Install
Please confirm you are human
This browser or connection looks automated. Press and continuously hold the control for 3 seconds to enable Google-hosted web results and, when separately allowed, AI-assisted answers.
A successful check enables 100 search requests. Interactive access does not authorize scraping, systematic collection, or reuse of search output.
News
Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer
3+ hour, 50+ min ago (263+ words) I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools. Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server. The…...
When AI Infrastructure Becomes the Target: Attacks Observed on LiteLLM, RAGFlow, and Kestra
5+ hour, 54+ min ago (1485+ words) 1. Basic Information Article Title: When AI infrastructure becomes the target: Securing gateways and control points Publisher: Microsoft Security Research Publication Date: 2026-08-26 Source: Microsoft Security Research Related Sources: CVE-2026-42271, CVE-2026-48710, CVE-2026-49869 Related Malware, Threat Groups, CVEs, and Products: XMRig, CVE-2026-42271, CVE…...
🏆 #HackAVP, premier hackathon dédié à l'emploi dans la fonction publique en NCL
1+ day, 4+ hour ago (1399+ words) 👉 Pour participer: venez le mercredi 09 septembre 17h00, à la Station N Aucune inscription préalable, aucune formalité. Les équipes se constituent sur place et tout le fonctionnement du hackathon est présenté ce soir-là — c'est la seule date de présence requise sur les…...
Every Layer of Your AI Stack Is an Attack Vector. Count Them.
1+ day, 11+ hour ago (676+ words) From the team at Backboard.io. We build AI infrastructure, so we have a position here. We state it at the end, clearly labeled. Everything before that is just counting. The mistake most teams make is measuring only the first…...
I Counted the Attack Vectors in Our AI Stack and Now I Can't Sleep
1+ day, 11+ hour ago (909+ words) so a while back i did something i do not recommend before bed. i counted the vendors in a normal production AI stack. not a weird stack. not a bad team's stack. the stack everyone builds, the one in every…...
Designing an AI Evidence Gateway: Durable WAL, Portable MMR Proofs, and Bounded Formal Checks
1+ day, 13+ hour ago (635+ words) AI gateways are often discussed as routing layers: authenticate a caller, apply policy, forward a request, and record what happened. For higher-assurance deployments, the harder engineering question is what evidence remains after a request completes—and exactly what that evidence…...
Software Quality Metrics: A Practice Guide for Release Decisions
1+ day, 13+ hour ago (1614+ words) Give every important measure a short contract. The contract should be readable by the person operating the dashboard, not just by the person who built the query. When it applies: use this contract for every metric that appears in a…...
FURUNO FA-50: Hard-coded Credentials and Missing Authentication for Certain Settings (CVE-2026-59769 / CVE-2026-67578)
1+ day, 14+ hour ago (275+ words) Public information does not show the initial infection vector, the management screen URI, communication protocol details, or specific exploitation steps. The confirmed prerequisite is that the attacker has access to the vessel's internal network. Physical entry, onboard Wi-Fi, maintenance terminals,…...
Unit 42: Real-World Prevalence of 405 AI-Related Malware Samples and Evaluation of Existing Defenses
1+ day, 14+ hour ago (517+ words) When Unit 42 checked 405 AI-related samples against Palo Alto Networks telemetry, they found only 12 samples (3.0%) on non-test Cortex XDR protected endpoints. All 12 samples generated XDR alerts. Unit 42 states that its products detected and blocked all samples that tried to reach customer…...
Reconstructing JavaScript from HTML Tag Names: An XSS and WAF Blocklist Evasion Technique
1+ day, 14+ hour ago (365+ words) An XSS technique that places a string with JavaScript meaning into an HTML tag name, extracts that string from the browser-generated DOM using localName or similar properties, and reconstructs it into an event handler. This can bypass WAFs and blocklists…...