Aggregator

A vulnerability has been found in SourceCodester Online Class Record System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. This vulnerability is known as CVE-2026-2089. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability was found in SourceCodester Online Class Record System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. This vulnerability is handled as CVE-2026-2090. The attack can be executed remotely. Additionally, an exploit exists.

A trojanized version of the popular 7-Zip software is quietly turning home computers into residential proxy nodes, Malwarebytes warns. Spurred by a Reddit post in which a user complained about getting infected with malware after downloading 7-Zip from 7zip[.]com instead of the legitimate 7-zip.org, Malwarebytes researchers looked into the matter and found that the malicious installer functions as 7-zip, but also silently drops additional payloads onto the system. Further analysis showed the malware’s primary role … More →

The post Trojanized 7-Zip downloads turn home computers into proxy nodes appeared first on Help Net Security.

A vulnerability was found in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.2 and classified as critical. The affected element is the function ocfs2_find_victim_chain. Such manipulation of the argument cl_next_free_rec leads to allocation of resources. This vulnerability is referenced as CVE-2025-68771. The attack needs to be initiated within the local network. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.2. This affects the function f2fs_recover_fsync_data. Executing a manipulation can lead to unchecked return value. This vulnerability is handled as CVE-2025-68769. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in Linux Kernel up to 6.1.159/6.6.119/6.12.63/6.18.2 and classified as critical. This vulnerability affects unknown code of the component hfsplus. The manipulation results in improper initialization. This vulnerability is identified as CVE-2025-68767. The attack can only be performed from the local network. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.12.60/6.17.10 and classified as critical. Affected is the function tcp_send_active_reset. Such manipulation leads to divide by zero. This vulnerability is referenced as CVE-2025-68291. The attack needs to be initiated within the local network. No exploit is available. It is suggested to upgrade the affected component.

In a joint advisory issued late last week, Germany’s domestic intelligence agency (BfV) and federal cybersecurity office (BSI) said attackers are attempting to gain access to private messaging accounts in order to monitor confidential communications and potentially compromise broader networks.

Armis has announced Armis Centrix for Application Security, which unifies application security across an organization’s software development lifecycle. The technology helps security teams secure code as a next-generation attack vector to fortify organizations’ defenses and protect against cyber threats. “To effectively manage risk, it’s essential to get to the root cause of the problem and weed it out,” said Nadir Izrael, CTO of Armis. “Code-based vulnerabilities are being embedded into organizational infrastructure, and AI-generated code … More →

The post Armis Centrix brings unified, AI-driven application security to the SDLC appeared first on Help Net Security.

A vulnerability classified as problematic was found in tsMuxer git-2539d07. Affected by this vulnerability is an unknown functionality. The manipulation results in privilege escalation. This vulnerability was named CVE-2023-45510. The attack needs to be approached within the local network. There is no available exploit.

A vulnerability categorized as problematic has been discovered in Jorani Leave Management System 1.0.3. This affects an unknown part of the component List of Leave Requests Page. The manipulation of the argument Comment results in basic cross site scripting. This vulnerability is identified as CVE-2023-45540. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability classified as problematic has been found in VeridiumID up to 3.4.x. This affects an unknown function of the component Admin Portal. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2023-45552. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in tsMuxer git-2539d07. This affects an unknown part of the component MP4 File Handler. Such manipulation leads to memory leak. This vulnerability is referenced as CVE-2023-45511. The attack needs to be initiated within the local network. No exploit is available.

根据发表在《The Journal of World Prehistory》期刊上的一项研究，数学可能比文字更早出现。我们通常认为数学思维的起源与文字的出现紧密相连，它们诞生的时代大约是在五到六千年前。但最新研究挑战了这一观点。研究人员分析了美索不达米亚北部 Halafian 遗址出土的彩绘陶片上的花瓣图案，陶片的历史可追溯到 8000 年前。研究人员发现，陶片花瓣遵循几何序列：4、8、16、32 和 64，即 2 的几何级数，不是随意的选择，凸显了艺术家对几何序列、对称性和空间划分的理解。数学的出现可能是为了解决早期村落的资源分配问题。

Langflow SSRF 服务器端请求伪造漏洞(CVE-2025-68477)

MLflow DNS Rebinding 漏洞分析

大型语言模型（LLMs）凭借其出色的零样本推理能力和强大的语义理解能力，为恶意软件检测领域带来了新的希望。然而，将 LLMs 直接应用于 Android 恶意软件检测时，却面临着两大核心挑战：一是 Android 应用中海量的支持代码远超 LLMs 的上下文窗口限制，使得恶意行为在良性功能中难以被识别；二是 Android 应用复杂的程序结构和组件间依赖关系，超出了 LLMs 基于序列的推理能力，

分析SpeculativeDecoding和MoE推理加速机制如何将输入相关控制流外显为可观测元数据，导致提示词指纹识别、语义推断与路由泄露等新型侧信道攻击。

История Дарена Ли, который построил криптоимперию и исчез прямо перед оглашением приговора.

Agent Skills作为连接大语言模型与现实世界的桥梁，正在重塑人机交互范式。其可插拔、可组合、可执行的特性赋予了Agent强大的能力，但也创造了前所未有的攻击面。本文系统性地分析了Agent Skills面临的三重脆弱性：执行边界模糊、输入输出不可预测、数据流复杂性，并从提示注入、代码注入、SSRF、供应链投毒等多个维度剖析了攻击向量,并原创性提出Skills安全风险评估框架概念，提供了可审