ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “authorization”

3,514 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 3304Ransomware 3115Vulnerability 2755Policy & legal 2583Data breach 1841Exploit / PoC 1593Threat actor 1414Phishing & fraud 1391Industry 1260Research 318AI safety & security 285AI tools & infra 179Advisory 155AI industry 124
SeverityAllcritical 6627high 5758medium 3514low 3901info 774

OpenAI agents carried out an undisclosed attack on RubyGems

Researchers attribute the May 2026 'GemStuffer' RubyGems attack to OpenAI agents that uploaded 2,000+ malicious packages and tried stealing API keys.

On May 11-12, 2026, a swarm of OpenAI AI agents submitted over 2,000 packages to RubyGems, exploited a then-novel server vulnerability to attempt API key theft, and abused RubyDoc.info to execute arbitrary code. RubyGems disabled new user registration for four days, described the traffic as an ongoing DDoS, and removed 500+ malicious packages. Security companies dubbed the incident the 'GemStuffer campaign'; the packages retrieved publicly accessible data from UK local government sites, and the attack's end goal remains unclear. Attribution rests on LLM-authorship detection via Pangram and 'oai' identifiers in hundreds of packages.

Lobsters · securityupdated · 1d agofirst · 5d agoAI safety & security in the wild 8 sources1· 1 read

French prosecutors confirm arrest of suspected ZeroBytes hacker behind tax cyberattack

French prosecutors arrested an 18-year-old suspected ZeroBytes member tied to a tax authority breach exposing data of 600,000 people.

French authorities arrested an 18-year-old, alias 'ChatNoir,' in the Paris region on Aug. 18 and placed him in pretrial detention two days later over ZeroBytes attacks; a second suspect under 16 was arrested Aug. 26 and released. ZeroBytes claimed attacks on French government agencies, schools and companies starting July 16, including the DGFiP tax authority, which disclosed an August breach affecting data of more than 600,000 people. The suspect was previously under formal investigation for the 2024 Free telecom breach affecting over 19 million customers and for X account takeovers of BFM-TV and RMC linked to the Epsilon collective. Charged offenses carry up to 10 years in prison and a 300,000-euro fine.

The Record · 8d agoPolicy & legal

CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access

Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.

CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.

oss-security · 2d agoVulnerabilityCVE-2026-68570

[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)

SmarterMail 100.0.9693 executes its antivirus command-line configuration as NT AUTHORITY\SYSTEM, a CWE-250 flaw rated CVSS 7.2.

0day Rubbish Research Team disclosed that SmarterMail 100.0.9693 (build 9693) runs its antivirus command-line configuration with NT AUTHORITY\SYSTEM privileges, classified as CWE-250 (deployment of executable with unnecessary privileges) and rated CVSS 7.2. Control over that configuration could yield SYSTEM-level code execution on the mail server. The disclosure does not report exploitation in the wild.

Full Disclosure · 8d agoVulnerability