits Apple hasn't quantified.
A CVSS 9.8 use-after-free in the kernel's IPv4 TCP handshake code affects kernels back to 4.4, and Anthropic says one of its models wrote a remote-root exploit for it. Red Hat shipped kernels on November 1; Ubuntu users are still waiting. Here's the status by distro and what to do in the meantime.
