Agregátor RSS

Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said.

Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain "Plex2Shell."

Complex exploit chain

The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination.

Read full article

Comments

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]

Open source Windows alternative ReactOS has reached a major milestone: The operating system can now be installed directly onto an NTFS drive partition. As reported by Phoronix, the move to NTFS clears a long-standing hurdle for the project and brings it one step closer to finally reaching beta.

Prior to this latest announcement, ReactOS required users to keep a FAT32 partition for installations. A proprietary Microsoft-developed filesystem, NTFS can trace its roots back through the Windows NT family lineage starting in 1993 with Windows NT 3.1. The variant introduced with Windows XP in 2001 remains the standard used by most Windows systems today. With ReactOS's stated goal of reaching binary compatibility with Windows Server 2003, being confined to FAT32 partitions was a practical barrier to clear on the way to reproducing the Windows environment.

However, users looking to hop off the Windows train shouldn't be grabbing their bags just yet. ReactOS wrote that the new driver still "lacks caching (which causes inferior performance), journaling and security support." So while the new driver is here, even the most intrepid of OS tinkerers should tread carefully. The ReactOS team warned in its announcement on X that there are still "potentially undiscovered bugs."

Read full article

Comments

Updating your software only gets you so far. A scary scenario - security fixes themselves being bypassed - is becoming more common, according to AI penetration-testing startup Terra Security, which found a sharp rise in reported patch failures in 2026 after years of relatively low numbers. And no, it’s not a coincidence that AI vulnerability discovery and patching also exploded this year. For example, Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February. Redmond’s patch, however, was incomplete, and left a second flaw - a zero-click authentication coercion vulnerability (CVE-2026-32202) - that was also found and abused before Microsoft fixed it in April. Terra researchers reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes, and found a distinct pattern. After six years of relatively few patch bypasses, this changed in 2026: “A fix would ship, a bypass would be found, and another fix would go out.” The share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0.2 percent between 2019 and 2025. This year, this figure had jumped to 2.3 percent, according to the researchers. Meanwhile, vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency's (CISA's) Known Exploited Vulnerabilities list as other bugs affecting the same vendors, according to Terra. Of these, server-side request forgery fixes and prototype-pollution patches break the most. Compared with their share of all CVEs, prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs, while server-side request forgery vulnerabilities were 4.6 times as common, according to Terra. This has to do with the way these types of bug classes are fixed: using a reject-list of inputs such as hostnames, paths, and object keys. There’s a “simple” reason for this, according to Terra. “If the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one,” the researchers said. Fixes for Linux kernel vulnerabilities are also more likely to cause new bugs, according to kernel CNA records as of October 8. “In fact, 3.2 percent of kernel CVEs were introduced by the fix for another CVE, and about 10 percent in busy subsystems like fs/smb and net/sched,” the bug hunters noted. The silver lining in all of this, we’re told, is that it should be a wake-up call for software vendors and network defenders to break the “patch and move on habit.” Instead, before shipping patches, software vendors should consider three questions: Does it fix the root cause? Does it cover the whole bug class? Does it break something else? And for sysadmins and patch managers: consider the same things before applying the fix. “If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it,” the pen testers advise. ®

Using a system called BootLoops, scientists produced 36 papers in three months. Paired with experts, the tool could pollinate ideas across fields.

Some major scientific advances involve taking a technique developed in one field and applying it to another, but interdisciplinary research is tricky and time-consuming. Now a new AI research system has automated the process, generating 36 papers in three months.

Most researchers work within a narrow specialty, and few have time to comb through unrelated fields for tools that might help them. As a result, researchers can end up banging their heads against a problem scientists in another discipline have already solved.

But Harvard physicist Matthew Schwartz stumbled across a potential solution while working as a visiting researcher at AI firm Anthropic. After getting the company’s AI, Claude, to develop a suite of tools for mathematical physics, Schwartz discovered they could help solve quantitative problems in a host of other areas.

Called BootLoops, the tools, which are model agnostic, help AI search scientific literature, write code, and solve mathematical problems. Working with 19 coauthors, Schwartz used BootLoops to produce 36 manuscripts on topics ranging from ecology and linguistics to health insurance and sunspots.

“Once Claude had BootLoops, it kept noticing the same pattern: many fields have problems that a technique from mathematics, physics, or computer science would solve outright if anyone knew it existed,” Schwartz wrote in an Anthropic blog post about the system.

Schwartz first started using Claude as a general-purpose research assistant last December, and while he was able to do some useful work with it, he says it required constant handholding. So he decided to instead point it at problems that were a good match for the model’s strengths—what he calls “Claude-shaped problems.”

He started with the equations physicists use to interpret particle collisions at the Large Hadron Collider. The best methods were scattered across software in several programming languages or existed only on paper, so he got Claude to combine them into a single framework. Using the tools it had built itself, the model reproduced the results of one of his papers in about 20 minutes.

Schwartz then moved onto a harder class of these equations, and within a few weeks, the model had solved 30 of them, including 15 that had never been calculated before. It didn’t take long for Schwartz to realize that many of the methods the AI had developed could be used in neighboring areas of physics such as cosmology and string theory.

But it was Claude itself that made the bigger leap, pointing out that the same kinds of equations turn up in population genetics and evolutionary biology. The problem for Schwartz, however, was that he found it harder to tell when Claude was overselling its findings in fields he was less familiar with. So he brought in experts from each field to judge which of Claude’s findings were worth pursuing, and from some 400 candidate problems, 36 ended up as papers.

One project examined the star ratings used to grade private health plans under Medicare, which determine the bonuses insurers receive. The rules say the boundaries between ratings levels should be drawn so each plan’s score sits as close as possible to the average of its group, but the algorithm Medicare actually uses is a shortcut that doesn’t guarantee this.

Using a statistical method dating back to 1958 to calculate the exact answer, BootLoops found drawing precise boundaries would push 34 plan ratings across the bonus line, 16 up and 18 down. This would shift an estimated $0.9 to $1.4 billion in bonus payments between 2025 and 2027.

Another project tackled a 150-year-old puzzle about what kills sunspots. Because the sun’s rotation hides sunspots from view for much of their lives, astronomers have never been able to agree on how long they last or why they disappear.

Borrowing a tool doctors use to measure how the risk of dying changes with age and applying it to every sunspot logged since 1874, the team found that sunspots age. At a given size, their risk of “dying” rises about 20 percent a day, something none of the published theories could account for.

For each new problem, Claude built new tools, so the BootLoops toolkit kept growing, and it now spans 22 fields, according to the project’s website. Other problems it’s tackled include how Earth’s atmosphere first filled with oxygen, how quickly tree species come and go in a Panamanian rainforest, and how natural selection weeds out harmful mutations in humans.

The kinds of cross-disciplinary leaps BootLoops can make are extremely rare, Georgia Channing, artificial intelligence for science lead at Hugging Face, told Science. “A physics researcher wouldn’t spend six months reading linguistics research in order to figure out how to repurpose linguistics methods,” Channing said.

That’s not to say the system isn’t without flaws. Schwartz says many of Claude’s early findings were technically correct but scientifically unremarkable until experts steered them, and he warns that the model “loves to declare victory” too early.

But the results suggest AI may be a powerful way to pollinate ideas across research fields, even if we still need humans to decide which ones are really worth pursuing.

The post New AI Tool Could Help Scientists Make ‘Rare’ Cross-Disciplinary Leaps appeared first on SingularityHub.

Sytém iOS skrývá spoustu šikovných funkcí, o kterých možná nevíte • Mnoho z nich však může zlepšit uživatelský zážitek • Toto je výběr těch nejzajímavějších

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]

Při některých činnostech Windows 11 reagují o 20 % rychleji. • Microsoft popisuje, že zlepšil správu paměti a někde ji ušetřil. • Vylepšení postupně mířila do verzí 24H2 a 25H2, role 26H2 není zřejmá.

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and theSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Smartphony bez služeb od Googlu potřebují zaujmout něčím neobvyklým • Tato novinka má 4" displej a modulární klávesnici, která slouží i jako touchpad • Unikátní vlastností je i změna IMEI kódu telefonu doslova na počkání

Byla vydána nová verze 25.12.6 linuxové distribuce primárně určené pro routery a vestavěné systémy OpenWrt (Wikipedie). Opravena je řada zranitelností v základních síťových službách, které jsou ve výchozím nastavení aktivní a které lze zneužít na dálku. Důrazně je doporučena aktualizace.

Netflix se chystá na dosud největší experiment s klasickou kinodistribucí. Nová Narnie režisérky Grety Gerwigové jde v únoru do kin po celém světě, včetně projekcí IMAX. Na Netflix dorazí až 2. dubna. Sedmitýdenní odstup je pro streamovacího giganta velmi neobvyklý a může naznačit, jakým směrem se ...

Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]

Předpověď počasí by mohla být v brzké době ještě mnohem spolehlivější, před pár dny totiž vstoupila do služby nová evropská meteorologická družice Meteosat-13. Třináctka se oproti svým předchůdcům, kteří snímají kontinent už od 70. let minulého století, diametrálně liší. Je to totiž první sounder ...

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Český projekt mapSTL.com promění vybrané místo na světě ve 3D mapu pro tisk, včetně měst, kopců a hor. Vytištěnou mapu můžete také pověsit na zeď jako obraz. STL i barevný 3MF stáhnete zdarma a bez registrace. Vyzkoušejte své oblíbené místo a podělte se o zpětnou vazbu.

Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. [...]

F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. [...]

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]