Taklimat Pagi Saya

CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution

CVE ID :CVE-2026-96883 Published : Sept. 24, 2026, 8:17 p.m. | 3 hours, 4 minutes ago Description :pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated rem

CVE-2026-81630 - Botslab G980H Dashcams Insufficient Verification of Data Authenticity

CVE ID :CVE-2026-81630 Published : Sept. 24, 2026, 9:18 p.m. | 2 hours, 3 minutes ago Description :The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through a

CVE-2026-97636 - Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key

CVE ID :CVE-2026-97636 Published : Sept. 24, 2026, 10:17 p.m. | 1 hour, 6 minutes ago Description :Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team d

Siemens Mendix Runtime (Update A)

View CSAF Summary This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute. The following versions of Siemens Mendix Runtime are affected: Siemens Mendix

CVE-2026-14443 - Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a

CVE ID :CVE-2026-14443 Published : Sept. 24, 2026, 9:17 p.m. | 2 hours, 4 minutes ago Description :Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be

Eufy Omni C20, Omni X10 Pro

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. The following versions of Eufy Omni C20, Omni X10 Pro are affected: Omni C20 Omni X10 Pro CVSS Vendor E

CVE-2026-87722 - Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

CVE ID :CVE-2026-87722 Published : Sept. 24, 2026, 10:17 p.m. | 1 hour, 6 minutes ago Description :Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPre

MacSync malware uses public iCloud calendars to deliver new payloads

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads. [...]

CVE-2026-95699 - MrSteam iSteamX Improper Isolation or Compartmentalization

CVE ID :CVE-2026-95699 Published : Sept. 24, 2026, 9:18 p.m. | 2 hours, 3 minutes ago Description :Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other

CVE-2026-97387

CVE ID :CVE-2026-97387 Published : Sept. 24, 2026, 10:45 p.m. | 37 minutes ago Description :None Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

3 Cyber Threats That Defined the Summer of 2026

This installment of the Reporters' Notebook video series discusses the impact of AI agents breaching Hugging Face, Fairlife's ransomware attack, and Iranian-linked threat actors compromising a dozen US water systems. It was a busy summer.

Hackers now exploit critical Roundcube flaw in code injection attacks

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]

Botslab G980H Dashcams

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device

CVE-2026-97230 - IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

CVE ID :CVE-2026-97230 Published : Sept. 24, 2026, 10:36 p.m. | 46 minutes ago Description :IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Py

CVE-2026-93354 - Taskview Community Missing Authentication via OAuth Dynamic Client Registration

CVE ID :CVE-2026-93354 Published : Sept. 24, 2026, 8:17 p.m. | 3 hours, 4 minutes ago Description :Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clie

New Carbonato malware uses AI agents to hijack exposed Docker hosts

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]

CVE-2026-87721 - Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

CVE ID :CVE-2026-87721 Published : Sept. 24, 2026, 10:17 p.m. | 1 hour, 6 minutes ago Description :Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19

How to Build A SASE Framework for Modern Cybersecurity

Keeping edge computing safe requires organizations to fundamentally rethink security governance. Here is a path forward: a step-by-step guide to building a SASE framework.

'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing

Agentic AI can smuggle arbitrary instructions from the Web, across multiple apps, into trusted internal communications channels.

Kontext Security Emerges With $4 Million for AI Agent Runtime Controls

The startup’s runtime enforcement platform evaluates AI agents in real time to provide visibility and control over their actions. The post Kontext Security Emerges With $4 Million for AI Agent Runtime Controls appeared first on SecurityWeek.

Autonomous AI Hacks Raise Thorny Questions of Legal Accountability

The prospect of legal accountability is unclear. Lawsuits are a possibility, but some legal experts believe any criminal investigations would face an extremely high burden. The post Autonomous AI Hacks Raise Thorny Questions of Legal Accountability a

Pra-tempahan Sonos Beam Ultra Dibuka Dengan Harga RM4199 – Jualan Bermula 29 September Ini

Jika anda mengikuti perkembangan dunia audio pengguna, Sonos, jenama perkakasan audio premium baru-baru ini telah melancarkan pembesar suara premium kelas pertengahan terbaru mereka, iaitu Sonos Beam Ultra, dan ia bakal memasuki pasaran Malaysia tida

Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content

The "third-party[.]com" domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. "third-party[.]com has been a generic documentation placehol

The AI Neuroscientist: An Interactive Agentic Interface for Neuroimaging Analysis

arXiv:2609.25254v1 Announce Type: new Abstract: Analyzing neuroimaging data requires specialized coding and statistical expertise, which limits accessibility for researchers without computational backgrounds. We present the AI Neuroscientist, a langu

Designing Reliable Output Contracts for AI-Powered Mobile Interfaces

Learn how schemas, validation, versioning, failure states, and fallbacks can keep probabilistic AI output from breaking deterministic interfaces.

Amerika Syarikat Kritik Langkah Australia Kawal Algoritma Media Sosial

Algoritma media sosial yang tidak terkawal kini menjadi kebimbangan utama. Tanpa kawalan, algoritma boleh menjadi pengaruh besar yang boleh mengancam pengguna. Oleh sebab itu, Australia mengusulkan undang‑undang (RUU) baharu untuk mengekang pengaruh

Exposed GitLab project email addresses let attackers push code

Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...]

Kimina-Prover: Applying Test-time RL Search on Large Formal Reasoning Models

Lean Pool: An AI-Maintained Archive of Formalized Mathematics

arXiv:2609.25199v1 Announce Type: new Abstract: Lean Pool is a repository of formalized mathematics. It is grown, maintained and optimized by AI agents.

BottleCap AI Releases ThinkingCap-Qwen3.8-27B: 37.2% Fewer Thinking Tokens at a 0.86pp Accuracy Cost

BottleCap AI has released ThinkingCap-Qwen3.8-27B, a fine-tune of Qwen3.8-27B that spends 37.2% fewer thinking tokens across 12 benchmarks. Macro accuracy moves from 86.65% to 85.79%, and long-context AA-LCR improves by 2.25pp. The model is a drop-in

OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data

Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information. The post OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data appeared first on SecurityWeek.

Meet AvisLoader: A Windows Loader Built to Outlast a Takedown

Discover how AvisLoader uses Tox peer-to-peer messaging for C2, ClickFix delivery, shortcut persistence, and payload distribution without fixed domains.

Ulasan Resident Evil (2026)

Bagi yang ingin menonton filem terbaharu berdasarkan IP permainan aksi seram popular Resident Evil, saya secara terus boleh katakan yang ini merupakan lebih kepada filem Zach Cregger berbanding filem Resident... The post Ulasan Resident Evil (2026) f

Contrastive-LM Releases CLM-8B: An Open System One Model That Scores Agent Actions Up to 9× Faster Than Jev

Contrastive-LM has released CLM-8B, an open System One model that scores candidate actions against a state instead of generating text. It adds 2 small projection heads to a frozen Qwen3-8B encoder and trains them with a contrastive InfoNCE objective.

Singapura Kenakan Denda Terhadap Penumpang Bas Yang Memainkan Lagu Dengan Kuat

Pernah berdepan dengan penumpang yang memainkan lagu terlalu kuat dalam bas? Di Singapura, perbuatan ini kini dianggap sebagai kesalahan undang‑undang. Pihak berkuasa menegaskan bahawa muzik atau audio yang dimainkan dengan kuat bukan sahaja menggang

Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer

An active ClickFix campaign has been observed compromising legitimate Ukrainian business websites to inject bogus Cloudflare verification pages and trick victims into downloading a previously undocumented information stealer called Psychedelic. "When

Football Manager 27 Akan Dilancarkan November 2026

SEGA dan Sports Interactive telah mengumumkan yang Football Manager 27 secara rasminya dijadualkan untuk pelancaran pada bulan November 2026. Mereka juga menyiarkan video pertama yang memfokuskan kepada aspek corak permainan... The post Football Mana

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the thread running through the pile. Trusted paths get poisoned

ChatGPT Ads expands to Southeast Asia and Taiwan

ChatGPT Ads is expanding to Southeast Asia and Taiwan, giving eligible businesses new ways to reach people across more than 60 countries.

Ulasan MSI Claw 8 EX AI+

MSI melalui penawaran PC mudah alih mereka mungkin bermula dengan “senyap” melalui generasi pertama untuk MSI Claw, tetapi dengan hadirnya model MSI Claw 8 AI+ mereka mula membawa penawaran yang... The post Ulasan MSI Claw 8 EX AI+ first appeared on

SpeakON Ships a MagSafe AI Voice Button With Its Own Microphone

Voice input on phones has been solved for years. What has not been solved is the output. Speak into most dictation tools and you get back exactly what you said, fillers and false starts included, in a note you then have to clean up and move somewhere

Accelerating vision-language models with LFM2.5-VL-DSpark

Ringg’s AI agents resolve up to 65% of customer calls with OpenAI

Using GPT-5.6, Ringg powers multilingual agents across voice, chat, WhatsApp, and web for 90% less cost vs. GPT-4.1.

X-Planner: Event-Structured Task Planning for Embodied Intelligence

arXiv:2609.25187v1 Announce Type: new Abstract: Task planning bridges high-level instructions and executable behavior in long-horizon manipulation, yet modern Vision-Language-Action (VLA) systems often leave this intermediate structure implicit. Exis

Introducing MentalHealthBench

MentalHealthBench is an expert-informed benchmark for evaluating helpful and safe AI responses across realistic mental health conversations.

When LLM Agents Fail to Read the Room: ReAdapt for Relational Social Reasoning

arXiv:2609.25284v1 Announce Type: new Abstract: A social agent's most basic decisions (should I react to this post? who should I reach out to?) are not purely content problems. The right action often hinges on the latent relationship between people -

A Coding Guide to TypeSafe AI Jev: Typed Decisions, Calibrated Confidence, and Speculative Fan-Out with a System One Model

This tutorial provides a complete coding guide to TypeSafe AI's Jev, a System One model designed for non-text, structured judgments. It covers installing the official Python SDK, using primitive question types (Choice, Score, Noul), implementing spec

PrismML brings its tiny LLMs to Qualcomm-powered smart glasses

Prism's larger goal is open-weight AI that runs on devices and makes better use of the computing power they already have.

Disney+ Beralih Ke Aplikasi Baharu Bermula Oktober Ini – Profil, Senarai Dan Sejarah Tontonan Tidak Akan Dibawa

Perkhidmatan penstriman Disney+ akan beralih ke sebuah aplikasi baharu yang dijadualkan untuk pelancaran pada 7 Oktober 2026. Peralihan ini walau bagaimanapun tidak akan memindahkan data pengguna semasa. Semua profil sedia... The post Disney+ Beralih

Pendaftaran Untuk Menganjur Kejohanan LCP Wild Card 2027 Kini Dibuka

Organisasi yang berminat kini boleh mendaftarkan permohonan untuk menganjurkan kejohanan Wild Card mereka sendiri bagi saingan League of Legends Championship Pacific (LCP) musim 2027. Pembukaan pendaftaran ini memberi peluang kepada... The post Penda

Grab and OpenAI bring practical AI skills to Southeast Asia

OpenAI and Grab launch GO Forward with AI, a regional programme helping 30,000 partners build practical AI skills across Southeast Asia.

Island Raises $400 Million at $6.4 Billion Valuation

The enterprise security firm has raised more than $1 billion since its launch in 2020; Evolution Equity Partners led the latest funding round. The post Island Raises $400 Million at $6.4 Billion Valuation appeared first on SecurityWeek.

AI-Powered Campaign Targets Hundreds of Online Retailers

A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration. The post AI-Powered Campaign Targets Hundreds of Online Retailers appeared first on SecurityWeek.

FedRAMP VDR & VER: Daily Scans Are Only the Beginning

FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a b

Beyond Copilots: How Multi-Day Autonomous AI Agents Are Rewriting the SDLC in 2026

From $44 C compilers to agent keypairs: Learn how autonomous AI agents are scaling multi-day coding, overcoming the verification tax, and reshaping the SDLC.

Airbnb widens access to GPT-6 Astra and OpenAI frontier models

Learn how Airbnb is expanding access to GPT-6 Astra and OpenAI frontier models to help engineering teams solve bugs, design systems, and ship faster.

Pratempah HONOR X9e Pro Kini Dibuka Bermula RM1,799 Bersama Tablet Percuma

HONOR baru-baru ini secara rasminya telah memperkenalkan model terbaharu mereka iaitu HONOR X9e Pro. Telefon pintar ini hadir dengan pelbagai peningkatan ‘PRO’ daripada pelbagai sudut seperti bateri, ketahanan, kecerahan skrin, kamera, pemproses dan

How AI Is Changing the Production Pipeline of Filmmaking: Interview with Amy Kouxiao Zhang

How is AI changing filmmaking? Amy Kouxiao Zhang shares how generative AI is reshaping micro-drama production, costs, and creative workflows.

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions

A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level o

MedGate-Fusion: Integrating First-Encounter Semantic Narratives and Physiological Biomarkers for Prospective Stroke Risk Stratification

arXiv:2609.25272v1 Announce Type: new Abstract: Prospective stroke risk stratification in primary care is challenging because early risk signals are distributed across routine biomarkers and unstructured clinical narratives. We propose MedGate-Fusion

Perbandingan Honor X9e Pro, Redmi Note 17 Pro Max dan Realme P4 Power 5G

Honor X9e Pro dilancarkan secara rasmi di Malaysia hari ini dengan penawaran tubuh tahan lasak, bateri gergasi 11,000 mAh dan skrin yang tahan hentakan. Ia serasi dibandingkan dengan Redmi Note 17 Pro Max dan Realme P4 Power 5G yang turut dilengkapi

Migrating the Hub from Git LFS to Xet

Evaluating Alibaba Cloud SLS as an Incident-Response Logging Architecture

An SRE-focused look at how Alibaba Cloud SLS turns Kubernetes logs into searchable insights, dashboards, alerts, and faster incident response.

Waymo is scaling fast. Here’s what the fleet data shows.

In the past month, Waymo has expanded its fleet in Texas by 49%. There are other hotspots as well.

Ghost Service Accounts Enable M365 Data Theft in Chile

Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.

Five Big Improvements to Gradio MCP Servers

Ettin Suite: SoTA Paired Encoders and Decoders

SectopRAT Returns, Hiding Inside a Legitimate Application

The latest activity from the remote access Trojan (RAT) shows why organizations should monitor the behavior of applications rather than blindly trusting them, experts say.

Meet Feather, the startup building the ‘Android of robotics’ for developers

Feather is betting on a customizable, $30,000 platform built for software developers.

Nexterity wants to automate the hard, dangerous part of pipefitting

The startup's robot can tighten or loosen four bolts at a time, and it fits in a Pelican case.

Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls

The logistics sector has become the target of a new malicious cyber campaign that distributes an Android spyware codenamed Corp MDM. According to Have I Been Squatted, the campaign uses fake Google Play pages branded as CEVA and TKW Logistics to dist

Bring your co-founder, partner, or colleague and get 50% off a second TechCrunch Disrupt 2026 pass

Buy one pass to TechCrunch Disrupt 2026 and get 50% off a second of the same ticket type. Register before event starts on October 13 at 8 a.m. PT.