» Tag
security
92 postsLinux Page Cache Vulnerability via TC Pedit: A New Exploit
Discover the Linux TC Pedit page cache exploit enabling root access. Learn about the vulnerability and its fix.
AI Jailbreak Benchmark Reveals 100x Safety Gap Between Models
New benchmark shows up to 100x safety gaps among frontier AI models against jailbreak attacks; some models yield zero jailbreaks.
Rust crate arrayref 0.3.10 pulls in malware via proc-macro1 dependency
crates.io package arrayref 0.3.10 pulls in malicious proc-macro1, executing remote payloads and affecting Rust GUI projects like egui and iced.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.com221,000 Live Secrets Found in 7.6PB of Hugging Face Training Data
Researchers scanned 7.6PB of Hugging Face training data and found 221,303 live secrets — GitHub, GCP, database, and AI provider credentials.
APC Framework Closes Authorization Gaps in Multi-Agent LLM Systems
A new authorization framework, APC, tracks delegated authority to block prompt-injection and unsafe action combinations in AI agents.
Operation CameraSwarm: 14,000+ Dahua Cameras Compromised
Hunt.io traced Operation CameraSwarm to an exposed dev directory, revealing three exploit paths behind 14,000+ compromised Dahua cameras.
Rsync 3.5.0 Patches 33 Security Flaws in Path and Daemon Handling
Rsync 3.5.0 closes 33 security vulnerabilities, mostly symlink-race path handling bugs in the daemon and client, with CVE IDs and regression tests.
Shai-Hulud npm Worm Infects Over 1,280 Packages
Shai-Hulud npm worm spread credential-stealing malware across over 1,280 packages.
Python library verifies OpenAI's signed AI agent traffic (RFC 9421)
regent-httpsig is an open-source Python library that verifies and signs OpenAI-style AI agent HTTP traffic per RFC 9421 and Web Bot Auth drafts.
Spectre Flaw Leaks JWT Tokens on Cloudflare Workers via Remote Timers
A new Spectre attack bypasses Cloudflare Workers' DyPrIs defense, leaking JWT tokens via microarchitectural timers; Cloudflare responded with MPK-based isolation.