Kategorie

A program could get past some Linux security rules by changing the number it sends with a request.

Attackers are exploiting a flaw in Brotli, Google's software for unpacking compressed data.

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure," Lumen Technologies Black Lotus Labs said in a report sharedRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores get the features from December 1, but only onSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft fixed the Edge bugs the day after the contest,Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]

Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]

Otter has added a new Work mode to its AI Chat assistant, expanding the range of tasks it can carry out before and after meetings.

It’s part of a wider drive by Otter — which received $320 million in funding last week — to move beyond meeting transcription and into automating tasks and workflows.

The Work interface, announced Tuesday, is accessible in the AI Chat prompt box, alongside the Chat option. While Chat allows users to ask questions, generate content, and retrieve information, Work is aimed at multi-step actions, Otter said. It’s a similar approach to other AI assistants, such as Claude and ChatGPT, that separate simpler chat functionality from newer agentic capabilities.

Prior to a meeting, Otter users can prompt Work to generate briefing documents based on information collated from previous calls and data from connected applications. After a meeting ends, the AI assistant can draft emails, generate documents — including Word and Notion docs, PDFs, and interactive web pages — and update Salesforce records.

The AI assistant requires human approval before completing tasks, an Otter spokesperson said.

The capabilities expand on functions already available with AI Chat’s existing Advanced mode. Otter will now remove the Express and Advanced options from the AI Chat interface.

Work mode is available now to all paid Otter users. There are no usage limits, Otter said — this differs from the Chat mode, which allocates a certain number of queries each month depending on a customer’s payment plan.

The feature updates reflect how meeting note taking is rapidly moving from data capture to workflow automation, said Irwin Lazar, principal analyst at Metrigy. “That is, vendors are delivering solutions that allow meeting notes to be actionable, based on context both from within meetings, as well as from other connected platforms,” he said.

Lazar pointed to similar functionality emerging in other meeting systems such as Microsoft’s facilitator in Teams and Cisco’s Webex meeting agent.

The vast majority (91%) of business users want meeting note-takers to access and act on context from outside a meeting, according to a global study of 403 organizations in Metrigy’s “Workplace Collaboration & Employee Experience: 2027” report.

In addition to the Work mode, Otter announced that its Live Assist feature is now available to enterprise customers, and will expand access to all paid Otter accounts in the coming weeks. Live Assist, announced in April, provides private guidance to a user during a call, such as suggesting questions and tracking meeting “objectives.”

“I see this kind of widget assist a lot in external-facing customer support roles, but for internal productivity meetings, this is quite unique,” said Thomas Randall, a research director at Infotech.

However he said that Otter faces from other meeting software vendors which are also integrating AI capabilities into their platforms. “So I don’t see Otter becoming a center of work, though its new functionality will be of great assistance to pre-existing users,” said Randall.

Related:

• Cisco brings collaborative agents and Claude into Webex chats
• AI notetakers at work could leave companies at risk for lawsuits

Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]

A new study from the Coalition for Language Equity in AI Research shows that AI models require significantly more tokens to process certain languages than others. These differences mean that users of underrepresented languages risk paying more for the same services, reports Rest of World.

An LLM’s tokenizer breaks text down into blocks, or tokens, but it does so much more optimally for languages with abundant digitized data, the researchers explain. They found that among the 20 languages with the largest web presence, less common languages used from 1.5 to 5 times as many tokens as the same prompt in English. When the study was expanded to 200 languages, the difference increased to as much as 17 times in one of the models examined.

Since most LLM providers charge by tokens used, that translates to much higher costs. In addition, more tokens mean longer response times and a smaller amount of information that’s able to fit into the AI models’ context windows.

The researchers describe this as a hidden “tokenizer tax” and warn that it exacerbates digital inequality.

This disparity is not limited to languages with few speakers, the researchers note. “If we sort by speakers instead of web presence, the tax lands on enormous populations: Punjabi (~200 million speakers), Bengali (~266 million), Urdu (~288 million), Burmese (~36 million), Amharic (~36 million). This means hundreds of millions of people billed at multiples of the English rate for the same intelligence,” the study says.

Languages that use writing systems not as commonly found in the AI models’ training data are particularly affected. Examples include Burmese, Tibetan, Khmer, and Lao. Languages that use the Latin alphabet, on the other hand, often have an advantage, even when spoken by relatively few people.

Related: CIOs grapple with subpar global genAI models

PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]

Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its CriticalRavie Lakshmananhttp://www.blogger.com/profile/[email protected]

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]

A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate [email protected]

Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution. Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]