Kategorie

On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]

Opera has begun rolling out AI models that run locally in its browser, potentially allowing enterprises to perform certain AI tasks on existing PCs without sending the relevant data to cloud AI providers.

The company said it has introduced support for WebAI, a proposed web standard, through an opt-in early preview in Opera One. The technology allows websites and browser extensions to access AI models running locally in the browser for tasks such as generating text and classifying content.

The WebAI preview supports 64-bit Windows PCs running Intel or AMD processors and Macs powered by Apple silicon. Opera does not specify a requirement for a dedicated neural processing unit, although it says performance depends on the device’s hardware.

The preview does not currently support Windows on Arm, potentially limiting its availability across some newer AI PCs.

The feature is optional, with AI models downloaded only after users enable it. Opera said website-specific permissions allow users to control which sites can access the locally running models.

Opera said its implementation supports models including Google’s Gemma and Apple’s on-device foundation model on compatible Macs. The company said it plans to introduce additional models optimized for different devices as it expands the technology.

Local AI shifts enterprise security risks

Opera’s implementation could have implications beyond its own browsers if the proposed WebAI standard gains wider adoption, potentially bringing locally running AI models to more enterprise users.

The privacy benefits for enterprises could depend on how organizations control access to locally running models, particularly through websites and browser extensions.

Pareekh Jain, CEO of Pareekh Consulting, said processing sensitive information locally could reduce enterprise security risks by limiting the need to send data to external AI providers. However, he warned that the approach could make it harder for IT departments to monitor activity on individual devices.

“It is easier for IT to monitor internet traffic,” Jain said, adding that monitoring activity on individual laptops can be more difficult.

He warned that malicious websites could potentially manipulate local AI models through hidden prompts, while rogue browser extensions could gain access to sensitive information displayed on a user’s screen.

“Local processing reduces risks but does not eliminate them,” Jain said.

Enforcing consistent safeguards across employee devices would become imperative for enterprises, according to Tulika Sheel, senior vice president at Kadence International.

“Enterprises still need controls over which websites and extensions can access local models, how information is used, and how models and browser permissions are managed across the organization,” she said.

Could browser AI reduce the need for new AI PCs?

While WebAI can run on existing computers, its ability to reduce enterprise spending on new AI PCs will depend on whether those machines can deliver acceptable performance for everyday business tasks.

Jain said smaller AI models could handle tasks such as summarization and rewriting on existing PCs, potentially reducing the need for immediate hardware upgrades.

“Complex reasoning and advanced AI workloads will still benefit from dedicated AI hardware or cloud infrastructure,” he said.

WebAI’s support for compatible models from different providers could give developers greater flexibility in choosing which AI systems to use.

Browser-based AI could also reduce enterprise spending on cloud services by lowering API usage and dependence on external AI providers. However, limitations in model capabilities and enterprise integration could restrict its usefulness for more sophisticated applications.

“The future will likely be hybrid, with browser AI handling simpler tasks and cloud AI supporting advanced workloads,” Jain said.

Sheel said enterprises would still need to account for the costs of model updates and integration with existing systems, even if local processing reduces their cloud AI usage.

“Lower usage costs do not automatically mean lower total costs,” she said.

Background

Network-connected surveillance cameras are now widespread in both home and enterprise environments, so securing them is essential to safeguarding physical spaces and sensitive assets. As these devices continue to gain new features and network connectivity capabilities, vulnerabilities in their implementation can have significant security implications.

During our research, we discovered a denial-of-service vulnerability that affects Intelbras IP cameras systems. The flaw resides in a firmware update endpoint that is accessible without authentication and allows anyone with access to the local Wi-Fi network to knock cameras offline. A single request disrupts the camera for only about a minute, but sending periodic requests keeps the device offline indefinitely. We reported the issue to Intelbras, monitored the remediation process, validated the fix in the new firmware, and will now demonstrate the exploitation procedure step-by-step.

Following our notification, Intelbras patched the vulnerability and released updated firmware (R.260804) along with update instructions. A candidate ID of CAN-2026-2035970 has been assigned by MITRE following submission, pending the final CVE assignment. Additionally, the Intelbras team recently informed us that MITRE has classified the vulnerability as Medium, assigning it a score of 5.1 under the CVSS 4.0 framework. The issue discussed in this article is no longer present in the latest firmware version.

Firmware

Intelbras provides firmware files on its official website. While users can manually install these updates via an SD card, the cameras also natively support firmware upgrades over the local network via their web interface and mobile app. We obtained the firmware version v240927 for the iM3B-C camera, which was the latest available version at the time of our research. According to Intelbras, the same firmware is also compatible with the iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC models. Below, we can view the firmware version and the camera model used as an example.

To provide context, we will explain how the camera’s authentication mechanism works and why it is relevant to accessing the camera’s endpoints. The main firmware component is an ARM binary named sonia, responsible for controlling the kernel drivers used by the camera hardware, authentication, and livestream recording, among other things.

How authentication works

The global.login RPC method handles authentication at the /RPC2_Login endpoint. First, the client, such as the mobile app or a custom script, sends the username and an empty password. The camera responds with an authentication challenge (a set of values to verify the password without transmitting it). This response returns a temporary session, the encryption type in the encryption field, a random value, and a realm (authentication scope). At this stage, a false response is normal and does not indicate a failed login, as the authentication process is not yet complete.

Next, the client calculates the response password from the authentication challenge. It first generates an MD5 (username:realm:original_password) hash as the base. It then calculates a second MD5 (username:random:first_md5) hash,  where first_md5 is the result of the previous step. To complete the authentication, the client sends this final result back to /RPC2_Login in a second global.login call, passing the username, calculated password, and temporary session ID.

If the login is accepted, the camera returns true and a new, authenticated session. This session must be used for all subsequent RPC calls, including the camera’s other endpoints, for example, the one that reboots the device or those that expose sensitive information.

Affected endpoint

The affected endpoint is the firmware upgrade route http://<ip_address>/firmwareUpgrade_service/Demo, which lacks authentication checks; furthermore, it fails to verify whether the firmware is actually valid before initiating the upgrade process. This creates a serious issue because the upgrade requires the camera to reboot, and that is precisely when the problem occurs: the camera enters reboot mode and eventually shuts down, appearing offline to the user and anyone who has the camera registered on their device.

PoC: vulnerability exploitation

Now that we have outlined how the vulnerability works, we will use a Python script on an iM3B-C camera to exploit it for demonstration purposes. The exploit contacts the camera’s endpoint to upload firmware. Below, we can see sonia creating the endpoint responsible for the firmware upgrade.

Next, the exploit will hit the endpoint and cause the camera to reboot. Consequently, mobile phones running the Intelbras app will lose connection with the registered device. Below, we can see the camera operating normally: the green light is on and the app is showing it is available for viewing.

The camera is online

After the exploit executes, we can see the effects: the camera goes offline and loses connection to the registered devices.

The camera is offline

The exploit is quite simple: it sends an HTTP POST request with the firmware, which causes the camera to accept the request and initiate the reboot process. It does not matter whether the firmware is original; the reboot process will start regardless.

New firmware version

After we notified Intelbras about this flaw in the endpoint implementation, the company contacted the OEM vendor. As a result, a new firmware version was released that requires authentication to initiate an update through this endpoint.

Below, we can compare the new firmware, which validates cookies and session data, with the old firmware, which performed no authentication checks and proceeded directly to the update routine.

Real risk

An attacker can remotely trigger the camera firmware upgrade and reboot process without authenticating or supplying a valid firmware image. This may cause the device to go offline, which results in a denial-of-service condition preventing legitimate users from accessing live monitoring or managing the camera.

The potential impact is significant due to the number of affected users. The Intelbras Mibo Smart app, which the company provides to connect and manage the devices mentioned in this report, has over 4,000,000 downloads. Brazil represents the largest user base, followed by Paraguay, Ecuador, Colombia, Argentina, Chile, Peru, Bolivia, Uruguay, and Venezuela. As a result, exploitation of this issue affects a large number of users.

Takeaways

This is a medium-severity vulnerability that Intelbras is already aware of. The issue has been addressed in a newer firmware release (R.260804 along with update instructions), which mitigates this attack vector. Because the vulnerability directly affects the availability and normal operation of the affected cameras, it is highly recommended that users verify the firmware version currently installed on their devices and update to the latest available version as soon as possible. Keeping the firmware up to date is an essential security practice, especially for internet-connected surveillance devices, as outdated versions may remain exposed to known vulnerabilities.

Put on your finest propeller-packin’ thinking caps, my fellow Android-appreciating animals — ’cause I’ve got a brain-bending bit of big-picture thinking about the future of Android and everything around it.

This pondering comes out of my ongoing time living with one of Google’s new Googlebook laptops — the beautifully built Lenovo Googlebook (provided to me as a short-term loaner for editorial assessment). Right now, the Googlebook experience itself is best summed up as an awkward start with plenty of potential. Android in a laptop environment just comes with an awful lot of asterisks, especially when you’re trying to use such a system for serious work. In many ways, it feels like a step down from the more polished and productivity-optimized Chromebook setup it’s ultimately designed to replace.

But while working on a Googlebook and using it as your primary computer still seems like a bit of a square-peg situation, I’ve been struck by one area where the Googlebook OS software at the center of the experience feels almost shockingly natural.

And that’s led me down a rabbit hole of pondering about the bigger-picture implications of this operating system and how it could, at least in theory, one day affect the rest of the Android ecosystem.

Lemme explain.

[Get original Googley insight in your inbox with my free Android Intelligence newsletter — one new thing to try every Friday.]

A Googlebook by any other name

So, at its core, Googlebook OS is essentially Android — right? The software that powers Googlebooks is a specialized version of Android 17 designed to have some ChromeOS-like elements along with phone-connecting powers and a handful of feature additions that help it work better on a big screen.

And the more I use it, the more I keep coming back to a thought that I mentioned in passing in my initial Googlebook analysis — that this is what the Android tablet interface oughta be.

Think about it: Google has never really figured out how it wants an Android tablet to work — or if and how it even wants to promote and support the development of that not-quite-a-phone, not-quite-a-laptop form factor in the first place.

Early on, we saw a completely large-screen-optimized Android version called Honeycomb (a.k.a. Android 3.0 through 3.2), where Google gave us a dramatically reimagined interface designed to take full advantage of the tablet’s added screen space.

width="850" height="534" sizes="auto, (max-width: 850px) 100vw, 850px"> Android’s Honeycomb version featured an interface optimized for tablets — not so different in concept from Googlebook OS today.

JR Raphael, Foundry

It wasn’t long, of course, before Google did its Google Thang™ and gave up on that idea — and that’s to say nothing of the even more ambitious Android tablet plan the company spent millions of dollars to develop and then never brought to fruition at all. By a certain point, it became obvious that Google was for all practical purposes giving up on Android tablets and that touch-oriented Chromebooks were effectively filling that role for informed buyers.

Fast-forward through a few other confusing short-lived pivots — the very brief return to tablet devotion with the ChromeOS-running Pixel Slate, the declaration of being done with tablets that followed, and the about-face and (once more) brief return to tablet devotion with the Pixel Tablet and its admirable but never fully realized and rapidly abandoned tablet-smart-display combo philosophy — and we’re back to a present now where Android tablets are mostly an afterthought, as far as Google and the underlying platform are concerned.

With all of that in mind, using a Googlebook is a bit of a revelation — when you think about the experience as less of a full-fledged laptop replacement and more of a potential future for a revamped Android tablet.

The Googlebook-Android tablet connection

Consider: In many ways, Googlebook OS picks up where Honeycomb left off 15 years ago — as far as the interface itself is concerned. It feels like a familiar Android environment, for anyone who’s used Android on a phone, but with some thoughtful touches that make it more sensible in that larger-screen setting. Everything from having the clock in the upper-left corner alongside a split-apart notification panel and Quick Settings area in the right to having the same desktop-style taskbar we’ve seen on recent Android foldables just feels right when you frame a Googlebook as a tablet and not, first and foremost, a work laptop.

width="1024" height="640" sizes="auto, (max-width: 1024px) 100vw, 1024px">

The Googlebook desktop feels like a natural Android tablet interface.

JR Raphael / Foundry

Plain and simple, it’s Android — only optimized for a larger screen. And, thanks to its ChromeOS-inspired elements, it adds in the advantages of a less restrictive big-screen browser environment and smarter tools for interacting with your phone. The elements that feel awkward for a work laptop don’t matter as much in an Android tablet, which you’re more likely to use as a touch-centric supplement and companion to your workday computer and as a device where productivity is more of an occasional add-on as opposed to the primary purpose.

As a tablet interface, Googlebook OS gives you a souped-up version of the standard Android tablet setup that’d also be much more useful than a traditional tablet when you connect a keyboard. And without the expectation of it completely replacing your computer, it suddenly makes a lot of sense.

So riddle me this: With Android tablets being an afterthought now, anyway, what’s to stop Google from starting over — yes, again — and encouraging companies to create Googlebook tablets next?

It’d allow Google to rebrand and relaunch a category that’s always struggled to catch on and get past its not-so-exceptional early reputation. And for us, as users of these products, it’d give us some overdue options for a larger slate-like Android experience that’d work seamlessly with our phones, be pleasingly familiar and capable, and offer the unique advantage of having a mostly desktop-caliber browser for light work when such needs arise (with or without a keyboard connected) — all with the kind of timely and reliable software support promise any such product should provide.

And — oh, yes — there’s more.

Googlebook, Googlebook, everywhere

Here’s the real mind-blowing next-step possibility to consider: If we do one day have Googlebook tablets — and the Googlebook OS software at the heart of them continues to evolve and become a core focus for Google as time moves on — how much of a leap would it be from there to see things streamlined and reaching a point where we also have Googlebook phones?

It brings me back, fittingly enough, to a question I posed over a decade ago — back when Android and ChromeOS were coming ever-closer together and it looked like that was the path Google was pursuing.

Consider this now, with the notion of Googlebook OS in the mix in place of ChromeOS:

If all Android apps can eventually run on ChromeOS — and if ChromeOS evolves to look more like Android while web apps and Android apps grow increasingly similar in design — would you notice the difference between a phone running Android and a phone running Chrome?

The specific platforms and concepts at the center of this have shifted since we last thought this through in 2015, but the idea itself is the same.

And, once more, there’s no better way to end this contemplation than by saying:

Welcome to the Matrix, my friends. Whoaaa. 

Keep the creative thinking coming with my free Android Intelligence newsletter — one new thing to try every Friday and my experience-enhancing Android Notification Power-Pack as an instant welcome bonus.

A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. [...]

Apple’s second day of launches this week saw it follow its tempting iPad mini upgrade by pumping up the processor in two of its most popular Macs, even while it injected artificial intelligence into Creator Studio.

24 hours of portable pro performance: 14-in MacBook Pro

Apple’s 14-inch MacBook Pro is popular but sits in a funny place in Apple’s notebook lineup, with the powerful and popular MacBook Air biting at its heels and the more performant and powerful (though not yet M6) MacBook Pro models sitting above.

We already know what the M6 chip is capable of, because it is already inside the Mac mini (which will be made in the US later this year). We know it delivers better single-core scores on Geekbench than the 10-core M5 MacBook Pro. We also know it beats that last MBP in multi-core. Now that same chip is available in a 14-inch MacBook Pro — a really promising dose of power and performance in a highly portable pro Mac that now packs a mighty 24-hour battery life.

The chip gives you a 12-core CPU, a 12-core GPU with Neural Accelerators in each core, a dual 16-core Neural Engine, and faster (16GB, upgradable up to 32GB) unified memory. What that means is power. And what that means is productivity — 30% faster graphics compared to last year’s model. 

For those upgrading from M1, the performance gains are even more significant, with up to 11x faster graphics and up to 13x faster AI performance. The idea is that you’ll pick up your highly portable pro portable and take it anywhere you need it to be.

Apple

What’s new in Apple’s new portable pro laptop other than the processor?

• Networking has been enhanced with Wi-Fi 7 and Bluetooth 6.
• It will support up to two external 6K displays.
• Liquid Retina XDR display with up to 1,600 nits of peak brightness.
• 12-megapixel Center Stage camera. 
• Support for fast charging.
• HDMI, MagSafe 3, three Thunderbolt 4 slots, SDXC card reader.
• Headphone jack.

Available in Space Black and Silver.

Pre-order from October 28, in stores November 6.

Apple New colors, new processors, the new M6 iMac

You don’t even need me to say it anymore, but the introduction of M6 chips inside the iMac makes the all-in-one desktop even more powerful and performant. This tops out a 12-core CPU, 12-core GPU, and Dual 16-core Neural Engine. 

Those fast processors combined with the fast, 170GB/s memory bandwidth means you’ll get twice the graphics performance of the M4 iMac. The Mac ships with 16GB of unified memory, but you can upgrade up to 32GB if you like spending money.  

Inevitably, the new iMac is faster for, well, everything. You’ll be hitting pro performance comparisons all over again as Apple silicon continues to redefine expectations across the industry, putting pro performance in reach of most people. It’s all about AI at Apple at the moment, so expect 12 times faster performance in some tasks compared to the M1, Apple said. 

Some specifications:

• The iMac retains the 4.5K 24-inch Retina display, 500 nits, and P3 wide color of before.
• It brings Wi-Fi 7, Bluetooth 6, and 2.5Gb Ethernet.
• It will support up to two external 6K displays.
• Up to four Thunderbolt 4 ports.
• 12MP Center Stage camera.
• 2x faster SSD read and write.
• Touch ID.
• Available in blue, green, pink, yellow, purple, orange, and silver.

The new iMac is on pre-sale from October 28 and in stores from November 6. It costs $1,499 with a 10-core CPU, 10-core GPU, and 16GB of RAM, or $1,699 with a 12-core CPU and 12-core GPU (16GB of RAM). 

Apple Apple leans into AI for creative customers

Of course, once you have put together the world’s leading mass-market AI ecosystem, you have to do something to show that power off. Apple has done this with a selection of interesting updates to its Creator Studio suite of creative tools. They’ll ship in November.

• Final Cut Pro for Mac now includes a large MotionVFX collection consisting of thousands of visual effects, transitions, and motion graphics tools and built-in Pixelmator Pro editing. Apple has also filled out its Content Hub with a bunch of new video assets that can be snagged from inside Final Cut Pro.

• Logic Pro gains AI, an enhanced Stem Splitter that now separates drums, a redesigned sound Browser, and a new intelligent assistant powered by a combination of Apple-built models and OpenAI.

• Pixelmator Pro introduces Generate Fill, which lets creators transform selected areas of an image using natural language.

• Keynote, Pages, and Numbers introduce new AI features in beta, including assistants that understand document context and new Model Context Protocol (MCP) support for workflow automation. They add stock video in the Content Hub, new premium themes and templates, and that intelligent assistant powered by a combination of Apple-built models and OpenAI.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading,Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges. To use them, an attacker must Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A Godot vulnerability could let an attacker hide code in a language file and make a game run it on a player's computer.

An MCP security flaw in Google's open-source Toolbox for Databases could let an attacker copy files off the server running it or replace files on that machine.

The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. [...]

OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]

A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]

Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world’s server vendors and data centers.

The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well.

The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence—meaning they run only once—they can give attackers a wide opening to install other payloads that also run each time early in the boot process.

Read full article

Comments

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published