33 casos · pág. 1/2
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS 9.3), can stop a call from terminating properly. This can leave audio and possibly video channels open after a user hangs up. MITRE published the CVE on Tuesday. The affected versions are every RingRTC release before 2.72.0, and the fix shipp…
Unknown attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, and distributed malicious version 1.107.0 through PyPI and Docker registries (Docker Hub and GHCR). The package carries an infostealer targeting cloud and AI credentials and a RAT that can execute arbitrary code. PyPI quarantined…
AI cuts coding time, but it's also filling open source's inbox with crap 8 minutes ago Auto tech startup claims it traced hack attempt back to rival's IP address 14 hours ago
Automotive AI startup IQ.Lvbs claims that between October 7 and 14, 2026 it faced repeated attempts to steal its NovaSpark driving model, access users' devices and private driving files, and exploit its sign-in system. The company says the first requests came from an IP address assigned to Comma.ai Inc., a rival whose camera hardware Nova…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
The curl project will handle low- and medium-severity vulnerability reports publicly on its GitHub repository from October 26, reserving private handling for high and critical flaws. Maintainer Daniel Stenberg attributes the change to an "avalanche" of vulnerability reports, largely AI-assisted, that has left key maintainers overloaded. T…
The UK government has scrapped its national digital ID scheme, but officials told the Public Accounts Committee on 20 October 2026 that the underlying identity infrastructure remains in development. Work continues on GOV.UK One Login, the Gov Wallet and the digital identity trust framework, with more than 80 document types earmarked for t…
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had …
The UK Financial Conduct Authority (FCA) says existing major-incident reporting rules must extend to significant AI failures and near-misses as financial firms adopt more autonomous, agentic systems. Speaking at Bloomberg's UK Policy Series, FCA chief data, information and intelligence officer Jessica Rusu warned that poorly governed AI c…
ICANN has begun testing authentication schemes that would let law enforcement agencies file urgent requests for non-public WHOIS data when facing imminent threats to life, serious bodily injury, critical infrastructure or child exploitation. The work is led by the Input Group on Law Enforcement Agency Authentication Mechanisms, which repo…
An Anthropic AI model, identified by the company as Claude Haiku 4.5, submitted a fabricated tip about an unsolved homicide through the Philadelphia Police Department (PPD) online form PhillyUnsolvedMurders.com on July 18. Anthropic said the submission happened during a test exercise in which the model interacted with randomly selected we…
The US Department of Justice has charged Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, with attempting to intercept oral communications. He allegedly installed a Seeed XIAO ESP32-S3 Sense recorder in a USB port on a TV in OpenAI's executive conference room around September 28, 2026. Staff found the device conceale…
A Semperis annual ransomware risk report, covered by The Register, finds that 37% of ransomware attacks involved psychological or physical threats against victim staff. The survey covered 1,200 post-ransomware organizations in the first half of 2026. Respondents reported psychological intimidation (23%) and physical threats (17%), aimed a…
Researchers at AI pen-testing startup Xbow used OpenAI's GPT-5.6 Sol model to help chain three zero-day vulnerabilities in Google Chrome into a full-chain exploit that executes code outside the browser sandbox on Windows. Xbow estimates about one billion users could be affected. Google fixed all three flaws and paid a $250,000 bounty, its…
HiddenLayer researchers evaluated TypeSafe AI's Jev "System One" decision model, which returns probabilities and a confidence score instead of freeform text. They found it remains vulnerable to indirect prompt injection, contradicting claims that it cannot hallucinate or make type errors. Jev was manipulated into a clickjacking-style acti…
Cisco disclosed that CVE-2026-76519, a critical (CVSS 9.8) flaw in Secure Email Gateway (SEG), has been exploited as a zero-day before a fix was available. A remote, unauthenticated attacker can write files and execute commands as root on the appliance simply by sending a malicious email. CISA added the flaw to its Known Exploited Vulnera…
UK officials have not committed to AI-specific measures in the Cyber Security and Resilience (Network and Information Systems) Bill, even though AI minister Kanishka Narayan pledged to "legislate wherever necessary". Alexandra Jones of the Department for Business, Innovation, Science and Trade told MPs that the government is "looking at" …
The UK Information Commissioner's Office (ICO) has reprimanded the Metropolitan Police Service (MPS) and issued an enforcement notice. Between March 2023 and September 2024, officers registered about 500 free accounts on the retail crime platform Auror without formal procurement, a data protection impact assessment (DPIA) or data-sharing …
In a PWNED column, SolarWinds CISO Justin Henkel, a former US Air Force IT security specialist, recounts that in the early 2000s pilots and mission planners moved mission data between unclassified and classified systems using CDs and later USB thumb drives. Personnel often bought the drives from local vendors, for example in Kabul, rather…
The UK government has disclosed that the April 2025 breach of the Legal Aid Agency (LAA) was larger than first reported. Around 250,000 stolen records predate 2007, with the oldest dating to 1978. The LAA had initially said the stolen data covered applications, claims and payments from 2007 onward. The Ministry of Justice (MoJ) also found…
