Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Apple patched a CoreGraphics zero-day that may have been exploited in targeted attacks. A public PoC for the flaw is now available.
← Thèmes
💻
Développement
Langages, frameworks, outils et pratiques de développement logiciel.
542 articles
S’abonner (RSS)US sanctions 10 over ATM malware scheme tied to Tren de Aragua
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States.
Over 543,000 valid credentials exposed in public GitHub repositories
GitGuardian found 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year.
WSL Containers est disponible pour tous et vient marcher sur les plates-bandes de Docker Desktop
Microsoft livre une première version stable des conteneurs WSL. Il n'a pas encore implémenté d'équivalent à Docker Compose.
Cloudflare se projette en Let’s Encrypt post-quantique
Cloudflare a entamé des démarches en vue de devenir une autorité de certification publique gratuite, avec la transition post-quantique en toile de fond.
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco confirms active exploitation of a Catalyst SD-WAN Manager authentication bypass that can grant unauthenticated attackers admin API access.
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
In a leak affecting 300+ orgs, AI coding agents posted 13,000+ internal screenshots, including billing records, to public GitHub.
Microsoft is rolling out Linux container support to WSL
and Intune can now disable them or limit image pulls to approved registries.
IAM for AI agents: A Practical Enterprise Framework
Human IAM wasn’t built for autonomous agents, and credential borrowing could turn every trusted identity into an attack path.
Building a post-quantum certificate authority with Merkle Tree Certificates
The move will be part of a major overhaul of the ecosystem for website authentication.
Microsoft déploie sa mise à jour Windows 11 26H2, voici ce que ça change
Windows 11 26H2 commence son déploiement officiel, mais rien ne vous oblige à l’installer tout de suite. De Windows Update au Registre, plusieurs méthodes permettent d’en repousser l’arrivée, voire de la bloquer sans sacrifier les correctifs de sécurité.
New Spectre v2 Variant Exposes Intel, AMD, Arm CPUs to Data Leaks
A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average.
L’astuce de serveur que j’applique partout depuis 20 ans…
EmDash 1.0: the stable CMS with a secure plugin registry
EmDash plugin security gets a rethink as Cloudflare's CMS 1.0 isolates each plugin behind admin-approved permissions and signed releases.
OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions
Similar performance, security tradeoffs also seen in current public models.
How we found 24 Android vulnerabilities using our open source AI security agent
GitHub's AI Android app vulnerabilities research uncovered 24 bugs, including a location leak and a Wikipedia takeover flaw.
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
L’ESA confie à OVHcloud et CGI le futur socle numérique de l’observation de la Terre
OVHcloud et CGI ont remporté un contrat de plusieurs millions d'euros auprès de l'Agence spatiale européenne (ESA). Les deux groupes vont participer à la construction de Digital EO, une infrastructure numérique dédiée aux données d'observation de la Terre.
Git v2.56.0 released
Version 2.56 of the Git distributed version-control system has been released. It has 748 non-m [...]
Storm-3168: Agentic-driven cloud attacks using compromised service principals
The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components.
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code.
Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer
Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.
New Carbonato malware uses AI agents to hijack exposed Docker hosts
CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution.
Crédit, trading, recherche : BNP Paribas mise sur Gemini pour automatiser ses métiers CIB
La banque va notamment intégrer les modèles Gemini à son assistant LLM@CIB et expérimenter des agents IA sur plusieurs processus de Corporate &...