اخبار امنیتی

Hiding Capabilities in AI Models

۱۴۰۵/۰۸/۰۵ · ۱۱ روز پیش هوش مصنوعی Schneier on Security

Interesting research: “ AI Models Can Provably Hide Arbitrary Capabilities ” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks…

Infosecurity Magazine

Copenhagen University Breach Compromises Data on Half a Million People

۱۴۰۵/۰۸/۰۵ · ۱۱ روز پیش نشت داده Infosecurity Magazine

Hackers have stolen personal information on over 520,000 people from the University of Copenhagen

Malwarebytes Labs

Samsung TVs without mics may listen through soundbars, researcher says

۱۴۰۵/۰۸/۰۵ · ۱۱ روز پیش امنیت سایبری Malwarebytes Labs

TVs without a built-in microphone may use a connected soundbar or Bluetooth microphone to listen to the room.

Infosecurity Magazine

First ISC2 AI Security Certification Expected for Early 2027

۱۴۰۵/۰۸/۰۵ · ۱۱ روز پیش هوش مصنوعی Infosecurity Magazine

ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification

Malwarebytes Labs

Popcorn Time’s forgotten updater left millions of devices exposed to hijacking

۱۴۰۵/۰۸/۰۴ · ۱۲ روز پیش امنیت سایبری Malwarebytes Labs

The update process for an abandoned streaming app could let attackers take over PCs. If you ever used Popcorn Time, check your devices.

CVE-2026-30612

WeLiveSecurity

PHP2Shell: What to know about two critical PHP flaws

۱۴۰۵/۰۸/۰۴ · ۱۲ روز پیش آسیب‌پذیری WeLiveSecurity

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes

CVE-2026-109619 CVE-2026-109618

Malwarebytes Labs

AI Halloween videos: Who’s getting your photos?

۱۴۰۵/۰۸/۰۴ · ۱۲ روز پیش هوش مصنوعی Malwarebytes Labs

Before you turn yourself into a zombie, check who’s getting your photos. Some Halloween AI sites offer little information about who's behind them.

Schneier on Security

Bias in Qwen3-Coder Model

۱۴۰۵/۰۸/۰۴ · ۱۲ روز پیش آسیب‌پذیری Schneier on Security

Interesting research : TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the code against Americans. Ask for the app…

Schneier on Security

Friday Squid Blogging: Increasing Squid Populations

۱۴۰۵/۰۸/۰۲ · ۱۴ روز پیش امنیت سایبری Schneier on Security

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Graham Cluley

Hacker leaks 281 GB of data from Germany’s far-right AfD party

۱۴۰۵/۰۸/۰۱ · ۱۵ روز پیش نشت داده Graham Cluley

The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party’s internal emails, and shows AI-written summaries rather than the emails themselves. Read more in my article on the Hot for Security blog.

Schneier on Security

Compromised TLS Certificates

۱۴۰۵/۰۸/۰۱ · ۱۵ روز پیش امنیت سایبری Schneier on Security

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2 384 , or a number with 116 digits,…

Krebs on Security

Widespread PHP Flaw May Cause Many Site Outages Today

۱۴۰۵/۰۷/۲۹ · ۱۶ روز پیش آسیب‌پذیری Krebs on Security

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.

پوشش در رسانه‌های دیگر: Schneier on Security

CVE-2026-109619 CVE-2026-109618

WeLiveSecurity

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

۱۴۰۵/۰۷/۳۰ · ۱۶ روز پیش بدافزار WeLiveSecurity

ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm

Graham Cluley

Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside

۱۴۰۵/۰۷/۳۰ · ۱۶ روز پیش هوش مصنوعی Graham Cluley

Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with zero-click attacks. Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to on your employees’ laptops when nobody’s looking.…