Aggregator

Currently trending CVE - Hype Score: 8 - Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source ...

The normalization of AI and automation within internet infrastructure is changing how organizations interpret traffic. Activity that once appeared anomalous is now treated as expected behavior. AI agents have emerged as a third category of automated traffic alongside good and bad bots, according to the Thales 2026 Bad Bot Report: Bad Bots in the Agentic Age. The distinction between legitimate and malicious automation is difficult to define because both operate through similar channels, workflows, and … More →

The post Bad bots make up 40% of internet traffic appeared first on Help Net Security.

Copy Fail的根源位于Linux内核加密子系统（crypto）的authencesn AEAD模板中（用于IPsec的Extended Sequence Number支持）。 2017年，algif_aead模块引入了一个“in-place优化”，让AF_ALG socket在处理AEAD解密时，将page cache页面直接放入可写的scatterlist（分散/聚集列表）。攻击者通过splice()零拷贝机制，把任意可读文件（如/usr/bin/su）的page cache页面传入AF_ALG socket的输入/输出scatterlist。随后，crypto_authenc_esn_decrypt()函数会把调用者的目标缓冲区当作临时暂存空间（scratch space），在输出边界之外写入4字节的seqno_lo，并且永远不会恢复原始数据。这就是经典的“Copy Fail”——复制操作“失败”了，超出了缓冲区边界。整个过程不需要race、无需重试、单次直线执行即可成功。PoC利用AF_ALG + splice() + authencesn的组合，实现对任意可读文件page cache的精确4字节覆盖。

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by '06fe5fd2bc53027c4a3b7e395af0b850e7b8a044' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by '06fe5fd2bc53027c4a3b7e395af0b850e7b8a044' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by '06fe5fd2bc53027c4a3b7e395af0b850e7b8a044' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by '06fe5fd2bc53027c4a3b7e395af0b850e7b8a044' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H severity vulnerability discovered by 'Nitesh Surana (niteshsurana.com) of TrendAI Research' was reported to the affected vendor on: 2026-04-30, 1 days ago. The vendor is given until 2026-08-28 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

リコー製Web Image Monitorを実装している複数のレーザープリンタおよび複合機（MFP）には、オープンリダイレクトの脆弱性が存在します。

Простая просьба в почте стала самым лёгким способом вскрыть сейф.

2026年4月30日，国家信息安全漏洞共享平台（CNVD）收录了Linux Kernel本地权限提升漏洞（CNVD-2026-19044，对应CVE-2026-31431）。

用7-Zip就可以析取

Орбита захламлена — значит карлик. Где же справедливость?

Warp, the AI-centric terminal used by close to a million developers, has released the source code for its client on GitHub under the AGPL license, with OpenAI signed on as the founding sponsor of the repository. An agent-first contribution model Warp is steering contributions through Oz, its cloud agent orchestration platform. Agents handle the bulk of implementation work, including coding, planning, and testing, and human contributors focus on ideas, direction, and verification of agent output. … More →

The post Warp open sources its AI terminal client appeared first on Help Net Security.