vulnerabilities

Attackers pushed refrigeration systems in hundreds of French supermarkets into defrost mode, causing food spoilage and losses, while IPinfo research revealed that France had an unusually large number of exposed, unpatched fridge dashboards online for months before the attack.

多个 Plex Media Server 漏洞（Plex2Shell，CVE-2026-96652 等）正被野外利用以投放加密货币挖矿程序，研究人员通过蜜罐捕获了实际攻击流量与 IOC。

Microsoft 发布了修复超过 1,400 个安全漏洞的更新，创下历史新高，其中 78 个被评为"严重"级别，1 个为已被利用的零日漏洞。微软将漏洞发现数量激增归功于大语言模型的使用。

深入的安全研究文章，详细讲解了对 Eufy Security 视频门铃及 Homebase 2 基站的逆向工程过程，涵盖远程信号干扰、声音同步协议逆向，以及从闪存转储中提取并解密门铃连接隐藏网络所用凭据的方法。

Project Glasswing reported finding 135,000 verified vulnerabilities across the internet, with at least 9,333 already patched, highlighting progress in improving overall web security.

TrustFoundry blog post offering a beginner-friendly introduction to JIT compiler vulnerabilities in JavaScript engines, focusing on V8/D8, covering TurboFan internals, common vulnerability types, and tools for analyzing JIT bugs using a CTF challenge example.

Debian published security advisory DSA-6528-1 for its Linux kernel package, disclosing and patching a large batch of CVEs spanning 2024 through 2026. The update addresses numerous kernel vulnerabilities and recommends users apply the security fix.

Debian security maintainer Samuel Henrique bumps rsync to 3.5.0 instead of backporting patches to fix 33 CVEs, introducing behavior changes including stricter symlink handling, tighter rsyncd access controls, and certificate verification in rsync-ssl.

AI is being used to supercharge cyberattacks, leaving critical sectors like healthcare and financial institutions vulnerable, as highlighted by recent incidents and expert concerns about escalating threats.

OpenClaw completed a security audit through OpenAI’s Patch the Planet initiative, identifying and fixing 24 severity-rated vulnerabilities with the help of Trail of Bits using Codex-assisted workflows.

Hackers breached OpenAI by exploiting vulnerabilities in third-party systems and employee validation, raising security and safety concerns in AI development. The researchers were white-hat and reported the issue, which has been patched.

Researchers from Hacktron AI used Anthropic's Claude to exploit vulnerabilities in OpenAI's systems, demonstrating AI's capability in cybersecurity and raising concerns about AI security vulnerabilities.

Security researchers discovered and disclosed vulnerabilities that allowed them to compromise OpenAI employees' accounts and access internal repositories through an exploit chain involving libheif and an SSO misconfiguration.

Independent security researchers discovered a critical vulnerability chain involving an SSO misconfiguration and image decoder flaw in OpenAI's systems, using Anthropic's Claude to gain access to internal repositories and triggering a security patch.

The article highlights the lack of robust security practices in agentic AI deployments, pointing out that many projects fail to apply standard security measures like logging and least privilege, and references OWASP's Top 10 and the AIUC-1 standard.

Anthropic's report describes a case where two undergraduates used Claude to automate a 24-hour cyber attack system, generating 0-day vulnerabilities and running AI agents for continuous intelligence collection, illustrating how AI amplifies capabilities for individuals and small teams.

An exploit kit named BlueMoon, targeting critical vulnerabilities in Chromium browsers and Windows, has been used by at least four hacking groups, some with ties to the Chinese government. Researchers from Proofpoint reported rapid deployment and sharing of the kit, possibly aided by AI, within a patch gap in the Chromium supply chain.

Security researchers discovered that LG smart TVs log plaintext transcripts and map network devices even when off, revealing invasive surveillance practices and potential vulnerabilities in over 200 million devices worldwide.

Microsoft patched a record 972 vulnerabilities in September 2026, with 112 critical, amid industry warnings about AI-enabled cyber attacks.

A practical walkthrough on how to test AI agents with multi-turn attacks to uncover vulnerabilities that seem harmless in isolation but become critical over interactions.