Taklimat Pagi Saya

What We Missed: Did ShinyHunters 'Breach' ReliaQuest?

In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the latest antics of ShinyHunters to new research about the prevalence (or lack thereof) of AI-generated malware.

CVE-2026-15638 - Cryptographic Padding Oracle

CVE ID :CVE-2026-15638 Published : Sept. 15, 2026, 11:20 p.m. | 48 minutes ago Description :An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys.

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]

CVE-2026-85893 - Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

CVE ID :CVE-2026-85893 Published : Sept. 15, 2026, 11:19 p.m. | 48 minutes ago Description :Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. Severity: 8.8 | HIGH Visit the link fo

CVE-2026-83408 - Vulnerability in the Oracle GraalVM for JDK, Oracl

CVE ID :CVE-2026-83408 Published : Sept. 15, 2026, 10:17 p.m. | 1 hour, 50 minutes ago Description :Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is

mySCADA myPRO Manager

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the connected GSM modem. The following versions of mySCADA myPRO Manager are a

CVE-2026-15640 - Authentication Bypass via SAML Response Manipulation

CVE ID :CVE-2026-15640 Published : Sept. 15, 2026, 11:22 p.m. | 47 minutes ago Description :Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. Severity: 9.5 | CRITICAL Visit the link for more det

“We Think the Security Control Is Working” Is No Longer Good Enough

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. The post “We Think the Security Control Is Working” Is No Longer Good Enough appeared first o

Hackers target WordPress sites via third-party WooCommerce plugin

Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. [...]

Acronis warns of actively exploited flaw in its cPanel backup plugin

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild. [...]

CVE-2026-15639 - Reflected Cross-Site Scripting

CVE ID :CVE-2026-15639 Published : Sept. 15, 2026, 11:21 p.m. | 48 minutes ago Description :An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. Severity:

[webapps] PodcastGenerator 3.2.9 - Stored XSS

PodcastGenerator 3.2.9 - Stored XSS

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 202

[webapps] Marimo 0.20.4 - RCE

Marimo 0.20.4 - RCE

Siemens Teamcenter

View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious UR

CVE-2026-92184 - ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery

CVE ID :CVE-2026-92184 Published : Sept. 15, 2026, 11:30 p.m. | 39 minutes ago Description :A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python

CVE-2026-69486 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

CVE ID :CVE-2026-69486 Published : Sept. 15, 2026, 11:17 p.m. | 50 minutes ago Description :Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. Severity: 8.8 | HIGH Visit the l

CVE-2026-83357 - Vulnerability in the Oracle GraalVM for JDK, Oracl

CVE ID :CVE-2026-83357 Published : Sept. 15, 2026, 10:17 p.m. | 1 hour, 50 minutes ago Description :Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is

[webapps] Langflow 1.10.0 - RCE

Langflow 1.10.0 - RCE

Digital Watchdog VMAX DVR and NVR Product Lineups

View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Cybersecurity researchers have disclosed details of a multi-platform campaign that uses the Message Queueing Telemetry Transport (MQTT) protocol as a communication channel to control Windows and Linux systems. The emerging malware family, codenamed B

[hardware] Fullhan FH8626V100 - Multiple Vulnerabilities

Fullhan FH8626V100 - Multiple Vulnerabilities

CVE-2026-73460 - Security Advisory 0160

CVE ID :CVE-2026-73460 Published : Sept. 15, 2026, 11:20 p.m. | 49 minutes ago Description :On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can

CVE-2026-81855 - Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

CVE ID :CVE-2026-81855 Published : Sept. 15, 2026, 10:17 p.m. | 1 hour, 50 minutes ago Description :A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. Severity: 9

CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy disclosed a breach compromising some customers' personal information after an attacker leaked data allegedly stolen from the utility company. [...]

VectraRAT Can Hack Windows Enterprises for $250 per Month

The full-service malware-as-a-service (MaaS) platform offers a Windows implant, command-and-control (C2) infrastructure, and an operator panel for comprehensive remote access.

Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists

Cybersecurity agencies in the United States, the United Kingdom, and the Netherlands have detailed a Windows malware that they say Iran's intelligence service uses to spy on dissidents, journalists, and activists around the world. The malware is cont

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gainin

Exein Secures $270M at $1.7B Valuation for Physical AI Security

The cybersecurity startup is building a proprietary foundation model and plans to accelerate global expansion. The post Exein Secures $270M at $1.7B Valuation for Physical AI Security appeared first on SecurityWeek.

Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data

A hacker claims to have stolen 7.5 million customer records after breaching the company’s systems. The post Texas Utility CenterPoint Energy Confirms Breach After Hacker Leaks Data appeared first on SecurityWeek.

Toward Self-Adaptive Physical AI: Can LLM Agents Manage Long-Horizon Physical Tasks?

arXiv:2609.13436v1 Announce Type: new Abstract: Large Language Model (LLM) agents offer a promising path toward autonomously managing long-term physical tasks without human intervention. However, physical tasks require agents to continuously observe

Hearthstone Menerima Penambahan Reign of the Black Empire Oktober Ini – Kelas Baharu Tahun Depan

Blizzard Entertainment telah mengumumkan pelan kandungan baharu untuk Hearthstone di acara BlizzCon 2026. Fokus utama pengumuman tersebut adalah pelancaran penambahan baharu berjudul Reign of the Black Empire pada 20 Oktober... The post Hearthstone M

Databricks brings GPT-5.5 to enterprise agent workflows

Databricks uses GPT-5.5 for enterprise agent workflows after the model set a new state of the art on the OfficeQA Pro benchmark.

The AI data center boom is colliding with cities scarred by big industry

National outcry against data center construction has spread to Philadelphia, where officials suggested possible construction in a neighborhood already impacted by a now-defunct oil refinery.

New insights from Google’s AI & Economy ATLAS

We’ve translated ATLAS’s millions of global data points into an interactive, open-access experience.

Pembangunan Steam Deck 2 Masih Diteruskan – Tidak Terjejas Dengan Isu Komponen Memori

Pada pertengahan tahun ini, ia telah dilaporkan bahawa Valve akan memulakan proses pembangunan konsol permainan mudah-alih generasi kedua mereka, Steam Deck 2 dan jangkaan mereka ialah konsol tersebut akan diperkenalkan sekitar tahun 2028 kelak. Pier

Sega dan Netflix Bekerjasama Terbit Filem Crazy Taxi, Siri Baharu Sonic Serta Stranger Than Heaven

Francais permainan video arked klasik Crazy Taxi bakal diadaptasi menjadi sebuah filem live-action di Netflix menerusi perjanjian penerbitan multi-judul bersama SEGA. Kerjasama ini turut merangkumi pembangunan siri animasi baharu berteraskan... The p

Google Releases Gemini 3.8 Live and 3.8 Live Extended Thinking for Production Grade Voice Agents

Google has released Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking, its most advanced live dialogue models to date. The models execute tools and API calls in the background while the conversation keeps flowing, process live visual inputs, and

The AI graveyard: a running list of projects and startups that didn’t make it

From Apple's repeatedly delayed Siri AI to OpenAI's messy "super app" launch, here's a look at the AI projects that shut down or missed expectations.

Your Architecture Is Why Your Coding Agent Keeps Writing Bad Code

Stop blaming LLMs for bad PRs. Learn how monorepo isolation and tiered AGENTS.md rules eliminate context drift and double your AI coding agent productivity.

Valve Umum Set Kepala VR Steam Frame Secara Rasmi

Valve hari ini telah mengumumkan dan membuka pendaftaran secara rasmi untuk perkakasan terbaharunya, Steam Frame. Peranti ini merupakan set kepala VR tanpa wayar berserta alat kawalan yang direka untuk permainan... The post Valve Umum Set Kepala VR S

ZGCM-1: A Fully Open and Extremely Efficient Foundation Model for Math and Agentic Search

arXiv:2609.13356v1 Announce Type: new Abstract: In this work, we present ZGCM-1, a fully open 7B dense foundation model trained from scratch with extreme data, system, and algorithmic efficiency. ZGCM-1 is founded on a core premise: compact models ca

I Built a RevenueCat Paywall That Doesn’t Hold the First Lesson Hostage

How Slovo uses RevenueCat to keep daily Russian lessons free while testing a custom paywall, three-day trial, and outcome-based subscription pitch.

Grab Bersetuju Membeli Pegangan Majoriti 60% Atome Untuk RM6.1 Bilion

Grab hari ini bersetuju untuk membeli pegangan majoriti pada perkhidmatan bayar nanti, pakai lekas (BNPL), Atome Financial, pada harga RM6.1 bilion. Grab akan mendapatkan pegangan sebanyak 60% pada Atome melalui transaksi ini. Langkah ini juga akan t

AI for Societal Impact

Explore this collection to see how experts and local leaders are using AI breakthroughs to ensure everyone can share the opportunity of AI.

We don’t need AI regulation — leave safety to us, Nvidia’s Jensen Huang says

AI isn't some kind of new form of "alien mind," according to Jensen Huang. It's just hardware and software, so safety can be engineered by each AI product maker.

Helping ChatGPT better recognize context in sensitive conversations

Learn how new ChatGPT safety updates improve context awareness in sensitive conversations, helping detect risk over time and respond more safely.

Your Agent Aced the Task. Will It Do It Again?

Operations workflows with ChatGPT Work

Learn practical ChatGPT Work workflows for initiative briefs, strategy updates, decision packets, and progress reporting.

Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incident

The 'Breaking' News: The OpenAI–Hugging Face Incident - A Technical Reconstruction and Its Implications for AI At this Black Hat USA 2026 talk, OpenAI security engineers and researchers will reconstruct the OpenAI-Hugging Face incident and examine it

What the AI Warning Letter Completely Missed

The recent open letter is right about the "window," but it omits naming who is coming through it or, critically, who will close it.

Democratizing AI Safety with RiskRubric.ai

Oppo Find X10 Pro Max Akan Menggunakan Cip MediaTek Dimensity 9600 Pro

MediaTek baru sahaja melancarkan cip mercu baharu Dimensity 9600 Pro yang dibina menggunakan teknologi 2nm. Sejurus selepas pengumuman tersebut, Oppo mengesahkan bahawa telefon pintar premium terbaharu mereka, Find X10 Pro Max akan menjadi antara per

Cip MediaTek Dimensity 9600 Pro Dilancarkan Dengan Binaan 2nm

Cip MediaTek Dimensity 9600 Pro diperkenalkan dengan teknologi 2nm TSMC. Ia hadir dengan reka bentuk CPU 2+3+3 All Big Core yang menggabungkan 2x C2-Ultra sehingga 4.55GHz, 3x C2-Pro pada 4.35GHz dan 3x C2-Pro pada 3.1GHz. Hasilnya, prestasi teras tu

Converge Then Diversify: Decoupling Convergence and Diversity in Multi-Objective Bayesian Optimisation

arXiv:2609.13396v1 Announce Type: new Abstract: Multi-objective Bayesian optimisation (MOBO) is a sample-efficient approach for optimising expensive black-box functions with multiple objectives. In MOBO, the goal is to adequately approximate the Pare

Building AI to accelerate science and improve lives

The true measure of AI is who it helps. Here’s how it’s impacting lives today. We're focused on key areas where advanced technology can help make extraordinary progress …

Scaleway on Hugging Face Inference Providers 🔥

US data centers could consume more natural gas than Germany and Japan combined by 2035

The AI frenzy could push U.S. data centers to become one of the largest consumers of natural gas in the world.

Public AI on Hugging Face Inference Providers 🔥

Inside NVIDIA’s cuDNN Graph API: Fusion, Autotuning, and Plan Reuse with cuDNN Frontend

Learn how to leverage NVIDIA’s cuDNN Frontend Graph API to build custom kernel fusions, autotuning engine configurations, FP8-style epilogues, scaled dot-product attention, dynamic shapes, and CUDA graph captures. This practical tutorial demonstrates

Blizzard Umum World of Warcraft: Forever, Kempen Baharu Warcraft III: Reforged, dan Pengakhiran Midnight

Blizzard Entertainment mengumumkan pelbagai kandungan bagi francais Warcraft di BlizzCon 2026, didahalui oleh pengenalan judul baharu World of Warcraft: Forever, pelancaran kempen penceritaan untuk Warcraft III: Reforged, serta kemas kini... The post

What’s at stake in AI’s trillion-dollar gamble

When Jessica Wachter, a finance professor at the University of Pennsylvania’s Wharton School, wanted to assess AI’s impact on the economy over the next few years, she faced a long list of business and technical uncertainties. So she started with what

AI for everyone in every language

We’re moving beyond traditional text translation to build models that understand the world’s rich, living languages exactly as they are expressed.

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Introduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more m

Schneider Electric SCADAPack x70 Products

View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabili

Generalized Agent Iteration: One Formal Framework for Iterative Policy Improvement and Recursive Self-Improvement

arXiv:2609.13406v1 Announce Type: new Abstract: When we speak of recursive self-improvement (RSI), are we speaking of a phenomenon, a mechanism, or a prospect? Towards autonomous and evolving intelligence, RSI is being claimed at many scales, while n

Vibe Patenting: Evaluating LLM Judges for Professional Patent-Drafting Agents

arXiv:2609.13422v1 Announce Type: new Abstract: LLM judges are increasingly used to evaluate and improve AI-generated outputs, yet their reliability for complex professional work remains unclear. We study this problem through Vibe Patenting, an end-t

Samsung Galaxy A08 Kini Rasmi Dengan Bateri 6000mAh

Samsung Galaxy A08 kini dilancarkan secara rasmi selepas disenaraikan secara senyap di laman web rasmi beberapa negara termasuk Malaysia. Model ini hadir sebagai penerus siri Galaxy A untuk segmen asas, dengan peningkatan ketara pada kapasiti bateri

Roundtables: Could AI really kill us all?

Listen to the session or watch below Employees at the world’s leading AI labs are saying there’s a real possibility that advanced AI could destroy humanity. Are they right? Or is this more scaremongering and hype? Watch a conversation unpacking AI ex

Lessons From Building an Edge ML System for Tennis Swing Detection

A practical look at building an edge ML system for tennis swing detection, from noisy sensor streams to latency, labeling, and distribution shift.

Kolaborasi Free Fire Bersama Naruto Kini Kembali Sehingga 15 Oktober

Free Fire telah mengumumkan yang acara kolaborasi bersama dengan NARUTO SHIPPUDEN akan kembali pada 16 September 2026 melalui Chapter One: Nine Tails Strikes dengan penambahan mekanik permainan baharu serta pengenalan... The post Kolaborasi Free Fire

BambooToken malware controls Windows and Linux systems via MQTT

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

AI-assisted researchers flooded Vercel with reports, forcing the company to automate vulnerability triage. The post $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws appeared first on SecurityWeek.

Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow?

Microsoft agreed to adopt guardrails and privacy standards for its AI in schools, as negotiated with the American Federation of Teachers. The post Microsoft Commits to Sweeping AI Privacy Rules for Students. Will Other Tech Giants Follow? appeared fi

Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers

Developed by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service providers with guidelines to protect the identity assertions, access tokens, and cryptographic mechan

Meta Introduces ZGateway: A Stateless Proxy Tier That Unifies ZippyDB Traffic and Handles Over 1 Billion Operations Per Second

Meta engineering team introduced ZGateway, a proxy tier that now sits between client applications and ZippyDB, the Meta’s most widely used key value store. ZippyDB backs product metadata, counters, and configuration at billions of operations per seco

Work with Codex from anywhere

Use Codex anywhere with the ChatGPT mobile app. Monitor, steer, and approve coding tasks in real time across devices and remote environments.

Meta now lets AI agents handle the boring parts of WhatsApp Business setup

A new WhatsApp Business MCP server lets developers use AI coding agents like Claude, Cursor, Codex, and ChatGPT to handle setup, messaging templates, testing, and troubleshooting.

Sea's View on the Future of Agentic Software Development with Codex

Sea Limited's CPO explains why the company is deploying Codex across engineering teams to accelerate AI-native software development in Asia.

Agent-net Open Sources Webagent: A Go Harness That Turns Any Website into a Guarded AI Agent

Agent-net, the team building an agent-to-agent marketplace where AI agents discover, trust, and pay each other, has released Webagent, an open source harness for standing up public-facing business agents. So, basically you give it your website, get a

Building a Local-First Kotlin App With GitHub Actions and RevenueCat

Inside the six-day build of myQuote, a Kotlin app using Jetpack Compose, Android TTS, GitHub Actions, and RevenueCat’s Test Store.

Amana’s Sky Shader Worked Perfectly, Except It Kept Getting the Weather Wrong

Three rendering bugs made Amana’s Metal sky shader contradict the real weather. Here is how cloud color, scope, and interpolation were fixed.

[webapps] Ghost_CMS 6.19.0 - Remote Code Execution

Ghost_CMS 6.19.0 - Remote Code Execution

Microsoft Issues Emergency Fixes After Massive Patch Tuesday

You can't make an omelet without breaking a few eggs, and you can't patch nearly 1,000 CVEs without a few glitches.

`LeRobotDataset:v3.0`: Bringing large-scale datasets to `lerobot`