Newsy

Cloudflare fixes Containers cross-tenant flaw exposing customer data

Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors

Anthropic has just announced a new Claude Marketplace, and it brings all AI-related tools into one place, including plugins, connectors, agents, and more. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks

CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28. The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek .Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks

The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents. The post China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks appeared first on SecurityWeek .Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer

Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Microsoft pauses KB5002907 update after Office license deactivations

Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

GitHub Actions re-enabled with Mini Shai-Hulud payload still active

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

OpenAI's AI agents accidentally uploaded user-provided images to third-party sites

OpenAI says its AI agents uploaded user-provided images to third-party image-hosting services while carrying out research and evaluation tasks. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining appeared first on SecurityWeek .Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure

OpenAI’s CEO said there is an “extensive and ongoing review related to our agents’ use of internet access during training and evaluation.” The post OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure appeared first on SecurityWeek .Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Kiteworks urges 6-hour server shutdown over potential zero-day attacks

Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Friday Squid Blogging: Participatory Squid Dissection in October in Tennessee

I feel like someone who reads this blog will want to go to this : Families are invited to dive into the fascinating world of marine biology during an exciting, hands-on Family Squid Dissection at the Hands-On Science Center. Designed for curious learners of all ages, this unique experience combines an interactive lesson with the opportunity to explore the anatomy and adaptations of real ocean life. […] During the guided squid dissection, each family will work together to examine a squid up close, exploring its organs, structures, and specialized features. The experience provides a memorable op…Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Elementor WordPress flaw lets attackers create admin accounts

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts. [...]Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Weekendowa Lektura: odcinek 695 [2026-09-25]. Bierzcie i czytajcie

Zapraszamy do nowego wydania Weekendowej Lektury. Jeśli weekend spędzacie przed komputerem, to ucieszycie się pewnie z kolejnej porcji linków, która pozwoli zorientować się w bogatym krajobrazie zagrożeń. Miłego klikania!Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

IntroductionCzytaj całość ↵Źródło ↗ — otwiera w nowej karcie

On Anthropic’s AI Misuse Report

Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise, phishing, vulnerability research, and the extraction of sensitive data from downstream organizations. ...Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie

Sprawcy ataku na system Medyc twierdzą, że ukradli dane 5 milionów pacjentów i 8 milionów zdjęć

Po naszym wczorajszym artykule o włamaniu do systemu Medyc, obsługującego gabinety lekarskie w całym kraju, odezwali się sprawcy ataku, grupa występująca pod pseudonimem "fingerprint". W swoim krótkim komunikacie ogłosili, że wykradzionych danych jest dużo więcej, niż wskazywały nasze ostrożne szacu...Czytaj całość ↵Źródło ↗ — otwiera w nowej karcie