Taklimat Pagi Saya

CVE-2026-93452 - snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress

CVE ID :CVE-2026-93452 Published : Sept. 17, 2026, 11:25 p.m. | 56 minutes ago Description :snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination b

Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom

Revolut allegedly fed customer information to hackers impersonating an Italian government agency for five months. The post Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom appeared first on SecurityWeek.

Schneider Electric NetBotz 5 750/755

View CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door conta

[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)

C-MOR 6.0104 - Cross-Site Scripting (XSS)

Bransys ELD

View CSAF Summary Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. The following versions of Bransys ELD are affected: Android iOS CVSS Vendor Equipment Vulnerabilities v3 7.5 Bransys Br

CVE-2026-93435 - redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

CVE ID :CVE-2026-93435 Published : Sept. 17, 2026, 11:18 p.m. | 1 hour, 3 minutes ago Description :redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the cl

CVE-2026-18441 - LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

CVE ID :CVE-2026-18441 Published : Sept. 17, 2026, 11:27 p.m. | 52 minutes ago Description :The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all

Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels

The Coast Guard confirmed evidence of malicious cyber activity on the VL Prosperity, but has not attributed the attack to Iran. The post Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels appeared first on SecurityWeek.

China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator, maintainer NLnet Labs said in an advisory on Wednesday. An attacker who controls a malicious zone and queries a vulnerable resolver can trig

CVE-2026-93454 - Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

CVE ID :CVE-2026-93454 Published : Sept. 17, 2026, 11:25 p.m. | 54 minutes ago Description :Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-

AI's Vulnerability Surge May Be More Manageable Than First Feared

New research suggests the coming Vulnpocalypse may not be so overwhelming for enterprise security teams — if they have the right strategies.

CVE-2026-87701 - Azure Cosmos DB Elevation of Privilege Vulnerability

CVE ID :CVE-2026-87701 Published : Sept. 17, 2026, 11:18 p.m. | 1 hour, 3 minutes ago Description :Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to

CISO's Expert Guide to Agentic Pentesting for Websites

Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR 2026). A new free guide explains how autonomous AI agents are closing that gap, and what

Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar

A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited in your environment? Mythos-class AI is compressing the time between disclosure and working

Mitsubishi Electric GX Works3 and Motion Control Settings

View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and th

[webapps] CubeCart 6.7.4 - SQL injection

CubeCart 6.7.4 - SQL injection

'Breeze Comet' Tears Into Brazilian & Global Financial Systems

Brazil's most sophisticated threat group is making light work of the country's financial systems, putting money directly into its own pocket.

CVE-2026-93309 - O-RAN-SC SMO OAM VES Collector allocation of resources

CVE ID :CVE-2026-93309 Published : Sept. 17, 2026, 11:30 p.m. | 49 minutes ago Description :A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing

Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing condi

CVE-2026-2585 - Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter

CVE ID :CVE-2026-2585 Published : Sept. 17, 2026, 11:27 p.m. | 52 minutes ago Description :The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and includ

CVE-2026-93453 - SOGo before 5.12.11 Password Reset Token Interception via Origin Header

CVE ID :CVE-2026-93453 Published : Sept. 17, 2026, 11:25 p.m. | 54 minutes ago Description :SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect r

CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot

The decision follows BOD 26-04, which directs federal organizations to prioritize vulnerabilities based on real-world risk. The post CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot appeared first on SecurityWeek.

New RatHat Android malware uses AI to automate device control

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices. [...]

CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus

The move is consistent with the agency's advice on the need for organizations to prioritize the vulnerabilities that actually matter.

CVE-2026-93436 - vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

CVE ID :CVE-2026-93436 Published : Sept. 17, 2026, 11:18 p.m. | 1 hour, 3 minutes ago Description :vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote

[Virtual Event] Cybersecurity Outlook 2027

China's FamousSparrow APT Spies on US Politics in Latin America

Amid the US and China's fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight.

CVE-2026-93450 - go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

CVE ID :CVE-2026-93450 Published : Sept. 17, 2026, 11:25 p.m. | 56 minutes ago Description :go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no d

Hitachi Energy FACTS Control Platform (FCP)

View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availabilit

Siri Kad Grafik Generasi Akan Datang AMD Dan NVIDIA Dijangka Hanya Akan Tiba Pada 2028

Tatkala kita sedang menunggu tentang pengumuman lanjut berkenaan siri kad grafik NVIDIA GeForce RTX 5000 Super, satu ura-ura yang kurang enak sedang berlegar-legar di arena web berkenaan siri kad grafik generasi akan datang oleh kedua-dua AMD dan jug

Underway Wants to Keep the Part of Startup History Founders Usually Lose

Underway uses AI-guided conversations to help founders document everyday decisions and preserve startup history before hindsight tidies it up.

Windows 11 24H2 Home and Pro reach end of support in October

Microsoft reminded customers this week that devices running Windows 11 24H2 Home and Pro editions will stop receiving updates next month. [...]

Google DeepMind launches institute to widen the AGI debate

Google DeepMind just launched an institute to hash out the big AGI questions in public

Making global data easier to explore

Google and the UN system have launched the UN System Data Commons, a new open platform making global statistics accessible and easy to search.

[webapps] CubeCart 6.7.4 - SQL

CubeCart 6.7.4 - SQL

[webapps] EasyAppointments 1.5.1 - Blind SQL Injection

EasyAppointments 1.5.1 - Blind SQL Injection

Microsoft Open-Sources TauGrid: A Kubernetes-Native Stack for GPU AI Workloads

Microsoft's AKS engineering team open-sourced TauGrid on August 28, 2026, packaging the tau CLI, Kueue queueing, KubeRay orchestration, GPU node health monitoring and observability into one Helm install. It is MIT licensed and deployable now on any K

[webapps] C-MOR 6.0104 - Directory Traversal

C-MOR 6.0104 - Directory Traversal

Amazon-owned Zoox’s 100-robotaxi limit in Nevada is about to disappear

An updated permit shows the 100-cap will expire later this month just as competition in Las Vegas heats up.

Nunchux AI Introduces VC-Attention: A Training-Free Low-Bit Attention Kernel That Speeds Up Video Diffusion Transformers

Nunchux AI has released VC-Attention, a training-free low-bit attention kernel built for video Diffusion Transformers (DiTs). It targets 2 problems at once: value quantization error and a slow softmax stage. Why Attention is the Video Bottleneck Vide

OpenAI details more cases of AI agents taking unauthorized actions

OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. [...]

Khosla-backed Mazama Energy just raised $135M to drill deeper into super-hot-rock geothermal

Geothermal startup Mazama is drilling three miles underground to tap superhot rock, with one well capable of generating 15 MW of electricity 24/7.

Making AI-Assisted Claims Independently Challengeable: Publication Authority and a Protocol for Falsifiable Publication Records

arXiv:2609.17631v1 Announce Type: new Abstract: AI-assisted claims can appear authoritative when evidence, analysis, human authorization, presentation, and correction history refer to different states. Provenance, attestation, and transparency expose

Finance workflows with ChatGPT Work

Learn practical ChatGPT Work workflows for reporting, variance analysis, forecasts, monthly reviews, and decision-ready finance deliverables.

Advanced AI Society Joins the Linux Foundation, Launches Open Verification Ecosystem

To answer growing statutory mandates and security requirements across enterprise and public

Our response to the TanStack npm supply chain attack

OpenAI details its response to the TanStack “Mini Shai-Hulud” supply chain attack, outlines protections taken to secure systems and signing certificates, and explains why macOS users must update OpenAI apps by June 12, 2026. Learn what happened, what

OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training

OpenAI published a framework for disclosing model misalignment alongside six reports describing problematic behavior. The post OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training appeared first on SecurityWeek.

What Recent AI-Powered Attacks Mean for Your Identity Security

AI is making credential theft faster and easier to scale, giving attackers more opportunities to abuse valid identities. Specops explains why identity security must go beyond successful authentication by verifying that both the user and the device re

EvolveTrade: Experience-Driven Policy Refinement for Self-Evolving LLM Trading Agents

arXiv:2609.17632v1 Announce Type: new Abstract: Large language model (LLM) trading agents can combine market data, news, and executable analysis, but their behavior is often controlled by static hand-written tool-use policies that are fixed before de

How Cooley is accelerating IPO work with ChatGPT

Cooley built GO Public with ChatGPT Work to bring intelligence to the IPO process, helping lawyers surface issues earlier and focus judgment where it matters most.

Google Research Introduces Retrieve-for-Train (R4T): An RL-Compiled Diffusion Retriever for 12× to 20× Faster Query Fan-Out

Google Research has introduced Retrieve-for-Train (R4T), a framework for search that returns coherent, diverse result sets. It trains a fan-out language model with RL once, using groundedness, diversity, and alignment rewards. That model then synthes

Brevo supply-chain attack injected ClickFix scripts on customer sites

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. [...]

Why Enterprise AI Needs More Than a Chatbot: Building Custom AI Workflows

Enterprise AI needs integrations, approval rules and error handling to turn model responses into reliable business workflows.

SAIR: Accelerating Pharma R&D with AI-Powered Structural Intelligence

Ishan Shah on Recoverable Systems, AI Guardrails, and the Internet's Useful Weirdness

Ishan Shah discusses distributed systems, event-driven recovery, AI guardrails, HackerNoon, and what keeps the internet worth building for.

What You Can't See Is Still What You Learn: A Preregistered Sixty-Society Confirmation That Evidence Masking Drives Compositional Generalization

arXiv:2609.17637v1 Announce Type: new Abstract: Restricting what a module can read may improve what a system learns to compute. We test this in a preregistered confirmation with sixty four-cell systems sharing a frozen language-model backbone and com

Crusoe raises $3.9B to build massive data centers and small modular “AI factories”

The round values the data center giant at $30.9 billion.

One Color Preprocessing Improves DSATUR

arXiv:2609.17633v1 Announce Type: new Abstract: The Graph Coloring Problem (GCP) is NP-hard and DSATUR stands as one of the fastest heuristics for it despite producing colorings that typically use more colors than state-of-the-art coloring algorithms

Building a safe, effective sandbox to enable Codex on Windows

Learn how OpenAI built a safe, effective sandbox to enable Codex on Windows with controlled file access and network limits.

Dua Sony PlayStation Pulse Diumumkan Dengan Pemacu Audio Planar

Sony mengumumkan dua fon kepala baharu PlayStation Pulse khusus untuk sesi gaming. Kedua-dua PlayStation Pulse Wireless Headset dan PlayStation Pulse Edge Wireless Headset dilengkap pemacu audio planar yang menurut Sony menawarkan prestasi audio yang

Comp AI Raises $34 Million for AI-Native Compliance and Security

The company plans to expand into continuous cybersecurity, offering security testing across applications and infrastructure. The post Comp AI Raises $34 Million for AI-Native Compliance and Security appeared first on SecurityWeek.

Anthropic Launches Claude Code Projects in Beta: Parallel Cloud Sessions That Keep Running After You Close Your Laptop

Anthropic redesigned Projects in Claude Code. The old project was a folder: some files plus one chat. The new one is a single ongoing conversation where Claude acts as coordinator. You describe work, and Claude decides what becomes a thread. Each thr

Introducing Astra for Law

OpenAI for Law brings frontier intelligence for law, custom firm workflows, connected legal data sources, and legal-grade controls for confidential client work.

Welcome EmbeddingGemma, Google's new efficient embedding model

PrismML hopes its tiny LLM will change how we all use AI

If AI lab PrismML isn't on your radar yet, it should be.

OpenAI Releases a Model Misalignment Disclosure Framework With 3 Review Tracks and 6 Incident Reports From RL Training

OpenAI can disclose misalignment before fixes exist. Its 6 initial reports include fabricated data and leaked API keys. The post OpenAI Releases a Model Misalignment Disclosure Framework With 3 Review Tracks and 6 Incident Reports From RL Training ap

OpenAI Reveals Six Model Incidents Involving Hidden Failures and Unauthorized Uploads

OpenAI on Wednesday disclosed six new instances of "unexpected or concerning model behavior" that took place over the past six months, while sharing a new framework for reporting, tracking, investigating, and disclosing model misalignment in a bid to

Honor X9e Pro Akan Dilancarkan Pada 24 September Ini

Peranti siri X9 dari Honor merupakan salah satu peranti yang terkenal dengan tahap ketahanan yang luar biasa dari jenama itu. Kini mereka akan membawakan Honor X9e Pro di Malaysia pada 24 September yang akan datang. Antara perkara menarik yang ada pa

MyKad Baharu Turut Menyertakan Komponen Dompet Digital Secara Terbina

MyKad generasi baharu telah pun dilancarkan yang hadir dengan rekaan dikemaskini, bersama-sama sejumlah besar penambah-baikkan bersama dengannya. Tidak setakat ciri-ciri sekuriti bersama kad pengenalan berkenaan, kini pembangunnya NexG turut menyatak

Kerajaan Perluas Subsidi Bil Elektrik Untuk Pengguna Domestik Untuk Had Penggunaan Sehingga 800 kWj – Hingga Disember 2026

Perdana Menteri Anwar Ibrahim kini mengumumkan perluasan subsidi bil elektrik untuk pengguna domestik ditingkatkan daripada had 600 kWj sebelum ini, kepada sehingga 800 kWj (kilowatt jam) sebulan. Penambahan subsidi ini berkuat-kuasa untuk bil elektr

Make your ZeroGPU Spaces go brrr with ahead-of-time compilation

mmBERT: ModernBERT goes Multilingual

NVIDIA Releases 6 Million Multi-Lingual Reasoning Dataset

Educational Byte: What Should You Look For in a Self-Custody Crypto Wallet?

Choosing a self-custody crypto wallet goes beyond looks. Discover the features that can help protect your funds and make everyday use much easier.

Physics-Constrained Digital Twins for Sensor Integrity in Urban Pedestrian Flow: Detecting Stealthy False Data Injection with Conformal Guarantees

arXiv:2609.17635v1 Announce Type: new Abstract: City pedestrian counting systems now feed economic indicators, planning decisions and safety operations, yet the twins built on top of them treat the incoming stream as ground truth. We study what happe