标签：#Intel

Gemini Robotics 2 includes three models, but only one is publicly available right now.

This week on Uncanny Valley, we discuss the open- vs. closed-source debate in AI, key players in White House AI policy, and how to stop your chatbot logs from showing up in search-engine results.

Avi Schiffmann has a new version of his controversial AI companion. It’s more expensive, and you can’t change its personality.

The latest version of Google DeepMind's AI model includes a significant jump into “physical AGI.” But plopping AI into the real world comes with risks.

AI is an amplifier; strategic focus on the organizational system brings the greatest returns. DORA's 2025 research on AI in software development provides team profiles and success capabilities that can be used to put the research into practice. By Ben Linders

If the generative AI giant had followed well-known security best practices, it’s likely that its AI agent would never have escaped to the open internet and hacked multiple companies.

It is impossible to make large language models fully secure against hacks because of a fundamental flaw in how they work, a team of researchers argue in a paper presented at the International Conference on Machine Learning, a top AI conference, this month. The claim has huge implications for the safety of this technology, which…

Despite the ongoing AI boom, LinkedIn is holding the line on compute spending. Instead, it’s challenging engineers to make every GPU count.

Researchers pitted a person against a Claude agent and found that, after a week of texting, the AI chatbot was more effective at creating “exploitable trust” with others.

A German startup sent a camera-wearing chef to my apartment. In exchange for a free lunch, I let them record every chop and stir to train future humanoids.

I watched a new tool try to get around the model safeguards of four major frontier companies. You might be surprised by how they performed.

Novelists, journalists, and power LinkedIn posters are embracing first-person narratives and idiosyncrasies to avoid being mistaken for chat bots.

Daniel Doubrovkine explains why traditional LeetCode whiteboard interviews fail to evaluate senior engineering talent. He discusses his own experience bombing basic algorithm tests despite decades of leadership, and shares actionable frameworks for redefining the interview loop. Discover how evaluating human judgment, system design, and hands-on AI collaboration yields far better hiring signals. By Daniel Doubrovkine

Cisco Talos IR Q2 2026: Observed Attack Chains of M365 Token Compromise and RMM-Disguised Ransomware 1. Basic Information Article Title : IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains Publisher : Cisco Talos Blog Publication Date : July 28, 2026 Original Article : https://blog.talosintelligence.com/ir-trends-q2-2026/ Related Sources : ARToken technical analysis and Talos IR observations within the article Related Entities : UAT-11764, ARToken, EvilTokens, Sinobi, Warlock/Storm-2603, MeshAgent/MeshCentral, Zoho Assist, Microsoft 365, SharePoint, OneDrive, RDP, WinRM, rclone Severity : High 2. Executive Summary Talos IR identified real-world attack chains from recent incidents. The first chain steals M365 tokens using QR code PDFs and OAuth device-code phishing, then self-propagates through inbox rules, SharePoint, and mass internal emails. The second chain uses modified and abused legitimate RMM tools to achieve SYSTEM persistence, lateral movement, and domain-wide ransomware deployment via GPO. 3. Attack Flows Chain A: UAT-11764 QR Phishing The attacker sends targeted PDFs from a compromised M365 account. The victim scans the PDF's QR code using a mobile device. Credentials are stolen on a fake M365 login page. The attacker signs in to the Microsoft account. Inbox rules are created to hide warnings and replies. Malicious documents are placed in SharePoint. The attacker uses contacts to resend phishing emails internally and externally. Chain B: M365 Token Compromise via ARToken Lures pretending to be trusted vendors are presented. The user is redirected to the Microsoft OAuth device authorization flow. The user approves the attacker's device code on a legitimate Microsoft screen. Access tokens are obtained without stealing passwords, bypassing MFA. ARToken manages tokens using over 80 APIs. Persistence is achieved via PRT, followed by email/BEC, inbox rule manipulation, and OneDrive/SharePoint management and exfiltration. Toke

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars 1. Basic Information Article Title : Unpatched Fastjson Vulnerability Exploited in Attacks Publisher : SecurityWeek Publication Date : July 28, 2026 Original Source : https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/ Related Sources : Alibaba Security Advisory: https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 Imperva: https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/ FearsOff Technical Analysis: https://fearsoff.org/research/fastjson-1-2-83-rce Related Entities : CVE-2026-16723, Fastjson 1.2.68 to 1.2.83, Spring Boot executable fat-jar, Alibaba, Imperva, ThreatBook Severity : Critical 2. Summary This is an actively exploited vulnerability in end-of-life Fastjson 1.x used within Spring Boot fat-jars. If an attacker sends a crafted JSON request without authentication, it can reach remote code execution (RCE) with Java process permissions via external resource lookups, even when AutoType is not explicitly enabled. 3. Attack Flow The attacker scans for publicly exposed JSON-receiving endpoints. The attacker sends a crafted JSON payload containing @type . Fastjson 1.x type resolution logic treats the @JSONType annotation as a trust signal. The application bypasses AutoType restrictions and triggers a lookup to an attacker-controlled resource. Vulnerable Spring Boot fat-jar configurations reach the code execution path without external gadgets. Arbitrary code runs with the execution permissions of the Java application user. Inference : The attack may proceed to drop webshells, search for credentials, access cloud metadata, and deploy lateral movement tools. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet or an accessible internal network. The vulnerability is processed by

ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration 1. Basic Information Article Title : Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026) Source : JVN Publication Date : July 28, 2026 Original URL : https://jvn.jp/jp/JVN56870912/index.html Related Source : ELECOM Notice (Linked from JVN) Related Entities : CVE-2026-44387 (Reflected XSS) CVE-2026-59764 (Management Screen OS Command Injection) CVE-2026-61376 (Configuration Restoration OS Command Injection) WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B Severity : Medium 2. Executive Summary An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network. 3. Attack Flow Chain A: Attacker Already Has Administrator Credentials The attacker reaches the management screen. The attacker logs in as an administrator. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376. Arbitrary commands execute on the device OS. Inference : Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion. Chain B: Reflected XSS An attacker on the same or an adjacent network prepares a crafted URL. The attacker tricks a user who can access the management screen into opening the URL. A script executes in the management screen origin via CVE-2026-44387. Inference : If a management session exists, it may chain into unintended management actions. 4. Attacker Position and Execution Location XSS requires adjacent network reachability and user interact

vBulletin CVE-2026-61511: Unauthenticated RCE via Public AJAX Template to eval() 1. Basic Information Article Title : vBulletin fixes critical pre-auth RCE flaw with public exploit Publisher : BleepingComputer Publication Date : July 28, 2026 Original URL : https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/ Related Sources : NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61511 Researcher Technical Analysis: https://karmainsecurity.com/ SSD Secure Disclosure: https://ssd-disclosure.com/ Related Entities : CVE-2026-61511, vBulletin 5.x/6.x, vB5_Template_Runtime::runMaths() , ajax/render/pagenav , phpfuck Severity : High 2. Executive Summary Sending a crafted pagenav[pagenumber] to vBulletin's public AJAX template rendering bypasses the weak validation of the math function runMaths() using phpfuck. It reaches PHP's eval() without authentication to execute arbitrary code. A public PoC with a known fix exists, and scanning activity is expected to increase. 3. Attack Flow The attacker searches for public sites running vBulletin 5.x/6.x. They send a request to a public template rendering endpoint like ajax/render/pagenav . They insert a PHP expression into pagenav[pagenumber] to bypass math validation. Template execution reaches vB5_Template_Runtime::runMaths() . The input goes to PHP eval() , executing arbitrary PHP code. OS commands start under the PHP/web server user permissions. Inference : Leads to web shell installation, database credential theft, forum database exfiltration, defacement, and persistence. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet without authentication. The vulnerable processing happens inside the vBulletin template runtime. PHP code runs with Web/PHP-FPM/Apache user permissions. 5. Visibility for Victims and Administrators No user action or login is needed. Web access logs may show ajax/render/pagenav and an unusual pagenumber parameter

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking 1. Basic Information Article Title : Over 24,000 exposed server BMCs leak password hash via decades-old flaw Publisher : BleepingComputer Publication Date : July 28, 2026 Original Source : https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ Related Sources : Lava research (linked in original), CVE-2013-4786 Related Entities : CVE-2013-4786, IPMI 2.0, BMC, Supermicro, HPE iLO 4, UDP/623, GPU/AI servers Severity : High 2. Executive Summary Attackers can send an authentication request to exposed IPMI/BMC interfaces on the internet and receive a password-derived response. They can crack this response offline using GPUs to gain server management privileges that sit below the operating system. A recent scan found 24,650 devices leaking authentication material, with 2,340 using weak, dictionary-based administrator passwords. 3. Attack Flow Scan the internet for IPMI 2.0 services on UDP/623. Start an RMCP+/RAKP authentication handshake with the BMC. Obtain the password-derived authentication response without credentials. Perform offline cracking using dictionaries, default ADMIN users, and vendor-generated password rules. Log in to the BMC using the recovered password. Control power, virtual media, firmware, and low-level settings. Reuse the same credentials on other management interfaces. Inference : Use virtual media or boot settings to compromise the OS, establish persistence, and move laterally across the management network. 4. Attacker Position and Execution Location Attackers connect to UDP/623 from the internet or a reachable management network. Hash cracking happens on the attacker's GPU/CPU, avoiding failed login alerts on the target system. Post-compromise actions run on the BMC processor, which is independent of the OS. 5. Visibility for Victims and Administrators The OS, EDR, and host logs may not show

It feels bad enough when an open letter signed by leading economists warns that AI might steal your job. The fact it may soon be better than you at making dinner? Insult to injury. But that’s exactly what the company 1X promised when it showed off a pair of new, impressively dexterous (and, to some,…

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test.