Пощёчина кремниевой долине: разработчик-одиночка сделал бесплатный аналог Claude Code на китайской модели
Китайский DeepSeek-TUI лишает западные корпорации легких денег.
Aggregator
CISA Urges Critical Infrastructure Providers to Make Plans to Remain Operational if hit by Cyber-Attack
2 months 3 weeks ago
CISA’s CI Fortify initiative aim for critical infrastructure operators to build isolation & recovery
The Digital Foundation of Public Trust Is More Than Skin Deep
2 months 3 weeks ago
Imagine a parent attempting to access Supplemental Nutrition Assistance Program (SNAP) benefits to feed the family, only to meet a perpetual loading screen. Or a resident rushing to file an unemployment claim before a weekly deadline, only to find the portal timing out. For state and local governments, these are not...
Anthony Cote
MuddyWater hackers use Chaos ransomware as a decoy in attacks
2 months 3 weeks ago
The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on Microsoft Teams social engineering to gain access and establish persistence. [...]
Bill Toulas
Google Chrome 被发现在合格设备上静默下载 Gemini Nano
2 months 3 weeks ago
Google Chrome 被发现在合格设备上静默下载了 4GB 大小的 Gemini Nano 模型，而且会在用户删除之后重新下载。Gemini Nano 就是 Google 受争议的 Prompt API 所针对的本地模型，运行该模型需要至少有 4GB 显存、16GB 内存和至少 22GB 可用空间（浏览器安装包所在分区）。Google Chrome 有 38 亿用户，是市场份额最高的浏览器，满足运行 Gemini Nano 要求的设备至少数以亿计，即使不考虑重复下载，为如此多的设备静默下载 4GB 数据也是难以想象的资源浪费。此外值得一提是 Chrome 安装包大小是 1GB 左右，悄悄下载的模型大小四倍于浏览器本身，超出了大多数用户对额外功能大小的预期。Gemini Nano 下载在被称为 OptGuideOnDeviceModel 的文件夹内，该名字代表 OptimizationGuide on-device model storage。
Iran-Linked APT Posed as Chaos Ransomware Member in Espionage Campaign
2 months 3 weeks ago
Rapid7 reveals an Iranian false flag operation masquerading as a Chaos ransomware attack
MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
2 months 3 weeks ago
The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has been attributed to a ransomware attack in what has been described as a "false flag" operation.
The attack, observed by Rapid7 in early 2026, has been found to leverage social engineering techniques via Microsoft Teams to initiate the infection sequence. Although the incident
The Hacker News
Webinar: Why network incidents escalate and how to fix response gaps
2 months 3 weeks ago
Most network incidents don't escalate due to a lack of alerts; they escalate when response breaks down. This webinar explores how to fix gaps in triage, enrichment, and coordination. [...]
BleepingComputer
G.O.S.S.I.P 阅读推荐 2026-05-06 DARPA 拖拉机简史
2 months 3 weeks ago
《DARPA拖拉机简史》==《DARPA try everything来解决内存漏洞简史》
Hackers compromise Daemon Tools in global supply-chain attack, researchers say
2 months 3 weeks ago
Researchers at Kaspersky said attackers tampered with installers for Daemon Tools — a popular program used to mount disk images as virtual drives — and distributed them through the software’s official website.
Двадцать ударов за три месяца. Касперский зафиксировал повышенный интерес взломщиков к заводам
2 months 3 weeks ago
Теперь аналитики знают о BO Team почти всё.
INC
2 months 3 weeks ago
You must login to view this content
cohenido
Akira
2 months 3 weeks ago
You must login to view this content
cohenido
Submit #800793: PicoTronica e-Clinic Healthcare System (ECHS) v5.7 Information Disclosure [Accepted]
2 months 3 weeks ago
Submit #800793 / VDB-361359
Submit #800792: PicoTronica e-Clinic Healthcare System (ECHS) v5.7 Improper Privilege Management [Accepted]
2 months 3 weeks ago
Submit #800792 / VDB-361358
Submit #800781: PicoTronica e-Clinic Healthcare System (ECHS) v5.7 Exposure of Private Personal Information to an Unauthorized Acto [Accepted]
2 months 3 weeks ago
Submit #800781 / VDB-361357
The “Juice” Factor: Designing Game Feel
2 months 3 weeks ago
Designing game feel requires responsive controls, hit-stop, sound, animation, and feedback systems that make gameplay satisfying.
Uzair Amir
The Hacker News Launches 'Cybersecurity Stars Awards 2026' — Submissions Now Open
2 months 3 weeks ago
For nearly 20 years, we at The Hacker News have mostly told scary stories about cyberspace — big hacks, broken systems, and new threats.
But behind every headline, there’s a quieter, better story.
It’s the story of leaders making tough calls under pressure, teams building smarter defenses, and security products that keep hunting threats 24/7 — even when it’s hard.
Most of the time, this work is
The Hacker News
Европол построил «теневую IT‑базу» под давлением террористической угрозы, а затем потерял над ней контроль
2 months 3 weeks ago
У Европола нашли секретный софт, о котором не знали даже регуляторы.
CISA Adds One Known Exploited Vulnerability to Catalog
2 months 3 weeks ago
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
CISA