ZCS Command Injection via SNMP Handlers Enables Unauthenticated Remote Code Execution
A critical remote command execution vulnerability in the Zimbra Collaboration Suite, identified as CVE-2026-73570, poses risks by allowing unauthori…
AI & ML
⚑ Сообщить о проблемеПоследние новости AI & ML от Tech News
Все темы
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
claude
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration
CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed exploitation. It affects self…
Artifactory Vulnerabilities Under Active Exploitation Enable Authentication Bypass and Admin Access
Three Artifactory vulnerabilities under active exploitation enable authentication bypassing on Internet-accessible, self-hosted deployments, potenti…
AI-Assisted Discovery Helps Microsoft Patch More Than 1,000 Vulnerabilities in a Month
With its latest September 2026 Patch, which addresses more than 950 vulnerabilities, Microsoft has patched about 2,750 vulnerabilities so far this y…
Independent Investigation of Hugging Face Incident Reveals How Agents Collaborated and Behaved
After six days of on-site investigation at OpenAI, a small team of METR and Redwood Research researchers provided an account of how OpenAI agents be…
Google Mantis: An Agentic Vulnerability Scanning Harness for Reducing False Positives
Google has open-sourced Mantis, an AI-agent framework designed to automate the software vulnerability lifecycle, from identifying and validating vul…
BMC Vulnerabilities Put Thousands of Servers at Risk of Hardware-Level Compromise
Security researchers are warning that thousands of enterprise servers could be exposed to compromise through vulnerabilities in their Baseboard Mana…
npm Staged Publishing Available, Adding a Human Approval Step Before Packages Go Live
npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a…
Wiz Discloses CosmosEscape, and Practitioners Debate What Customers Could Have Done
Wiz Research disclosed CosmosEscape, a chain that escaped Azure Cosmos DB's Gremlin sandbox and reached a platform-wide key granting read and write…
GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates
Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades…
AI-Enabled Security Researchers Discover How a Crafted Video Can Provide Attackers Access to Your PC
JFrog Security Research revealed "PixelSmash," a vulnerability in the FFmpeg media framework, allowing for Remote Code Execution and Denial of Servi…
Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data
GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding…
BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways
BadHost is a high-severity authentication bypass vulnerability in the widely used Python web framework Starlette, with 325 million weekly downloads.…
A Trailing Slash Bypassed AWS API Gateway Authorization
A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthen…
Arm Open-Sources Metis, an AI Security Framework Outperforming Traditional SAST Tools
Arm has open-sourced Metis, an agentic AI security framework designed to autonomously uncover complex software vulnerabilities. Unlike traditional p…
Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution
Two recent Linux kernel vulnerabilities have been disclosed: Copy Fail (CVE-2026-31431) on April 29, 2026, and Dirty Frag (CVE-2026-43284 and CVE-20…
Attacker Bought 30 WordPress Plugins on Flippa and Backdoored All of Them
An attacker purchased 30+ WordPress plugins on Flippa for six figures, planted a PHP deserialization backdoor in the first commit, and waited eight…
Cloudflare Processes 10M+ Daily Insights with New Security Overview Dashboard
Cloudflare has launched a Security Overview dashboard that consolidates security signals into prioritized action items. It surfaces millions of dail…