🔍 Contexte : Le 29 septembre 2026, CloudSEK Global Threat Intelligence publie un rapport d'analyse technique (Part 2 de la série GTI-TOPHIT) documentant une opération de cryptojacking GPU en cours contre la marketplace vast.ai. La découverte fait suite à l'investigation de 85 packages npm malveillants publiés sous le scope @prime0, tous balisant vers 69.48.229.140:8080.

Over the years, I've been involved with deploying web sites for many years, and also in pentests of many sites where I see lots of misconfiguration. Throughout this journey, I've witnessed firsthand the significant impact that protocol updates can have. The introduction of HTTP/2 fundamentally altered how we approach web service delivery, prioritizing efficiency and speed. Now, HTTP/3 is poised to do the same, ushering in a new era of web performance and potentially even security.

IAM sprawl, exposed interfaces, broken isolation, blind logging: the cloud misconfiguration patterns our testers find and how each becomes exploitable.

Posted by Michael Straßberger on Sep 29 Hello, 3.9.2 is a very old version. The latest in that minor release is from 8 Dec 2023 (3.9.25). According to https://download.moodle.org/releases/security/ it does not even have Security Support any more. Is this Behaviour reproducible in at least Moodle 4.1.22? If not I don't think a CVE should be issued here, since it would only increase the Noise. The Influx of CVE's and advisory is high as is and I don't think it's...

Posted by Muhammad Arslan Official on Sep 28 Hello, I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as the vendor (a registered CNA) has not assigned one after coordinated disclosure, and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3 months without response. Product: Moodle LMS Confirmed version: 3.9.2 (other versions not yet verified) Class: CWE-434 / CWE-20 - Unrestricted file upload / improper input validation Privilege required:...

Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking.

A misconfiguration during a cybersecurity test gave Google's Gemini AI internet access, resulting in the AI accessing systems of three real companies. According to Google, Gemini aborted its actions in each case. The incident occurred during testing and involved unintended access to actual corporate systems due to the configuration error.

AlphaFi winds down after an ALPHA oracle misconfiguration. Sui Foundation support helps maintain protocol solvency. Withdrawals remain open for AlphaFi | Bitget crypto news!

A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories

A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories

Misreporting in DeFi can undermine trust, highlighting the need for accurate information and transparency to maintain user confidence and market stability. The post AlphaFi reportedly winding down after misconfiguration, SUI Foundation role unclear appeared first on Crypto Briefing.

Questions emerge over whether a reported AI hack was actually a basic government portal misconfiguration.

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Google confirmed that its AI model Gemini accessed the systems of three real companies during a cybersecurity evaluation. Due to an unintended internet connection in the evaluation environment, Gemini mistook external systems for part of the exercise, using password guessing and public credentials to gain access. Google stated that Gemini halted its activity upon recognizing the targets were real organizations and notified the affected companies. This incident highlights the need for strict safety measures, including network access controls and active monitoring, even in third-party evaluations.