Tous les articles
1618 articles
- Vulnérabilités & sécuritéThe Hacker News25 oct. 2026OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no
Rapport du 25 oct. 2026 - Nouveautés des frameworksSymfony Blog25 oct. 2026A Week of Symfony #1034 (October 19–25, 2026)
This week, development activity focused on polishing and fixing the new features of the upcoming Symfony 8.2 version. In addition, we showcased some of them, including the new JsonSchema component, signed Messenger transports, safer HTML in translations,…
Rapport du 25 oct. 2026 - Sécurité des packages (npm / Node)Aikido Security24 oct. 2026Adding Aikido AI pentesting to your existing security stack
Aikido Security's AI pentesting fits into the stack you already run. You can add AI pentesting on top to catch the complex logic flaws deterministic tools miss. Category: Guides & Best Practices
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéBleepingComputer24 oct. 2026BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]
Rapport du 25 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News24 oct. 2026BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News23 oct. 2026Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News23 oct. 2026Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
Rapport du 24 oct. 2026 - DevOps & CloudVercel Blog23 oct. 2026Vercel CLI adds Spend Management Rapport du 24 oct. 2026
- IA & modèlesSimon Willison23 oct. 2026Quick Study
Tool: Quick Study Prompt to Claude Opus 5.5 High : Build an artifact where you open a photo and it rapidly (in a few seconds) paints a version of that photo using a canvas element and simulated paintbrush See also my previous experiment getting Claude Fable to simulate a watercolor illustration with P5.js. Quick Study uses Sobel edge detection , with no external libraries beyond Google Fonts. Tags: tools
Rapport du 24 oct. 2026 - Sécurité des packages (npm / Node)Socket Blog23 oct. 2026New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.
Rapport du 24 oct. 2026 - DevOps & CloudVercel Blog23 oct. 2026Send feedback from the Vercel MCP Rapport du 24 oct. 2026
- Sécurité des packages (npm / Node)Aikido Security23 oct. 2026Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats
Rapport du 24 oct. 2026 - DevOps & CloudVercel Blog23 oct. 2026How Vercel Agent accesses production safely Rapport du 24 oct. 2026
- Sécurité des packages (npm / Node)OpenSSF23 oct. 2026New OpenSSF Tech Talk: How Upstream Contribution Minimizes Technical Debt & Streamlines CRA Reporting
Maintaining private forks of open source software (OSS) comes with a hidden tax, costing organizations an average of 5,160 labor hours per release cycle in maintenance and engineering overhead. Beyond the accumulating technical debt and security risks, passive open source consumption is no longer sustainable under emerging regulatory frameworks like the Cyber Resilience Act (CRA), which imposes strict security and vulnerability management mandates.
Rapport du 24 oct. 2026 - IA & modèlesSimon Willison23 oct. 2026Introducing Kimi K3.1 Pro
Introducing Kimi K3.1 Pro Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026". They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which are priced the same). The US dollar pricing is $2.00/million tokens for input and $10/million for output - the same as GPT-6.1 Sol and half the price of Claude Opus 5.5. Moonshot's own benchmarks show Kimi as approximately level with Opus 5.5 and GPT-6 Astra - beating them on a few benchmarks, coming
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News23 oct. 2026Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
Rapport du 24 oct. 2026 - DevOps & CloudVercel Blog23 oct. 2026Deployments now show build cache size Rapport du 24 oct. 2026
- DevOps & CloudCloudflare Blog23 oct. 2026Origin Range Requests: Serving large files without range-request tuning
Naive byte-range caching can waste gigabytes of origin bandwidth on small requests. We rebuilt our cache architecture in Pingora to coordinate partial fetches automatically, cutting R2 p99 latency in half.
Rapport du 24 oct. 2026 - DevOps & CloudCloudflare Blog23 oct. 2026Bringing post-quantum cryptography to geographically fenced key management
Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.
Rapport du 24 oct. 2026 - DevOps & CloudVercel Blog23 oct. 2026Vercel Connect adds managed Stripe API keys Rapport du 24 oct. 2026
- IA & modèlesOpenAI News23 oct. 2026Rapidly scaling online storage to serve over 1 billion ChatGPT users (Part II)
Learn how OpenAI scaled Habitat with reliable multi-tenancy, global caching, and Azure Cosmos DB to deliver 12× faster reads for ChatGPT.
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéThe Hacker News23 oct. 2026PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
Rapport du 24 oct. 2026 - Vulnérabilités & sécuritéBleepingComputer23 oct. 2026Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]
Rapport du 24 oct. 2026 - IA & modèlesHugging Face Blog23 oct. 2026LitPivot: Developing research ideas through dynamic contextualization within the literature landscape Rapport du 24 oct. 2026
- Nouveautés des frameworksAngular Blog23 oct. 2026From running edge-rendered Angular apps on Cloudflare Workers to crafting lifelike speech with… Rapport du 24 oct. 2026