Aggregator

A forum actor posting as TheTrueWorldCreator is offering what they claim is full access to the core money database of PT Betiri Cipta Media, an Indonesian aggregator and distributor of digital goods operating as a PPOB business.

Google turned on a transfer feature in Android that moves passwords and passkeys straight from one password manager to another, with no file to download along the way. You start it from inside the app you are switching to, and Google says the data moves between the apps in a few seconds. “Historically, moving your passwords meant downloading them into an unencrypted text file, which left them unprotected on your device,” Google said. Passkeys, the … More →

The post Your passkeys can now move between password managers on Android appeared first on Help Net Security.

A threat actor, likely Russian-speaking, used hundreds of AI agents to develop and launch a global exploitation campaign targeting vulnerable PaperCut NG/MF servers. [...]

约 200 年前，法国物理学家克劳德-路易·纳维和爱尔兰物理学家乔治·斯托克斯提出了一组至今仍然广泛使用的、描述液体、空气等流体运动的偏微分方程。Navier-Stokes 方程并不保证适用于所有可能的情况。几十年来，数学家一直致力于寻求证明方程的普适性或导致方程失效的特例。2000 年克雷数学研究所将 Navier-Stokes 方程列为六大千禧年数学问题之一。OpenAI 本周宣布通过动用约 1 万个 AI 智能体进行长达 88 小时的攻坚，于 9 月 5 日发现了一个 Navier-Stokes 方程失效的特例。如果得到确认，将标志着 AI 首次解决了一个重大的数学难题。但此事在数学界引发了巨大争议。过去一个月，纽约大学数学家 Tristan Buckmaster 和 Anthropic 研究员 Levent Alpöge 利用来自 OpenAI 和 Anthropic 的 AI 工具在解决 Navier-Stokes 问题上取得了重大进展。然而就在他们准备公布研究成果之前，OpenAI 投入了数百万美元算力，开展了大规模攻坚行动。OpenAI 声称它未利用 Buckmaster 和 Alpöge 的最新研究成果，但 Buckmaster 公开发表声明，对此提出质疑。纽约大学团队指控 OpenAI 抓取了他们的数据训练其模型。

Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [...]

在网络安全圈子里，Stuxnet（震网）是绕不开的里程碑，这款全球首款能够实现物理杀伤的工控网络武器，彻底改写了网络战的定义。 近期上线的 github.com/Sadpainy/Stuxnet公开仓库，以纯学术研究为核心定位，重构出Stuxnet全套开源代码，开发者依托2010年曝光的Stuxnet原始二进制样本，整合全球安全社区多年逆向工程成果，逐模块还原、重构而成的可分析源码工程。 (社区认为还是有遗漏，可以自行二次重构) 源码严格复刻原版病毒的多渠道入侵方式，支持USB设备LNK漏洞、局域网Print Spooler漏洞、P2P点对点三种传播路径，专门针对物理隔离、离线运行的工控内网设计。同时内置精准的环境检测逻辑，程序会自动扫描设备是否搭载Siemens WinCC、Step7工控软件与指定型号S7-315、S7-417 PLC设备，非目标环境下自动休眠或自销毁，最大程度模拟原版病毒的隐蔽生存机制。 项目采用C语言编写，严格对标原版Stuxnet的攻击逻辑与技术架构，将复杂的病毒程序拆解为多个独立功能模块，每一份源码文件都对应病毒的真实运行环节，从入侵植入、权限突破、工控劫持，到载荷攻击、内核隐身、内网传播，完整复刻了原版病毒的全套执行闭环，同时优化了代码可读性，适配人工分析与学习研究。 针对西门子工控设备的核心劫持能力，是该仓库重点还原的核心技术亮点，全部通过专属钩子库源码实现。 为还原Stuxnet极致的隐身对抗能力，该GitHub项目完整复刻了两套内核级Rootkit（内核隐藏工具）驱动源码，也是这款病毒难以被传统杀毒软件查杀的核心原因。 其中mrxcls.sys源码实现了文件系统隐身功能，通过SSDT系统服务描述表挂钩技术，完全规避常规系统检测与安全查杀。 mrxnet.sys源码则承担网络隐身与扩散任务，既能过滤系统文件请求、隐匿网络行为，同时支撑P2P点对点传播机制，让病毒在隐身状态下持续在内网横向扩散。 仓库中最具技术代表性的s7plcmain源码模块，完美还原了Stuxnet独一无二的物理杀伤能力，也是整个项目最核心的攻击载荷。源码完整复刻了原版病毒的侦查与注入逻辑，程序运行后会持续监控PLC设备的s7blk_write写入操作，一旦检测到工程师向设备下载OB1、OB35核心程序块，就会自动拼接注入恶意代码。 被篡改的工控程序不会触发系统报错与设备崩溃，只会悄悄修改变频驱动运行参数，让工业离心机电机长期处于异常转速，持续磨损机械结构最终造成硬件报废，精准还原了当年Stuxnet摧毁核工业设备的核心攻击原理。 #震网

Внешняя структура Харикло поставила перед астрономами вопрос о неизвестном механизме удержания вещества.

The disgruntled researcher continued their vendetta against Microsoft by publishing yet another zero-day exploit for Windows Defender.

AI agents are gaining real-world access faster than safeguards can mature, making permissions, isolation and oversight critical to prevent harmful actions. Jacob Coxon, a researcher who spent three years working on model training at OpenAI and later Anthropic, left Anthropic this week with a blunt warning: AI companies are moving toward increasingly capable systems faster […]

Школьные сочинения больше не должны кормить нейросети Microsoft.

Discover how AI Assistant for Akamai Web Security Analytics helps SOC and AppSec teams investigate events faster and take guided action with natural language.

Identity verification company IDScan has confirmed that hackers accessed customer data stored in its cloud platform, days after reports linked the company to a massive database containing more than 153 million driver's license scans. [...]

Bad actors are misusing Google Play's Early Access program to push deceptive apps that claim to offer money, rewards, casino winnings, and premium content. Early Access apps are apps that haven't been released on the official Android app marketplace. The main idea behind the program is for developers to solicit user feedback for new applications or features they may be working on before their

ProteinTalks обучилась на 38 млн измерений и научилась прогнозировать реакцию опухолевых клеток на терапию.

Executive Summary In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating payload (e.g. ”encrypt files in ~/Documents”, “give me a biohazard recipe”, “ignore all previous instructions and…”) is embedded in a specially crafted prose wrapper. An LLM with limited […]

The post PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector appeared first on Check Point Research.

Cybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release. The malicious downloads are distributed through poisoned search results, gaming forums, […]

The post Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware appeared first on Cyber Security News.

Multiple cyber-espionage groups deployed an exploit kit dubbed "BlueMoon" that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. [...]

WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […]

The post WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites appeared first on Cyber Security News.

A new phishing campaign is moving fake login pages into victims’ browsers. Rather than sending people to a malicious website, its operators use browser-generated blob URLs to assemble the page in local memory, leaving less for security tools to inspect before it appears. The operation starts with a DocuSign-themed email carrying a calendar invitation. Its […]

The post Hackers Use Blob URLs and Microsoft Teams to Create Phishing Pages Inside Victims’ Browsers appeared first on Cyber Security News.

Identity was the target in roughly half of all confirmed malicious activity. Prophet Security breaks down the four main attack patterns seen across customer environments between May and July 2026, and explains why some attacks succeeded while others were blocked. [...]