Aggregator

数百万用户用药、过敏、家族病史等敏感信息泄露

OpenAI has announced its plans for a “Defense Factory,” a cybersecurity operation that prioritizes agent-driven actions. This initiative is designed to continuously discover, validate, remediate, and verify vulnerabilities as AI systems develop the ability to conduct increasingly complex cyber operations. The initiative addresses growing concerns that long-running autonomous agents, especially those powered by widely accessible […]

The post OpenAI Builds ‘Defense Factory’ as AI Agents Gain Ability to Chain Cyber Exploits appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Claude models compromised real systems during misconfigured security tests, exposing a worrying mix of flawed reasoning, harmful actions and weak safeguards. Anthropic just published one of the more uncomfortable self-assessments a major AI lab has released this year. The company’s alignment report documents four separate incidents in which Claude models broke into real third-party systems […]

Threat actors are impersonating corporate IT helpdesk staff in an active social-engineering campaign that hijacks Microsoft 365 identities, establishes MFA persistence, and systematically collects data from SharePoint, OneDrive, and Exchange Online. Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The activity is marked by unusual sign-ins, attacker-added authentication methods, extensive […]

The post Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Природная геометрия неожиданно выиграла у привычной защиты.

A vulnerability was found in Bosch Sensortec BHI360 SensorAPI. It has been classified as very critical. The affected element is the function bhi360_parse_debug_message of the file bhi360_parse.c of the component FIFO Parsing. This manipulation of the argument msg_length causes stack-based buffer overflow. This vulnerability is handled as CVE-2026-42804. It is possible to launch the attack on the local host. There is not any exploit available. It is suggested to install a patch to address this issue.

A vulnerability was found in Armiya Information Technologies Access Control System and classified as problematic. Impacted is an unknown function. The manipulation results in open redirect. This vulnerability is known as CVE-2026-8323. It is possible to launch the attack remotely. No exploit is available.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December. [...]

苹果宣布了一系列新产品，包括 iPhone 18 Pro 与 iPhone 18 Pro Max、AirPods 5 以及其首款折叠屏手机 iPhone Duo。其中最引人瞩目的是其折叠屏手机。三星、Google 和华为等苹果竞争对手早就推出了折叠屏手机，在内存和存储器短缺导致价格飙升时代，苹果推出起售价 15,999 元的折叠屏手机，消费者是否接受还有待市场检验。iPhone Duo 配备了 7.6 英寸超视网膜 XDR 可折叠屏，5.4 英寸超视网膜 XDR 外屏，A20 Pro 芯片，10 月 16 日（星期五）起接受预购，10 月 23 日（星期五）起正式发售。

LLM-based code scanners won’t help attackers build a nuclear weapon, but that refusal could work in their favor

A vulnerability has been found in GeoVision GV-LPC2011 and GV-LPC2211 up to 1.13 and classified as critical. This issue affects some unknown processing of the component PTZ Connection State Management. The manipulation leads to resource consumption. This vulnerability is traded as CVE-2026-88286. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in Google Cloud Gemini CLI and run-gemini-cli GitHub Action. This vulnerability affects unknown code of the component Env File Handler. Executing a manipulation of the argument GEMINI_CLI_HOME can lead to improper input validation. This vulnerability appears as CVE-2026-13745. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in GeoVision GV-LPC2011 and GV-LPC2211 up to 1.14 20260903/1.14 20260908. This affects an unknown part of the component VLSVR Request Handlers. Performing a manipulation results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-88289. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability classified as very critical was found in GeoVision GV-LPC2011 and GV-LPC2211 up to 1.13. Affected by this issue is some unknown functionality of the component PTZ Control Service. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-88285. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in Red Hat crun up to 1.29.1. Affected by this vulnerability is an unknown functionality of the component Terminal Setup. This manipulation causes open redirect. This vulnerability is registered as CVE-2026-88264. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability described as critical has been identified in GeoVision GV-LPC2011 and LPC2211 up to 1.14 20260903/1.14 20260908. Affected is an unknown function. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-88290. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in GeoVision GV-LPC2011 and GV-LPC2211 up to 1.13. This impacts an unknown function of the file BKDownloadLink.cgi. The manipulation leads to path traversal. This vulnerability is listed as CVE-2026-88288. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in GeoVision GV-LPC2011 and GV-LPC2211 up to 1.13. This affects an unknown function of the component WS-Discovery. Executing a manipulation can lead to stack-based buffer overflow. This vulnerability is tracked as CVE-2026-88287. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in GeoVision GV-LPC2011 and LPC2211 up to 1.13. The impacted element is an unknown function of the component ONVIF SetUser. Performing a manipulation results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-88280. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.