Search: “Amcrest”

28 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 1 Research 1 Threat actor 1

SeverityAll critical 0 high 0 medium 1 low 2 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-627: Backblaze Personal Computer Backup bztransmit Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-627 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bztransmit component.

The Zero Day Initiative published advisory ZDI-26-627 describing a link-following denial-of-service vulnerability in the bztransmit component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 7d agoVulnerability 5 sources CVE-2026-19820

Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras

One actor compromised over 14,000 Dahua cameras in Ukraine and Russia using brute-force, authentication bypass, and cloud relay serial-number abuse.

Hunt.io reconstructed Operation CameraSwarm from an exposed operator directory, revealing one actor compromised 14,000+ Dahua cameras between June 17 and July 22, 2026, mainly in Ukraine and Russia. The toolkit included a brute-force engine, a two-flaw 2021 authentication-bypass chain planting a persistent backdoor account on 1,923 cameras, and abuse of Dahua's cloud relay where 89.4% of probed serials returned open, unauthenticated channels. A SalatStealer Windows binary and Defender-disabling PowerShell script were staged on the same server but appear unrelated to the camera campaign.

Security AffairsAug 19, 17:37 UTC · 28d agoThreat actor in the wildCVE-2024-39943 CVE-2025-31702

Schrödinger's backup: not actually recovered until you try to restore IT

The Register sponsored feature urges admins to verify backups through restore testing before an incident happens.

A sponsored feature from The Register argues that backups cannot be considered recovered until restore tests succeed. It promotes verification practices and vendor tooling for disaster-recovery readiness.

The Register · SecurityAug 27, 15:00 UTC · 20d agoIndustry

CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.

oss-securitySep 15, 18:21 UTC · 1d agoVulnerability CVE-2026-59739

ActReview: Rebuttal-Guided Training Data and Rubric Rewards for Actionable Peer Review Generation

ActReview post-trains Qwen3-8B-Base on OpenReview rebuttals to generate actionable peer-review feedback with grounded revision suggestions, benchmarked on 1,000 curated instances.

The paper defines Actionable Peer-review Generation as diagnostic claim generation plus revision suggestion generation and introduces ActReview, a rebuttal-guided post-training framework. From OpenReview review-rebuttal threads the authors build ActReview-40K, aligning reviewer weaknesses with author responses grounded in localized paper evidence, and post-train Qwen3-8B-Base with multi-task SFT followed by GRPO using weakness-specific rubric rewards. They also release ActReview-Bench, a human-curated 1,000-instance benchmark, on which ActReview outperforms prior specialized review-generation models on actionability and grounding while remaining competitive with strong prompt-based LLMs. Human evaluation confirms improved revision usefulness but identifies a remaining gap in technical accuracy.

Hugging Face daily papersSep 7, 20:00 UTC · 9d agoAI research

Fortunate Recall: Ontology-Driven Memory Lifecycle Management for Persistent Coherence in LLMs

Fortunate Recall introduces ontology-based lifecycle policies for LLM memory, cutting confabulation roughly in half (e.g., 45.1% to 22.4%) versus Mem0.

Fortunate Recall (FR) is a composable policy layer that classifies personal facts into a 10+1 behavioral ontology and applies category-specific lifecycle rules including differential temporal decay, slot-key supersession, event-time validity, and retrieval routing. FR-Bank scores 76.9% on the new 516-question LifecycleBench, ahead of Mem0, A-MEM, Memory-R1, and MemoryOS (61%-70.5%), and 75.2% on LongMemEval-S. End-to-end, confabulation drops from Mem0's 45.1% to 22.4% over answered queries, with the ranking replicating on open-weight Kimi K2.5 and transferring to the independent BEAM benchmark (46.8% vs 32.9%).

arXiv cs.AI / cs.LG / cs.CLSep 9, 16:31 UTC · 7d agoAI research

Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems

An empirical study finds no major agent-memory system enforces fact revocation at retrieval, causing agents to act on superseded, unsafe information.

Researchers tested five agent-memory systems across nine policy scenarios, nine models, and six defense conditions, tracking whether revoked facts are returned and acted upon. No system enforces revocation by default: revoked records are returned whenever the revocation label is visible to the retrieval layer, outrank their replacements, and lead agents to unsafe actions. The authors propose a backend-agnostic guard that sits between the agent and any memory store and withholds revoked or conflicting records at retrieval time.

arXiv cs.CRSep 8, 05:03 UTC · 8d agoAI safety & security

The 12 Best Managed Detection & Response (MDR) Services, Compared and Priced

Buyer's guide compares 12 MDR services, naming Huntress best value, CrowdStrike Falcon Complete for response authority and Expel for transparency.

The article compares 12 managed detection and response providers across response authority, tool bundling and pricing, highlighting Huntress for published SMB pricing and CrowdStrike Falcon Complete for unilateral containment. It stresses the consolidation landscape: Sophos completed its acquisition of Secureworks in February 2025 for approximately $859 million, and Arctic Wolf closed its purchase of BlackBerry's Cylance endpoint assets the same month. It also warns that only full-response contract tiers isolate hosts and kill processes, while lower tiers only triage or guide.

GBHackersupdated Sep 9, 08:07 UTC · 7d agofirst Sep 9, 07:56 UTC · 7d agoIndustry 3 sources1

"They don't care about this": A Systematic Study of TEE Build Reproducibility in the Wild

91% of 115 surveyed TEE deployments across Intel SGX, TDX, and AMD SEV fail to provide reproducible builds needed for verifiable remote attestation.

A systematic study of 115 TEE deployments found 91% were not reproducible and 80% lacked both source code and a reference build, undermining remote attestation guarantees. Interviews with 12 developers of 50 Intel SGX projects confirmed that only one participant treats reproducibility as a development priority. The authors identify technical barriers such as embedded timestamps plus ecosystem-level issues like lack of build-environment control in multi-stakeholder projects, and call for holistic, committed reproducibility practices.

arXiv cs.CRSep 10, 11:43 UTC · 6d agoResearch

Mars Security Launches Real-Time Intel-to-Detection Engine That Turns Live Threat Intelligence Into Backtested Detections in Minutes

Mars Security launched Real-Time Intel-Based Detection, converting advisories into MITRE ATT&CK-mapped, backtested detection rules for CrowdStrike, Wiz, and Splunk within minutes.

The capability turns newly published threat intelligence from CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence into validated detection rules within minutes, each backtested against 30 days of the customer's own telemetry before deployment. Rules are written in native query languages across CrowdStrike Falcon, Wiz, Splunk, firewalls, Linux Sysmon, identity providers, AWS telemetry, and data lakes such as Snowflake and Databricks, with no data ingestion or stack changes. The feature is available at no additional cost to existing customers and on AWS Marketplace. Mars also flags detection coverage gaps and extends monitoring to credentials leaked by AI coding agents.

Cyber Security NewsSep 8, 13:20 UTC · 8d agoTools1

Mercator ↔ Equal Earth

Simon Willison used GPT-6 Astra (medium) in ChatGPT Work to build an animated D3 transition between Mercator and Equal Earth map projections.

Willison built an animated transition between the Mercator and Equal Earth map projections using D3. The tool was generated by GPT-6 Astra (medium) in ChatGPT Work. Equal Earth is a projection recently voted on at the UN. The post is a vibe-coding demonstration rather than a security or major model event.

Simon WillisonSep 7, 16:24 UTC · 9d agoAI tools & infra1

ActReview: Rebuttal-Guided Training Data and Rubric Rewards for Actionable Peer Review Generation

ActReview post-trains Qwen3-8B-Base on 40K rebuttal-derived instances with rubric rewards to generate actionable, grounded peer-review feedback, plus a 1,000-instance benchmark.

The framework builds ActReview-40K from real OpenReview review-rebuttal threads, aligning reviewer weaknesses with author responses and grounding feedback in localized paper evidence. Qwen3-8B-Base is post-trained with multi-task supervised fine-tuning followed by GRPO using candidate-aware, weakness-specific rubric rewards. Experiments show improved actionability and grounding over prior specialized review-generation models, supported by ActReview-Bench, a human-curated 1,000-instance evaluation set. Human evaluation confirms better revision usefulness while noting a remaining gap in technical accuracy.

arXiv cs.AI / cs.LG / cs.CLSep 8, 17:30 UTC · 8d agoAI research

CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope non-recursive Any search can skip Realms restrictions, exposing objects outside an administrator's authorized realm (CVE-2026-73579).

CVE-2026-73579 is an incorrect authorization vulnerability in Apache Syncope where non-recursive Any search requests are transformed in a way that skips Realms restrictions, returning objects outside the administrator's authorized realm. Affected component is syncope-core-persistence-common 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-securitySep 14, 15:31 UTC · 2d agoVulnerability CVE-2026-73579

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net SecuritySep 8, 13:43 UTC · 8d agoTools

[0day-rubbish] DBxtra .NET 13.1.1.0 Unauthenticated SOAP API to xp_cmdshell code execution (9.8)

0day Rubbish disclosed an unauthenticated SOAP API flaw in DBxtra .NET 13.1.1.0 enabling xp_cmdshell command execution, rated CVSS 9.8.

The 0day Rubbish Research Team disclosed an unauthenticated remote code execution vulnerability in DBxtra .NET 13.1.1.0, classified as CWE-306 (missing authentication). The flaw is reachable via the unauthenticated SOAP API and abuses SQL Server's xp_cmdshell to run operating system commands. It is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No CVE identifier or exploitation evidence was provided in the disclosure.

Full DisclosureSep 8, 17:31 UTC · 8d agoVulnerability 2 sources

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security NewsSep 8, 12:10 UTC · 8d agoThreat actor in the wild

CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search

Apache Syncope's JPA persistence layer allows SQL injection via the sort parameter in Task search, affecting all releases through 4.1.2.

CVE-2026-82232 is rated important by upstream: improper neutralization of special elements in an SQL command allows SQL injection through the sort parameter in Task search within syncope-core-persistence-jpa. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation in the wild is reported.

oss-securityupdated 13:21 UTC · 6h agofirst Sep 14, 15:54 UTC · 2d agoVulnerability 3 sources CVE-2026-82232

The EU CRA's Real Question: What Shipped, and When Did You Know?

ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.

An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.

BleepingComputerSep 8, 20:24 UTC · 7d agoPolicy & legal

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AISep 7, 11:00 UTC · 9d agoAI industry

ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92203, CVSS 7.7) in Airbyte's SharePoint connector, exploitable by authenticated remote users.

The Zero Day Initiative published ZDI-26-703 describing a server-side request forgery vulnerability in the _get_shared_drive_object function of Airbyte's SharePoint connector. Remote attackers can initiate arbitrary server-side requests to disclose information, though valid authentication credentials are required. The flaw carries a CVSS score of 7.7 and is tracked as CVE-2026-92203; it is flagged as a 0day with no vendor patch referenced.

ZDI Published Advisories05:00 UTC · 15h agoVulnerability 2 sources CVE-2026-92203

CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session on Apache Artemis and ActiveMQ Artemis. Affected versions are artemis-server 2.50.0 through 2.56.0 in Apache Artemis and artemis-server 1.0.0 through 2.44.0 in Apache ActiveMQ Artemis. Apache rates the issue important.

oss-securitySep 10, 00:46 UTC · 6d agoVulnerability 7 sources CVE-2026-579671

CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.

CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.

oss-securitySep 15, 18:24 UTC · 1d agoVulnerability CVE-2026-79993

The Frontier AEO Tracker: What Astra Chooses (and every other frontier model, and what you can do about it)

Latent Space launches an AEO tracker scoring 7 frontier models' product recommendations across 161 categories, revealing generational bias flips.

Latent Space built a tracker measuring Answer Engine Optimization by running 6 prompt variations across 7 frontier models with search enabled over 161 product categories, scoring first choices, alternatives, mentions, and anti-recommendations. It found 28 categories with a universally dominant primary choice and observed soft biases, such as models favoring their own lab's coding agents. Analysis of Anthropic's Sol→Astra and Opus→Fable generations showed newer models consulting fewer sources and being less likely to change answers when questions are paraphrased.

Latent SpaceSep 7, 21:32 UTC · 8d agoAI research

E2A-Bench: Benchmarking Evidence-to-Action Reliability in Financial Chart Reasoning

E2A-Bench, a 969-query financial chart reasoning benchmark, finds VLMs fail evidence-to-action consistency, with fine-tuning amplifying BUY:SELL bias 4-6x.

E2A-Bench is a 969-query benchmark built from 323 HS300 constituents across three input modalities with deterministic OHLCV-derived evidence anchors, evaluating grounding, reasoning-action consistency, evidence-confidence calibration, and directional coverage via UCR, RCI, ECI, and NDR metrics. Testing 20 VLMs showed the lowest-hallucination model ranked near the bottom on coverage with only 6.4% directional coverage, and oracle-aided verification reduced unsupported claims but could collapse coverage. Financial fine-tuning amplified the BUY:SELL ratio by factors of 4.21 to 4.68 across base-fine-tuned pairs.

Hugging Face daily papersSep 12, 20:00 UTC · 4d agoAI research

ZDI-26-562: (Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability

ZDI-26-562 details an unauthenticated, network-adjacent SSRF in the Home Assistant Green mDNS server, rated CVSS 5.4 and originally demonstrated at Pwn2Own.

A server-side request forgery in Home Assistant Green's mDNS service lets network-adjacent attackers initiate arbitrary server-side requests without authentication. The Zero Day Initiative assigned the flaw a CVSS 5.4 rating under advisory ZDI-26-562. The finding originated from Pwn2Own, and no exploitation in the wild is reported.

ZDI Published AdvisoriesAug 12, 05:00 UTC · Aug 12, 2026Vulnerability

Does Your Agent's Memory Survive a Model Upgrade? A Controlled Study of Memory Portability

A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.

The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.

arXiv cs.AI / cs.LG / cs.CLSep 4, 16:44 UTC · 12d agoAI research1

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker NewsSep 4, 14:51 UTC · 12d agoThreat actor in the wild

CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers

Apache Syncope SRA CVE-2026-73191 enables CAS service URL injection via Forwarded HTTP headers.

Apache Syncope disclosed CVE-2026-73191, a moderate-rated open redirect vulnerability in the Syncope SRA. When the SRA is configured for CAS authentication, the target Apereo CAS service URL can be manipulated through Forwarded HTTP headers, redirecting users to an untrusted site. The flaw affects syncope-sra in versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed releases.

oss-securitySep 14, 15:21 UTC · 2d agoVulnerability CVE-2026-73191