Search: “usb”

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

DEF CON researchers chained Windows Plug and Play auto-install abuse with third-party driver flaws to reach SYSTEM on fully updated Windows 11.

In 'Plug And Pwn' research prepared for DEF CON 34, Alejandro Hernando and Borja Martinez emulated USB devices so Windows auto-installed signed vendor software, chaining a Sierra Wireless SwiService.exe SetDNS primitive, a Sony FeliCa co-installer path-traversal flaw that writes a DLL into System32, and device reconnection for SYSTEM code execution. A remote variant over Remote Desktop forges a synthetic Intel RealSense device and abuses a CRYPTBASE.dll search-order hijack when PnP or low-level USB redirection is enabled. Microsoft notes RDP does not allow supported PnP and RemoteFX USB redirection by default, and no in-the-wild exploitation has been reported.

The Hacker News·Aug 11, 10:48 UTC · Aug 11, 2026Research

HuggingFace: Security.txt

Hugging Face published a security.txt file, prompting limited Hacker News discussion of the RFC 9116 disclosure standard.

Hugging Face's security.txt file, which lists its security contact and disclosure channels per the RFC 9116 standard, drew attention on Hacker News. The RFC 9116 standard lets organizations publish where and how security researchers should report issues, but the submission received only one comment.

Hacker News · security·updated Sep 11, 16:04 UTC · 5d ago·first Sep 11, 14:38 UTC · 5d agoIndustry 2 sourcesHN 22↑ · 1 comments

Thelio Mira AI Linux Workstation: 192 GB GPU Memory

System76 launches the Thelio Mira AI Linux workstation from $3,299 with dual NVIDIA RTX Pro 6000 GPUs and 192 GB GPU memory for local AI workloads.

System76's Thelio Mira AI is a locally built (Denver, Colorado) Linux workstation for AI training, fine-tuning, and inference, starting at $3,299. Configurations go up to a 16-core AMD Ryzen 9000 CPU, 192 GB DDR5 RAM, and dual NVIDIA RTX Pro 6000 Blackwell GPUs delivering 192 GB of (ECC) GPU memory with liquid cooling, dual PCIe 5.0 x16 slots, and up to three M.2 NVMe drives. It ships with Pop!_OS 24.04 LTS or Ubuntu and is positioned as a way to avoid recurring cloud GPU costs.

Hacker News · AI·Sep 10, 23:10 UTC · 5d agoAI industryHN 44↑ · 27 comments

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security News·Sep 10, 08:05 UTC · 6d agoIndustry

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-31583

Cisco RoomOS Stack Overflow Vulnerability

Cisco fixed a stack overflow in the RoomOS USB driver allowing physical-access attackers to execute code with root privileges.

Insufficient boundary checks in the USB driver of Cisco RoomOS allow a buffer overflow when specific data is supplied through the USB port. An unauthenticated local attacker with physical access can connect a malicious USB device and execute arbitrary code with root privileges. Cisco has released software updates and no workarounds address the issue.

Cisco Security Advisories·Aug 19, 16:00 UTC · 28d agoAdvisory

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Tick Group Weaponized Secure USB Drives to Target Air

Unit 42 says the Tick group weaponized South Korean certified secure USB drives with SymonLoader malware to reach air-gapped Windows XP systems.

Unit 42 discovered that the Tick cyberespionage group, which targets Japan and South Korea, compromised an ITSCC-certified secure USB drive made by a South Korean defense company and used a new loader named SymonLoader to extract a hidden executable from these drives. SymonLoader only infects Windows XP and Windows Server 2003, suggesting deliberate targeting of legacy air-gapped systems used by government and defense organizations. The group also delivered HomamDownloader and SymonLoader via Trojanized Korean and Japanese software sent as spearphishing attachments. Unit 42 believes the attacks occurred multiple years ago and that this malware is not part of an active campaign.

Palo Alto Unit 42·Aug 17, 12:55 UTC · Aug 17, 2026Threat actor in the wild1

Microsoft releases emergency Windows updates to fix RDS failures

Microsoft released emergency out-of-band Windows updates fixing Remote Desktop Services failures and Hyper-V issues caused by September 2026 security patches.

Microsoft issued out-of-band updates on September 14, 2026 to fix Remote Desktop Services instability introduced by the September security updates, which caused RDP connection and sign-in failures and unresponsive servers. Updates include KB5129194 (Windows 11 26H1), KB5129195 (Windows 11 24H2/25H2), KB5129236 (Windows 10), KB5129235 (Windows Server 2025), and KB5129237 (Windows Server 2022). The Windows 11 updates also fix a Hyper-V Plan9 shared folder issue and some USB Audio Class 1.0 multichannel problems, though remaining USB audio issues await a fix. Admins had previously used Group Policy mitigations or uninstalled the security updates, which removed security protections.

BleepingComputer·updated Sep 15, 08:40 UTC · 1d ago·first Sep 14, 20:52 UTC · 1d agoAdvisory 3 sources1

11 Best Device Control & USB Security Tools Compared (2026): Features & Pricing

2026 comparison of 11 device control and USB security tools ranks CoSoSys Endpoint Protector first for cross-platform control and DLP.

An editorial scorecard evaluates eleven device control and removable-media security tools across granularity, content-aware DLP, cross-platform parity, encryption/shadowing, and value. CoSoSys Endpoint Protector (now part of Netwrix) leads at 4.60 for genuine Windows, macOS, and Linux parity, with Ivanti DeviceLock at 4.25 for the deepest Windows peripheral control and Safetica positioned for SMB and mid-market value. Enterprise content-aware DLP anchors include Symantec (Broadcom), Forcepoint, Digital Guardian (Fortra), and Trellix, with pricing almost always per endpoint.

GBHackers·updated 09:52 UTC · 8h ago·first Sep 11, 07:08 UTC · 5d agoIndustry 14 sources

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.

Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.

Zscaler ThreatLabz·15:13 UTC · 3h agoThreat actor in the wild

CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives

CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.

CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.

arXiv cs.CR·Sep 9, 15:44 UTC · 7d agoResearch1

Microsoft Releases Emergency Windows 11 Update Following Patch Tuesday Bugs

Microsoft issued emergency Windows 11 update KB5129195 to fix Patch Tuesday regressions and fully close the CVE-2026-62721 privilege escalation flaw.

Microsoft shipped out-of-band cumulative update KB5129195 for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457) after the September 8 Patch Tuesday rollup, which addressed over 960 CVEs including two actively exploited flaws, broke Remote Desktop Services, Hyper-V Plan9 folder sharing, and USB audio. The emergency release also strengthens the incomplete fix for CVE-2026-62721, an elevation-of-privilege flaw in the Windows User-Mode Power Service that could let a local attacker gain SYSTEM privileges. Companion patches cover Windows 11 26H1, Windows 10, and Windows Server. Some USB Audio Class 1.0 and AMD Radeon graphics issues remain unresolved.

Cyber Security News·07:45 UTC · 11h agoVulnerability in the wildCVE-2026-62721

Incident response statistics and cases at educational institutions in Brazil

Kaspersky Securelist·Aug 3, 13:00 UTC · Aug 3, 2026Ransomware

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CR·Sep 4, 11:23 UTC · 12d agoResearch

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News·Sep 1, 06:34 UTC · 15d agoThreat actor in the wild

GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi

Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.

A vulnerability in Canonical's grub-efi-amd64-signed (gcdx64.efi, GRUB 2.14) exposes a serial command that accepts a caller-supplied 64-bit MMIO base address. The lockdown path does not restrict this command even when lockdown=y under UEFI Secure Boot, and the serial implementation does not validate that the requested register span belongs to a real UART rather than ordinary RAM. A local attacker with control of GRUB's boot configuration can abuse this to bypass the Secure Boot lockdown.

oss-security·Sep 13, 13:59 UTC · 3d agoVulnerability2

Top 10 Best Data Security Posture Management (DSPM) Tools in 2026

A 2026 scorecard ranks DSPM tools with Wiz and Cyera tied first, documenting consolidation via Palo Alto, Rubrik, Proofpoint, and CrowdStrike acquisitions.

The article ranks ten DSPM platforms: Wiz and Cyera tie at 8.7/10, followed by BigID at 8.5 and Securiti at 8.4, scored on discovery breadth, classification accuracy, access context, remediation, and value. It highlights heavy market consolidation, noting Dig Security was acquired by Palo Alto Networks, Laminar by Rubrik, Normalyze by Proofpoint, and Flow Security by CrowdStrike. Buyers are advised to purchase from current owners and confirm post-acquisition integration state.

Cyber Security News·07:29 UTC · 11h agoIndustry1

How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

Lobsters · security·Sep 10, 14:59 UTC · 6d agoResearch

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 8d agoResearch1

Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software

Position paper proposes hierarchical software quality assurance to characterize and secure EV charging station software attack surfaces.

The authors argue that charging station supply-equipment software is a largely unprotected and poorly characterized attack surface in EV charging infrastructure. They advocate applying hierarchical software quality assurance (HSQA) to this specialized software, spanning from individual vulnerabilities such as CVEs to high-level characteristics like the CIA Triad. HSQA embeds quality and security considerations across the entire software development lifecycle to assess and improve charging station software security.

arXiv cs.CR·Sep 9, 17:37 UTC · 7d agoResearch

Global sinkhole operation ends Sality botnet’s 23-year run

Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.

Sality, active since 2003 as a file-infecting virus with two P2P networks (versions 3 and 4), distributed credential thieves, spam, proxies, and DDoS payloads, and most recently delivered the EggJagger clipboard hijacker that swapped cryptocurrency wallet addresses for at least $150,000 in operator profit. A coordinated sinkhole operation replaced the botnet's super-peer list with defender-controlled sinkholes, and investigators in the US, Bulgaria, Hungary, and Romania seized payload domains. The Shadowserver Foundation is coordinating ISP and CERT notifications to infected device owners.

Help Net Security·Sep 2, 00:00 UTC · 14d agoMalware1

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability Notes·Sep 8, 15:05 UTC · 8d agoVulnerabilityCVE-2026-20293CVE-2026-33197CVE-2026-6485

The September 2026 Security Update Review

ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.

The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.

Zero Day Initiative Blog·Sep 8, 18:32 UTC · 8d agoAdvisory in the wildCVE-2026-85880CVE-2026-81963CVE-2026-70352+27 CVEs1

Record, train, and deploy from one place with Strands Agents, LeRobot, and Hugging Face Storage Buckets

Hugging Face, Strands Agents, and LeRobot integrate with Storage Buckets for a unified record-train-deploy robotics data workflow.

Hugging Face announced an integrated robotics workflow combining LeRobot, Amazon's Strands Agents, and Hugging Face Storage Buckets. The setup lets developers record robot data, stream it in a data loop, train models, and deploy agents from a single place. No article body was available, so details beyond the title are limited.

Hugging Face Blog·Aug 13, 17:16 UTC · Aug 13, 2026AI tools & infra

Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum

Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.

Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.

Security Affairs·Aug 12, 08:27 UTC · Aug 12, 2026Malware in the wild

USN-8729-1: Linux kernel vulnerabilities

Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.

Ubuntu released USN-8729-1 addressing several security issues discovered in the Linux kernel that could allow an attacker to compromise the system. Fixes span ARM32/ARM64/PowerPC architectures, Bluetooth, GPU, InfiniBand, and network drivers, plus the Microsoft Azure Network Adapter (MANA) driver. The update also corrects flaws in the SCSI and SPI subsystems, SMB and NTFS3 file systems, EFI core, and file systems infrastructure.

Ubuntu Security Notices·Sep 7, 09:08 UTC · 9d agoAdvisory 6 sources

Opaque recurrence, and other AI terms that you should probably know

TechCrunch updates its plain-English glossary defining common AI terms from AGI and agents to chain-of-thought reasoning.

TechCrunch maintains a regularly updated glossary of AI terminology, defining terms such as AGI, AI agents, API endpoints, chain of thought, coding agents, compute, deep learning, and diffusion. It highlights 'opaque recurrence', the reasoning technique in OpenAI's new Astra model that has drawn attention from AI safety researchers. The piece is an educational living document rather than new research or a product announcement.

TechCrunch · AI·Sep 7, 19:24 UTC · 8d agoAI industry1

[remote] D-Link DNS_340L - OS Command Injection

An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.

Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Top 10 Best Application Control & Allowlisting Tools in 2026

Roundup ranks 2026 application allowlisting tools, scoring ThreatLocker 8.8/10, Airlock Digital 8.5/10 and free Microsoft WDAC among top default-deny options.

This is a scored buyer's guide to ten application control and allowlisting tools for 2026, with ThreatLocker ranked first (8.8/10), Airlock Digital second (8.5/10) and Microsoft's built-in WDAC/AppLocker third (7.2/10). It notes ransomware has renewed interest in default-deny execution controls and that CISA and other agencies list application control among the most effective yet under-deployed mitigations. The evaluation is research-based with no lab testing, weighting policy automation at 30% and operability at 25%.

Cyber Security News·Sep 9, 07:59 UTC · 7d agoIndustry1

Windows 11’s strongest security defenses can be bypassed without a screwdriver

Researchers found a script-only attack, 'Download More RAM', that rewrites DIMM configuration chips to bypass Windows 11 VBS and HVCI security boundaries.

Researchers at the University of Birmingham and Durham University showed that overwriting configuration data on unprotected DDR4/DDR5 module chips creates memory aliases that let attackers with existing privileged access defeat Virtualisation-based Security and HVCI, re-enable blocklisted drivers, kill EDR, and bypass group policy. Microsoft assigned CVE-2026-23670 and shipped mitigations in its April 2026 updates; systems with Secure Boot enabled are protected. Affected unprotected product lines are estimated at more than half of the high-performance consumer memory market and over 70% of the gaming segment.

Help Net Security·Aug 17, 00:00 UTC · Aug 17, 2026VulnerabilityCVE-2026-236701

Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says

The Record·Aug 3, 12:21 UTC · Aug 3, 2026Malware

Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode

Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.

Marimo addressed CVE-2026-75149, a high-severity code injection flaw allowing attacker-supplied Model Context Protocol (MCP) commands to execute as local subprocesses when a crafted notebook is opened in edit mode, before any cell runs. The issue affects versions prior to 0.23.15, carries CVSS v4 of 8.7 and CVSS v3.1 of 8.8, and requires user interaction but no authentication. Marimo fixed it in version 0.23.15 (released July 23, 2026) via a PEP 723 hardening patch that treats notebook metadata as attacker-controlled and strips ai, mcp, completion, secrets, and server configuration sections. VulnCheck's CNA also disclosed CVE-2026-67618 (CVSS 7.1), involving an attacker-controlled AI base_url that exfiltrates operator API keys, and earlier CVE-2023-39987, a missing auth on /terminal/ws endpoint allowing full PTY shell access.

The Hacker News·Aug 25, 12:43 UTC · 22d agoVulnerabilityCVE-2026-75149CVE-2026-67618CVE-2026-39987

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security·Aug 28, 00:00 UTC · 19d agoPhishing & fraud in the wild

How Hugging Face Inference Endpoints, Jobs, and Buckets Power Search on Papers with Code

Hugging Face explains how Inference Endpoints, Jobs, and Buckets power semantic search on Papers with Code.

Hugging Face describes the infrastructure behind search on Papers with Code, built on its Inference Endpoints, Jobs, and Buckets services. The post is a product-focused engineering walkthrough with no security impact.

Hugging Face Blog·Aug 21, 00:00 UTC · 26d agoAI tools & infra

Cybersecurity jobs available right now: April 21, 2026

Help Net Security·Aug 6, 12:16 UTC · Aug 6, 2026Vulnerability

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.

Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.

arXiv cs.CR·Sep 9, 09:51 UTC · 7d agoResearch

German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.

Cyber Security News·15:12 UTC · 3h agoIndustry 2 sources

Arbitrary process termination from exposed minifilter communication port

Fortinet FortiClient Windows fortimon3 driver flaw (CVSS 4.7) lets authenticated attackers terminate arbitrary processes via exposed minifilter communication port.

Fortinet advisory FG-IR-26-165 discloses an unverified ownership vulnerability (CWE-283, CVSSv3 4.7) in the FortiClient Windows fortimon3 minifilter driver. An authenticated attacker can terminate arbitrary processes through an exposed minifilter communication port. The advisory was revised on 2026-09-08.

Fortinet PSIRT·Sep 8, 07:00 UTC · 8d agoAdvisory1

Microsoft confirms KB5002914 Excel update breaks copy and paste

Microsoft confirms KB5002914 Office security update silently breaks copy-paste, autofill, and formula dragging in Excel 2016 through 2024.

Microsoft confirmed the September 2026 KB5002914 security update breaks copy-and-paste, autofill, and formula dragging in Excel 2024, 2021, 2019, and 2016. Failures occur silently with no beep or error message, leaving the destination unmodified. Uninstalling KB5002914 via OfficeC2RClient or Oarpmany restores functionality while Microsoft investigates.

BleepingComputer·updated Sep 15, 09:25 UTC · 1d ago·first Sep 15, 08:40 UTC · 1d agoAdvisory 3 sources1