Hackers target exposed Vite dev servers to steal AWS, Azure secrets
Attackers exploit a Vite flaw in exposed dev servers to extract cloud credentials, configuration files, and infrastructure state.
← Thèmes
💻
Développement
Langages, frameworks, outils et pratiques de développement logiciel.
1912 articles
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
A Telegram Desktop flaw lets bots inject JavaScript into exported chats, enabling data theft and page manipulation.
macOS 27 Golden Gate is Now Available for all Users!!
Apple has now released the first public version of macOS 27.0 Golden Gate, together with security updates taking Tahoe to 26.7, starting its first two years of security-only support, and Sequoia 15…
CISA Adds Three Known Exploited Vulnerabilities to Catalog
U.S. CISA adds Acronis Backup, Cisco ISE, and Google Pixel flaws to its Known Exploited Vulnerabilities catalog.
Mistral et Cloudera scellent un partenariat pour une IA « souveraine »
Si le discours sur la souveraineté reste à nuancer, l’alliance de Mistral AI et Cloudera repose avant tout sur l’IA privée et le contrôle des infrastructures et des données au service des secteurs bancaire, industriel et public.
Broadcom complique la tâche pour les outils de migration VMware
An SDK useful to enterprises rolling their own tools for migrating off VMware is now only available to Broadcom’s top partners.
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft details a million-email CEO fraud campaign and passkey-themed attacks that compromised cloud accounts and enabled data exfiltration.
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Threat actors have been chaining three JFrog Artifactory vulnerabilities to gain admin privileges and deploy backdoors.
GitLab urges users to patch max severity path traversal flaw
CVE-2026-85706 is a path traversal vulnerability with a 10 out of 10 CVSS score, affecting both GitLab Community Edition and Enterprise Edition instances.
OpenAI Agents API 🤖, open model adoption 📈, sharded Postgres 🧑💻
OpenAI Agents API 🤖 html <table align="center" border="0"...
Conti ransomware gang member sentenced to 4 years in prison
Ukrainian lawyer and Conti malware developer Oleksii Lytvynenko was sentenced to four years in U.S. prison for ransomware attacks.
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Two critical Check Point VPN flaws could enable remote code execution. Patch now and restrict VPN access before exploitation begins.
Ivanti Patches Critical Flaws Across Enterprise Security Products
Multiple vulnerabilities have been discovered in Ivanti products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the system. Ivanti Endpoint Manager Mobile (Ivanti EPMM) is a mobile management software engine that enables mobile device, application, and content management. Ivanti Neurons is a cloud-based automation platform that unifies IT operations and security management into a single system of record. Ivanti Sentry is an in-line gateway that manages, encrypts, and secures traffic between the mobile device and back-end enterprise systems. Depending on the privileges associated with the system, an attacker could then install programs; view, change, or delete data. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Qualcomm et Amazon veulent déjà réinventer les data centers de l'intelligence artificielle
Ça bouge toujours dans le monde de l’IA et des datacenters. Cette semaine, Arm annonce son Neoverse CSS N4, avec jusqu’à 128 cœurs CPU, du PCIe 7 et de…
PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Selon un rapport de la société de cybersécurité GreyNoise, des agents IA ont piraté des centaines d'organisations en quelques heures, parfois sans même respecter les consignes de leur opérateur humain. PaperCut, voilà la cible sur laquelle se sont concentrés les attaquants. Ce logiciel de gestion d'impression très
Nintendo Switch 2 : la dernière mise à jour corrige enfin l’un de ses défauts les plus frustrants
Les possesseurs de Switch 1ère génération devraient installer la version 23.0.0 du firmware de leur console séance tenante. Cette mise à jour corrige en…
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA adds three exploited Cisco, Citrix, and Fortinet flaws to KEV, requiring federal agencies to patch by September 12, 2026.
CISA Adds Four Known Exploited Vulnerabilities to Catalog
U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.
OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor
Perplexity uses Astra to write communications, change software, and monitor production systems, and checks in much less frequently than with earlier models.
Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
Three threat groups are exploiting two Cisco FMC flaws to steal credentials, gain root access and deploy Qilin ransomware.
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Espionage groups have been using BlueMoon, an exploit kit chaining recent Chrome and Windows zero-day vulnerabilities.
Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing
The settlement concludes a legal fight that dates to April 2024, when UK users sued for the alleged violations of their country’s privacy laws.
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) proces...
After SAP settlement, Oracle draws EU antitrust attention over licensing practices
La Commission européenne examine les pratiques de licences logicielles d’Oracle, avant une éventuelle enquête formelle. Aucune procédure n’est ouverte à ce stade, mais Bruxelles a déjà consulté des tiers sur le sujet.