اخبار امنیتی

افشای ضعف‌های امنیتی در درایوهای USB؛ از دروغ Lenovo تا کلیدهای هاردکد شده در محصولات «امن»

Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products

تحقیقات نشان می‌دهد درایو اثر انگشت Lenovo ThinkPlus FU100 که با ادعای رمزگذاری AES-256 فروخته می‌شد، در واقع فاقد امنیت است. FU100 فقط یک کارت SD در یک کیس شیک است و داده‌ها رمزگذاری نشده‌اند؛ همچنین در SSD خارجی TSD303 رمز عبور به‌صورت متن ساده ارسال می‌شود. بررسی‌های بیشتر با کمک هوش مصنوعی نشان داد سایر محصولات امنیتی نیز با مشکلات مشابهی دست‌به‌گریبان‌اند. ابزار Netac شامل کلید ثابت بود که توسط Codex کشف شد و کدکس توانست رمز داخلی KakaSoft را در ۲۶ دقیقه بازسازی کند؛ محصولات Nexcopy نیز از کلیدهای هاردکد شده استفاده می‌کنند.

Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations

The startup maps how identities, assets and vulnerabilities connect, and uses AI agents to find and fix risky combinations of issues. The post Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations appeared first on SecurityWeek .

Alpine Linux سرور GitLab خود را پس از تلاش برای حمله RCE بازسازی کرد

Alpine Linux rebuilds GitLab after attempted RCE attack

تیم Alpine Linux پس از شناسایی تلاش هکرها برای سوءاستفاده از آسیب‌پذیری CVE-2026-97229، سرور GitLab خود را بازسازی کرد و تمام رمزهای عبور را ریست کرد. این آسیب‌پذیری که یک overflow عددی در کامپایلر عبارات منظم Onigmo در Ruby است، می‌توانست کد دلخواه اجرا کند. با اینکه Alpine هیچ مدرکی از اجرای موفق کد توسط مهاجمان نیافت، تصویر alpinelinux/gitlab:19.3.6 حاوی رفع آن منتشر شد.

North Korea linked to massive Binance crypto heist

The FBI says North Korea was behind the massive $6.3 billion crypto heist that hit Binance on October 29th. The FBI labeled the activity "TraderTraitor" and said that it had observed actors it has connected to hack converting the tokens to Ethereum and preparing for further laundering of the funds. The agency offered few other […]

OpenAI says it's doubling Pro usage limits and bringing Work features to Chat

OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex. [...]

Innocent People Are Being Accused of Shoplifting by Faulty AI-Facial Recognition Systems at an Alarming Rate

"It's the stuff of Kafkaesque nightmares." The post Innocent People Are Being Accused of Shoplifting by Faulty AI-Facial Recognition Systems at an Alarming Rate appeared first on Futurism .

Investors Dish on New Startups & What They'd Back Next

The cybersecurity market is difficult to predict, but a glimpse into the annual DataTribe Challenge shows what's trending and what's not.

Friday Squid Blogging: Bigfin Squid Off California Coast

Neat video : The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see

n0n-existent security

GM cracks the petty cash box for multistate driver tracking settlement

$220 million? For all of you? Yeah, we can probably dig that up ...

Anthropic: That Claude Code extension compromise… couldn't be us

Claudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor

New Framework Puts Ransomware Resilience for AI Systems in Focus

RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.