Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root…
bleepingcomputer.com
$ webdevs --topic security
Latest insecurity_
Threats, defenses, privacy, and secure engineering.
Today
// 27 Oct4 linksThe Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses…
bleepingcomputer.com
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks…
bleepingcomputer.com
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform…
bleepingcomputer.com
Yesterday
// 26 Oct2 linksCross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
blog.cloudflare.com
GPT-6.1 Sol helps CodeRabbit strengthen security across complex codebases
CodeRabbit uses GPT-6.1 Sol to investigate security risks across complex codebases. Its security agent helps developers review findings and proposed fixes.
openai.com
Earlier
// 23 Oct12 linksUpdated Google privacy policy says your Gmail might be used for advertising
Turning on Personal Intelligence gives the company more data for ad targeting.
arstechnica.com
Bringing post-quantum cryptography to geographically fenced key management
Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our…
blog.cloudflare.com
OpenAI and Poland’s NASK partner to advance AI safety and security
OpenAI and Poland’s NASK are partnering on AI safety, security, and technical research to strengthen safeguards and support a more resilient digital ecosystem.
openai.com
How bug bounty sharpens one researcher’s security skills
As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for…
github.blog
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of…
krebsonsecurity.com
Introducing full transaction detection for Cloudflare WAF
Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data…
blog.cloudflare.com
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and…
blog.cloudflare.com
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
openai.com
Cloudflare links vulnerability discovery to defense with OpenAI
Cloudflare uses OpenAI Daybreak to investigate vulnerabilities and propose fixes for review. Its developers use Codex to build faster and improve code quality.
openai.com
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different…
krebsonsecurity.com
U.K. Sanctions Cryptomus for RU Money Laundering
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related…
krebsonsecurity.com
Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs…
krebsonsecurity.com
grep: no matches