Posts of last few hours

PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution

A proof-of-concept (PoC) exploit has been released for a critical vulnerability in LMCache that can allow unauthenticated remote code execution on exposed distributed deployments. Tracked as CVE-2026-105192, the flaw has a CVSS score of 9.8 and affects LMCache versions beginning with 0.3.9. As of October 7, JFrog Security Research reported no fixed release. The vulnerability, […]

The post PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution appeared first on Cyber Security News.

https://cybersecuritynews.com/poc-lmcache-flaw/
Электромотор ужали до нитки: экзоскелет будущего будут не собирать из железа, а надевать как кофту
Ни шестерёнок, ни корпуса — а палец робота гнётся как живой.
https://www.securitylab.ru/news/578399.php
Attackers Hijack Three ccTLDs to Obtain Google Certificates
Attackers compromised .gh, .sl and .as registries to obtain unauthorized HTTPS certificates
https://www.infosecurity-magazine.com/news/attackers-hijack-cctlds-obtain/
PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution

A public PoC targets a critical Zammad flaw, CVE-2026-102489, allowing unauthenticated remote users to steal active session cookies and potentially execute code on vulnerable servers. The issue was associated with a breach reported in September at the Dutch Institute for Vulnerability Disclosure (DIVD), where two zero-day flaws in Zammad were reportedly exploited to gain access and […]

The post PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution appeared first on Cyber Security News.

https://cybersecuritynews.com/poc-released-for-zammad-session-leak-flaw/
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html
HashiCorp security advisory (AV26-1019)
https://cyber.gc.ca/en/alerts-advisories/hashicorp-security-advisory-av26-1019
OAuth grants pile up faster than you can review them. Here's how to keep up.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]
https://www.bleepingcomputer.com/news/security/oauth-grants-pile-up-faster-than-you-can-review-them-heres-how-to-keep-up/
Agentic恶意软件持久化与C2
https://mp.weixin.qq.com/s?__biz=MzA4ODEyODA3MQ==&mid=2247497261&idx=1&sn=8927ee699924232607d3619518933468
Manus 成功融资逾 5 亿美元
经历收购风波的中国 AI 企业 Manus 完成超过 5 亿美元融资，创始人肖弘也已解除边控，让这家一度卷入中美科技博弈、前途未卜的公司迎来“重启”，也彰显了中国资本市场对 AI 的热情。 Manus 的母公司蝴蝶效应，星期四（10月8日）在公众号宣布融资消息。这是中国 AI 应用领域迄今规模最大的单轮融资之一，由中国私募股权基金博裕资本和老牌美元基金 IDG 领投，老股东腾讯、红杉中国、真格基金跟投。 公司投后估值达到 40 亿美元，也让 Manus 成为中国估值最高的 AI 智能体初创企业。 去年 12 月 Meta 斥资 20 亿美元收购 Manus，但交易被中国监管部门要求撤回。

https://www.solidot.org/story?sid=85554
北欧饮食与长寿相关
众所周知，地中海饮食有利于健康长寿。现在研究人员报告另一种欧洲饮食——北欧饮食也与长寿相关。丹麦、芬兰、冰岛、挪威和瑞典等国的传统饮食与地中海饮食有很多相似之处，差不多是其寒冷版本，因此又名北方的地中海饮食。北欧饮食以植物为主，主要食用富含脂肪的鱼和根茎蔬菜。研究人员分析了于 64,000 名瑞典中老年人的健康数据，发现饮食习惯更符合北欧饮食的人的全因死亡率、心血管死亡率和癌症死亡率更低。

https://www.solidot.org/story?sid=85553
Splunk security advisory (AV26-1018)
https://cyber.gc.ca/en/alerts-advisories/splunk-security-advisory-av26-1018
已知最早的游泳哺乳动物
对一件早白垩世哺乳动物化石的分析证实约 1.25 亿年前的小型哺乳动物已经具备明确的半水生适应特征，这也是目前可确认的、最早具备游泳能力的哺乳动物。新发现的哺乳动物被命名为“板尾董尖齿兽”（Dongoconodon platycauda）。板尾董尖齿兽展现出了独特的半水生适应特征，是目前已知哺乳动物冠群中最早具有游泳能力的代表。其前后足具有发达的侧向扩展结构，与现生鸭嘴兽的蹼足高度相似，表明其生前可能具有发达的蹼膜；与此同时，董尖齿兽的掌骨、跖骨和指趾骨排列能够使手指和脚趾向外展开，从而增加划水时与水接触的面积，有利于游泳推进。 虽然板尾董尖齿兽的手足与鸭嘴兽十分相似，但它的尾巴却采用了完全不同的结构。化石保存了至少19节尾椎，其中靠近尾巴基部和中段的尾椎具有明显扁平的椎体和较宽的横突，表明这只动物具有背腹方向扁平的尾部。不过，它的尾巴并不像现代河狸和鸭嘴兽那样形成宽大的“桨状尾”，而是从基部向末端逐渐变细，更接近现代半水生啮齿类的海狸鼠。这只生活在恐龙时代的小型哺乳动物，可能拥有“鸭嘴兽式的手足”和“海狸鼠式的尾巴”，形成了一种此前未知的游泳方式组合。

https://www.solidot.org/story?sid=85552
MonsterCloud Owner Charged With Secretly Paying Ransomware Demands
MonsterCloud owner Zohar Pinhasi allegedly paid ransomware demands behind clients’ backs, then charged them millions for the supposed recovery. Zohar Pinhasi, the owner of Florida-based MonsterCloud, was charged this week with wire fraud. Federal prosecutors say his clients were scammed twice during the same ransomware crisis. Pinhasi (50) also used the names “Zack Silver” and […]
https://securityaffairs.com/200621/cyber-crime/monstercloud-owner-charged-with-secretly-paying-ransomware-demands.html
ASOS Confirms Data Breach Linked to Stolen Employee Credentials
The ASOS hack comes from the compromise of agentic marketing platform Simon AI, said the attackers
https://www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware

A threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights […]

The post Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

https://gbhackers.com/tensorlake-package-hijacked/
Microsoft посадила ИИ на короткий поводок. Windows получила цифровые клетки
Агенты больше не должны самостоятельно решать, какие файлы читать, какие программы запускать и куда отправлять данные.
https://www.securitylab.ru/news/578394.php
Рунет накрыл масштабный сбой. Проблемы затронули СМИ, банки и десятки сервисов
Curator оказался в центре внимания после массовых отказов крупнейших сайтов Рунета.
https://www.securitylab.ru/news/578441.php
美国男子因利用 AI 生成音乐和机器人账号欺诈播放被判 18 个月
54 岁的美国北卡罗来纳州男子 Michael Smith 因 AI 辅助欺诈罪被判入狱 18 个月。他是首位涉嫌 AI 辅助流媒体欺诈而被刑事起诉的美国人。Smith 从 2017 年起利用虚假电邮账户和通过欺诈获取的借记卡在 Amazon Music 、Apple Music、Spotify 和 YouTube Music 等平台创建了数千个账号，使用软件操纵机器人程序，循环播放他声称拥有版权的歌曲——这些歌曲实际上都是 AI 生成的。到 2024 年被捕时他创作了数十万首 AI 生成歌曲，播放量多达数十亿次，从流媒体获取了数百万美元的收入。他的歌曲的总播放量甚至超过了当今最炙手可热的歌星。比如 2023 年 4 月其歌曲的播放量达到了 8090 万次，相比下 Taylor Swift 所有歌曲的总播放量同期仅为 930 万次。Smith 除了服刑外还必须上缴其非法获取的 8,091,843.64 美元收入。

https://www.solidot.org/story?sid=85551
Uranium crypto exchange hacker convicted for stealing $53 million
A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. [...]
https://www.bleepingcomputer.com/news/security/uranium-crypto-exchange-hacker-found-guilty-of-53-million-theft/
PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution

A proof-of-concept (PoC) exploit has been released for CVE-2026-102489, a critical vulnerability in Zammad that can expose active users’ session cookies and enable remote code execution (RCE) as the Zammad operating system user. This flaw was reportedly exploited during the September breach of the Dutch Institute for Vulnerability Disclosure (DIVD), alongside a separate local privilege […]

The post PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

https://gbhackers.com/poc-exploit-released-for-zammad-vulnerability/

Managed ad