Search: “computability”

14 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 107 AI safety & security 83 AI research 80 Research 59 Policy & legal 43 Threat actor 41 Malware 38 Model release 35 Industry 34 AI tools & infra 23 Exploit / PoC 22 Advisory 20 Data breach 17 Vulnerability 16

SeverityAll critical 8 high 85 medium 116 low 19 info 432

ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.

The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoVulnerability 5 sources CVE-2026-19820

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputer20:39 UTC · 1h agoVulnerability

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security NewsSep 15, 15:51 UTC · 1d agoVulnerability CVE-2026-65414 CVE-2026-84607 CVE-2026-64752+7 CVEs1

LG TV flaws could let attackers listen in, even in standby mode

Researchers found LG smart TVs collect network data and ACR viewing profiles, and demonstrated microphone audio capture plus undisclosed RCE vulnerabilities.

An investigation by Gamers Nexus with Level1Techs and independent researchers found LG TVs performing network discovery, collecting nearby Wi-Fi names and device identifiers, and conducting Automated Content Recognition (ACR) tracking. They demonstrated microphone audio capture even when the TV appeared off, and audio buffering while the TV was unplugged from the internet. Remote-code-execution vulnerabilities were reported to LG under ongoing responsible disclosure, with full details not yet public.

Malwarebytes LabsSep 7, 13:34 UTC · 9d agoVulnerability

CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.

Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.

oss-security16:04 UTC · 5h agoVulnerability CVE-2026-89775

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.

The Hacker News13:14 UTC · 8h agoVulnerability 4 sources CVE-2026-90894

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · SecuritySep 15, 21:38 UTC · 1d agoVulnerability CVE-2026-65410 CVE-2026-65409 CVE-2026-43689+10 CVEs

VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

CERT/CC details CVE-2026-84286, an out-of-bounds memory access in ExLlamaV3's CUDA extension causing denial-of-service crashes; fixed via merged pull request.

CERT/CC published VU#369611 for CVE-2026-84286, an out-of-bounds memory access in the exllamav3_ext CUDA extension of the ExLlamaV3 LLM inference library. A crafted input with kernel parameter K set to 0 produces a negative index into a fixed 24-entry kernel dispatch array, causing a CUDA illegal memory access and denial-of-service crashes. The vendor fixed the issue in the main repository via pull request #310, and maintainers of 49 downstream projects, including ezexl3 and MawDiscord, are advised to rebuild against the patched version. The issue was reported by Nathan Keys and impact is limited to crashes and instability, not code execution.

CERT/CC Vulnerability NotesSep 11, 20:11 UTC · 5d agoVulnerability CVE-2026-842861

Skullcandy Dime 3 Bluetooth Flaw Lets Nearby Attackers Hijack Audio and Spy Through Microphone

Skullcandy Dime 3 earbuds on firmware 1.0.0.28 accept unauthenticated Bluetooth pairing via Airoha SDK flaw CVE-2025-20701, enabling audio hijack and microphone capture.

CERT/CC vulnerability note VU#859658 describes insecure Bluetooth Classic (BR/EDR) pairing on Skullcandy Dime 3 (model S2DCW) firmware 1.0.0.28, linked to CVE-2025-20701 in the Airoha Bluetooth audio SDK. The NoInputNoOutput I/O capability lets unknown nearby devices pair without pairing mode, PIN, passkey or user interaction, then bond and automatically reconnect. An attacker can hijack the A2DP audio session and access Hands-Free or Headset profiles to capture live microphone audio. Firmware 1.0.0.30 reportedly fixes the flaw, but the earbuds cannot be updated through the Skullcandy app, leaving current users without a consumer-accessible patch path.

Cyber Security NewsSep 11, 04:16 UTC · 5d agoVulnerability 2 sources CVE-2025-20701

Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.

Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.

The Hacker NewsSep 9, 10:43 UTC · 7d agoVulnerability in the wild1

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability NotesSep 8, 15:05 UTC · 8d agoVulnerability CVE-2026-20293 CVE-2026-33197 CVE-2026-6485

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

Citrix patches critical NetScaler Gateway and AAA authentication bypass CVE-2026-19490 (CVSS 9.3) plus a SIP ALG memory overflow flaw; exploitation attempts observed.

Citrix fixed CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting customer-managed NetScaler ADC and Gateway appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers, and CVE-2026-19489 (CVSS 8.8), a memory overflow causing DoS when SIP ALG is enabled in Large Scale NAT groups. Updates are available in versions 14.1-73.32, 13.1-63.21, and corresponding FIPS/NDcPP builds, while Citrix-managed cloud services were already patched. The flaws were reported by Samarth Vashisht of JPMorgan Chase's penetration-testing team, and Previdian later observed 10 exploitation attempts against CVE-2026-19490 from six unique IP addresses in Australia, Germany, Japan, and the US, with no confirmed compromise.

The Hacker NewsSep 4, 17:00 UTC · 12d agoVulnerability in the wildCVE-2026-19489 CVE-2026-19490 CVE-2026-8451

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.

Plex released fixes in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 for multiple undisclosed security flaws, with CVE identifiers requested and details not yet published. Censys data shows more than 360,000 devices expose the Plex Media Server web interface. Past Plex flaws saw real exploitation, including CVE-2020-5741 (CVSS 7.2), used to implant a keylogger on a LastPass employee's home computer during the 2022 breach, and CVE-2025-34158 (CVSS 8.5), an authentication bug patched in August 2025.

The Hacker NewsSep 4, 07:35 UTC · 12d agoVulnerability CVE-2025-34158 CVE-2020-5741

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

CVE-2026-80047: Hugging Face Transformers 4.49.0 through 5.8.1 writes attacker-controlled Python files to disk before the trust_remote_code consent check.

CERT/CC vulnerability note VU#456290 describes CVE-2026-80047 in the Hugging Face Transformers library, affecting versions 4.49.0 through 5.8.1. The library performs a remote module fetch and writes attacker-controlled Python files to the local disk before evaluating the trust_remote_code consent prompt, without user authorization. This violates the security contract enforced across other dynamic module-loading paths in the library. Transformers is a primary framework for training and inference across NLP, vision, audio, video, and multimodal machine learning systems.

CERT/CC Vulnerability NotesSep 1, 13:35 UTC · 15d agoVulnerability CVE-2026-800471