A OpenAI achou uma falha que deixa um hacker tomar conta de servidores sem nem precisar de login.
Se você tem site, API ou qualquer serviço rodando em Node.js, Bun ou Envoy, atualiza hoje. Quem não mexe com servidor também entra na conta: mantém os apps do computador atualizados nos próximos dias, principalmente os feitos em Electron, e ferramentas como o curl.
A falha tá no Brotli, uma biblioteca de compressão do Google que vem embutida em muito software. E ela funciona nos dois sentidos: um servidor desatualizado que recebe dado comprimido pode ser invadido por um cliente malicioso, e um programa desatualizado que baixa dado comprimido pode ser invadido por um servidor malicioso.
A OpenAI encontrou isso no mesmo exercício de segurança que ela contou hoje, em que tirou o acesso dos modelos à internet durante o treino.
A correção já existe. O Google soltou versões novas do Brotli na quarta, e o Node.js corrigiu no mesmo dia nas versões 22.23.4, 24.22.1 e 26.12.1.
O problema é que o Brotli vem copiado dentro de outros programas, então cada um precisa lançar a própria atualização. A Aikido, empresa de segurança, avisa que ainda não tem correção pra todos os serviços afetados.
Vai ser um fim de semana longo pra quem cuida de segurança.
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their
Update to #PHP2Shell Alert: SIGMA rule helps identify potentially suspicious activity & incorporated partner resources. If your org can't update immediately or uses unsupported PHP 8.1 or earlier versions, take affected PHP-based systems offline until patched or updated.
Cisco Systems are used worldwide within infrastructure networks and include various password protection types. Brush up on Cisco password best practices to learn which types to use and avoid to better secure NSS and DIB networks against malicious actors. media.defense.gov/2022/Feb/17/20…#CybersecurityAwarenessMonth
Kimi vient de sortir un modèle open weight qui talonne Opus 5.5 en code 😱😱😱
K3.1 Pro fait 65,7 % sur Terminal-Bench 4.0 contre 66,4 % pour Opus 5.5, et ils l'ont mesuré dans le harness de Claude Code 👀 1M de contexte, 2,8T de paramètres dont 104B actifs.
Dispo dès maintenant en API, avec une version Highspeed 2 à 3x plus rapide, et les poids arrivent d'ici le 4 novembre. Petit détail qui fait plaisir : ils ont retiré les données cyber de la version open weight avant de la lâcher. Respect 🫡
UPDATE: Specific mitigation guidance for the recently identified PHP critical vulnerabilities is now available. Secure your servers today. Guidance and technical steps here: nsa.gov/Press-Room/Pre…
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
261K Followers 208 FollowingBreaking cybersecurity and technology news, guides, and tutorials that help you get the most from your computer. DMs are open, so send us those tips!
1.2M Followers 0 FollowingNational Security Agency/Central Security Service official account, home to America's codemakers and codebreakers. Likes, retweets, and follows ≠ endorsement.
234K Followers 6K FollowingFounder @Binary_Defense @TrustedSec. @WeHackHealth Pod. God + Family/Hacker/CSO/USMC/Intel/Fitness. Make the world a better place.
4.6M Followers 2K FollowingFounder and CEO, O'Reilly Media. Watching the alpha geeks, sharing their stories, helping the future unfold. Didn't pay for a blue check, cannot make it go away
10.3M Followers 627 FollowingSix thousand years ago, someone invented the plow, and we all got wealthier. A gentle reminder that all civilizational wealth is driven by invention.
4.9M Followers 545 FollowingChairman and CEO of @IBM, avid learner and listener, relentlessly focused on what's next, #GoodTechIBM, father, husband, @Illinois_Alma, @IITKanpur
5.3M Followers 292 FollowingStarted & runs 37signals (makers of Basecamp, HEY, and ONCE). Non-serial entrepreneur, serial author. DM or email me at [email protected].
6.0M Followers 126 Following@GM Chair and CEO leading an outstanding team with the ambition, talent and technology to create a world with zero crashes, zero emissions and zero congestion.
5.0M Followers 159 FollowingValues are most enduring thing leaders create. Engineering pioneer, proud grandfather, philanthropist, Christian, farm boy at heart.