Aggregator

Mysterium VPN found 12M IPs exposing .env files, leaking credentials and revealing widespread security misconfigurations worldwide. Configuration mistakes rarely trigger alarms. A forgotten deny rule, an overlooked server setting, or a full project folder uploaded to production can quietly expose a company’s most sensitive secrets. In many cases, those secrets live inside simple environment files […]

OpenAI опубликовала отчет о работе мошенников и пропагандистов с языковыми моделями.

Anthropic's Claude Code Security launch sent shockwaves through cybersecurity markets. As GitGuardian's CEO, here's why I believe the real battle has shifted from code vulnerabilities to identity and secrets management in the AI era.

The post Claude Code Security: Why the Real Risk Lies Beyond Code appeared first on Security Boulevard.

2025年9月，恒脑已具备比肩Claude Code Security的代码安全检测能力

报告基于2025年7月至8月对全球650名CISO的调研。受访者来自制造、通信、能源、交通等九大行业，覆盖了包括美国、法国、德国和新加坡在内的九个国家和地区。

根据 IDC 的预测，因内存短缺 2026 年智能手机出货量预计下滑 12.9% 至 11 亿部。内存和 SSD 短缺对面向中低端市场的 Android 手机厂商影响最大，它们本就利润微薄，零部件成本的不断上涨将挤压利润空间，迫使其将成本转嫁给消费者。大厂如苹果和三星预计能安然度过这场危机，甚至还可能扩大市场份额。IDC 认为智能手机行业的小厂将会退出市场，行业整合将会出现，低端厂商面临供应受限和需求下降的双重压力，出货量将大幅下滑。在智能手机出货量将创历史新低的同时，其平均售价预计今年将上涨 14% 达到创纪录的 523 美元。对厂商和消费者而言，回到过去不再可能。

Meta on Thursday said it's taking legal action to tackle scams on its platforms by filing lawsuits against what it calls deceptive advertisers based in Brazil, China, and Vietnam. As part of the effort, the advertisers' methods of payment have been suspended, related accounts have been disabled, and the website domain names used to pull off the scams have been blocked. Concurrently, the social

European DIY platform ManoMano suffered a data breach via a third-party provider, exposing personal data of 38 million customers. European DIY e-commerce platform ManoMano disclosed a major data breach affecting 38 million customers. Hackers accessed personal information by compromising a third-party service provider, prompting notifications and potential security measures for impacted users across multiple countries. […]

OpenSSL защищал весь интернет на голом энтузиазме — настало время положить этому конец.

OpenSSL Projectより、OpenSSL Security Advisory [27th January 2026]が公開されました。

Oculeus has launched its new Two Factor Network (2FN) solution. The 2FN solution provides a framework for telcos to trace the origin of traffic, verify caller identity, determine the roaming status of inbound calls, and prevent Caller Line Identification (CLI) spoofing. The landscape of fraud has been changed by cybercrime-as-a-service with the evolution of specialized criminal gangs that subvert communications networks at scale, then sell their services to less technically skilled scammers worldwide. The services … More →

The post Oculeus 2FN authenticates calls in real time to stop CLI spoofing appeared first on Help Net Security.

汉堡王（Burger King）即将推出内置于员工所佩戴耳机中的 AI 语音机器人 Patty。Patty 是 BK Assistant 平台的一部分，不仅能协助员工备餐，还能评估他们与顾客互动时的“友好度”。汉堡王首席数字官 Thibault Roux 表示，他们根据收集的相关数据训练 AI 系统识别特定词语和短语，如 welcome to Burger King、please 和 thank you。经理之后可以询问 AI 系统门店员工的友好度表现。Roux 表示 AI 是辅助员工的培训工具，公司会不断迭代 AI 助手以更好的捕捉对话语气。

A vulnerability classified as critical was found in Vivo Health. This affects an unknown part. Such manipulation leads to missing authentication. This vulnerability is uniquely identified as CVE-2025-15567. Local access is required to approach this attack. No exploit exists.

A vulnerability classified as critical has been found in Vivo SmartRemote. Affected by this issue is some unknown functionality of the component URL Handler. This manipulation causes missing authentication. This vulnerability is handled as CVE-2025-15509. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as critical has been identified in logicminds rubyipmi up to 0.12.1. Affected by this vulnerability is an unknown functionality of the component BMC Username Handler. The manipulation results in privilege escalation. This vulnerability is known as CVE-2026-0980. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as critical has been reported in MailArchiver Plugin up to 4.5.0 on WordPress. Affected is an unknown function. The manipulation of the argument logid leads to sql injection. This vulnerability is traded as CVE-2026-2831. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as problematic has been found in shohei.tanaka Japanized for WooCommerce Plugin up to 2.8.4 on WordPress. This impacts the function paidy_webhook_permission_check of the component Paidy Webhook Endpoint. Executing a manipulation can lead to missing authorization. This vulnerability appears as CVE-2026-1305. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as problematic has been detected in jmpsec osctrl up to 0.4.x. This affects an unknown function of the component Query Parameter Handler. Performing a manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-28280. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in Switch EV swtchenergy. The impacted element is an unknown function. Such manipulation leads to insufficiently protected credentials. This vulnerability is documented as CVE-2026-27773. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in Morelitea initiative up to 0.32.3. It has been rated as problematic. The affected element is an unknown function of the component HTML File Parser. This manipulation causes HTML injection. This vulnerability is registered as CVE-2026-28274. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.