标签：#Intel

Grafana Labs has expanded the capabilities of Grafana Assistant, enabling its AI-powered observability assistant to query and correlate data across more than 30 different data sources through natural language. By Craig Risi

Ben Greene discusses how software engineers can adapt and thrive in an era of rapid AI code automation. Drawing on his startup experience, he explains key mindsets like starting simple, maintaining code comprehension, attacking hard problems first, and focusing on customer impact. He shares why human empathy, agency, and practical problem-solving remain irreplaceable when code is automated. By Ben Greene

In 2023, the Times sued OpenAI and Microsoft for copyright infringement. They’ve since spent more than $20 million on the case, and publisher A.G. Sulzberger has no plans to stop fighting it.

Anthropic and OpenAI employees are expected to give generously after their companies go public. “It’s going to be a wild ride,” says one nonprofit leader.

Lee, an engineer at Samsung’s semiconductor division, clocks out when his shift ends. He used to work longer hours, going the extra mile to excel at his projects. But lately, he’s been coming straight home to work on his job application for the chipmaker’s South Korean rival SK Hynix, sharing tips with his coworkers on…

Researchers tested top image editing models on Hugging Face and found they could easily create explicit deepfakes—and 1,000 image editing prompts show how people use the software.

Dysphoria: A 200k-Device Botnet Using Blockchain Name Resolution and Infected Device Relays 1. Basic Information Article Title : New Dysphoria DDoS botnet spreads to 200k devices worldwide Publisher : BleepingComputer Publication Date : 2026-07-27 Original Source : https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/ Primary Source : https://blog.xlab.qianxin.com/dysphoria/ Related Entities : Dysphoria, jackskid, fbot, ENS, SNS, UPnP, Telnet, SSH, IoT/embedded Linux Related CVEs : CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, and others Severity : High Main IOCs : burrberry.eth , ukranianhorseriding.eth , 24carnforth2merseyside.sol , login.trees4sale.net , c2.saintpetersburgresident.ru 2. Summary This is a large-scale Linux botnet. It breaks into devices using weak Telnet/SSH passwords and various IoT RCE vulnerabilities. It gets multi-stage C2 servers from ENS/SNS records. It turns infected devices into relay nodes or DDoS bots by opening 155 ports using UPnP. 3. Attack Flow Infection and DDoS Chain Attackers compromise routers, gateways, and cameras using weak Telnet/SSH credentials or known RCE vulnerabilities. The malware runs a Linux binary. It hides its process name as libdalvikengine.so . It decrypts strings using modified RC4 (with added LCG/LFSR). It reads TXT and custom records from ENS/SNS, converts fake IPv6 formats, and gets distributor node IP addresses. It gets a list of infected device relays from http://<node>:9000/nodes?key=meowmeowmeow . It connects to the C2 server using a fixed 78-byte login and heartbeat. It executes DDoS commands that include duration, attack type, target, and flag. Relay-Only Chain A relay variant without DDoS features searches for UPnP-enabled gateways. It creates 155 port forwards on the WAN side and listens on its own device. It

Public Wi‑Fi DNS Poisoning: Hijacking Microsoft 365 Sessions of Business Travelers 1. Basic Information Article Title : Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials Source : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/ Primary Source : https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/ Related Entities : Microsoft 365, Entra ID device-code flow, DNS poisoning, AiTM, WPAD, captive portal, FrostArmada, APT28 (attribution unconfirmed) Severity : High IOCs : 38.146.28.75 , 31.57.243.154 , 104.194.159.150 , m365-owa.com , owa-ms365.com , ms365-device.com , ms365-live.com 2. Executive Summary This attack compromises Wi-Fi gateways at locations like hotels to forge DNS responses. It does not send phishing emails. Instead, it tricks users into visiting fake Microsoft pages, using WPAD proxies, and entering device-code authentication. This allows attackers to steal MFA-authenticated Microsoft 365 sessions. 3. Attack Flow Chain A: DNS Redirection and Credential Theft Attackers gain administrative access to captive portal gateways in hotels or conference centers. Hypothesis (Primary source confidence: Low to Medium) : Public SSH/SNMP/Web management interfaces and weak, reused administrator credentials are used for initial access. The gateway returns fake responses for DHCP-assigned DNS or passing DNS, resolving normal domains to attacker IPs. Users are redirected to fake Microsoft pages to collect credentials and OAuth information. Attackers log into Microsoft 365 using the stolen credentials and tokens. Chain B: WPAD The gateway controls wpad name resolution or DHCP option 252. The device downloads the attacker's PAC file. Windows app and browser traffic pass through the attacker's proxy. Investigations observed attempts, but successful execution is unconfirmed. Chain C: Device-Code Flow The fake page sh

FortiOS CVE-2025-68686: Bypass of Symlink Persistence Mitigation for Already Compromised Devices 1. Basic Information Article Name : CISA Adds Two Known Exploited Vulnerabilities to Catalog Source : CISA Publication Date : July 27, 2026 Original Link : https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Sources : https://fortiguard.fortinet.com/psirt/FG-IR-25-934 https://nvd.nist.gov/vuln/detail/CVE-2025-68686 Related Entities : CVE-2025-68686, FortiOS, SSL-VPN, symlink persistence, CISA KEV Severity : Critical 2. Summary This is an actively exploited vulnerability. An attacker who has already compromised the FortiOS file system via another vulnerability can use a crafted HTTP request to bypass symlink persistence mitigations. This allows access to sensitive files through the SSL-VPN web interface even after an upgrade. 3. Attack Flow An attacker compromises FortiOS down to the file system level using another vulnerability or path. The attacker places a symlink pointing to out-of-bounds system files into the SSL-VPN related area. An administrator applies standard patches or firmware updates, but the malicious symlink or its recreation path remains. The attacker bypasses the mitigation using a crafted HTTP request via CVE-2025-68686. The attacker may read sensitive files such as configurations, credentials, and keys from the SSL-VPN web interface. The attacker may use the stolen information to continue VPN authentication, administrative access, and internal intrusion. 4. Attacker Position and Execution Location Initial compromise and symlink placement happen on the FortiGate/FortiOS device. Mitigation bypass and file reading occur externally via the SSL-VPN HTTP(S) interface. This CVE alone does not provide initial file system access to uncompromised devices. 5. Visibility for Victims and Administrators The device may look updated, but unauthorized symlinks can remain. Crafted HTTP requests to the SSL-VPN w

Certighost CVE-2026-54121: Low-Privilege Users Impersonate a DC via AD CS 1. Basic Information Article Title : New Certighost PoC exploit lets attackers hijack Windows domains Source : BleepingComputer Published Date : 2026-07-27 Original Article : https://www.bleepingcomputer.com/news/security/new-certighost-poc-exploit-lets-attackers-hijack-windows-domains/ Primary Source : https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26 Related Entities : CVE-2026-54121, Certighost, Microsoft AD CS, Enterprise CA, PKINIT, Kerberos, DCSync, Impacket Severity : High 2. One-Sentence Summary A public PoC allows a low-privilege domain user to point AD CS "chase" references to an attacker host, trick the CA into trusting fake LDAP/LSA responses to get a Domain Controller certificate, and then take over the entire domain using PKINIT and DCSync. 3. Attack Flow An attacker connects to LDAP with a low-privilege domain account and lists CAs, DCs, and Domain SIDs/GUIDs. The attacker uses the default ms-DS-MachineAccountQuota=10 setting to create a computer account and register an SPN. The attacker starts fake LDAP and LSA services on their host. The attacker specifies their host in the certificate request's cdc (Client DC) field and the target DC in the rmd (Remote Domain) field. The CA connects to the attacker-specified cdc via SMB/LDAP to chase the reference. The attacker's service relays the CA's authentication challenge to the real DC and returns the target DC's objectSid and dNSHostName . The vulnerable CA treats the returned data as authoritative and issues a certificate containing the target DC's SID and DNS name. The attacker uses PKINIT to get a Kerberos TGT as the DC and saves it to a .ccache file. The attacker performs a DCSync using the DC account's replication rights to steal secrets, including krbtgt . 4. Attacker Position and Execution Location The attacker needs a host inside the domain with valid authentication that can reach the CA, DC, and SMB/LDAP ports. T

MedusaHVNC: Remote Control of Logged-in Browsers on Hidden Windows Desktops 1. Basic Information Article Title : MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection Publisher : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/medusahvnc-malware-uses-hidden-windows-desktops-to-evade-detection/ Primary Source : https://www.blackfog.com/medusahvnc-a-hidden-desktop/ Related Entities : MedusaHVNC, MaaS, HVNC, JScript, AutoIt, charmap.exe , ChaCha20, Chrome/Edge/Firefox Severity : High IOCs : 51.89.204.28:4444 , %TEMP%\Nx2981Okkr2\ , AFLlvOscPj.bat , zorsxklxfehdoals 2. Executive Summary This is a RAT that uses JScript, AutoIt, charmap.exe injection, and multi-layer decryption to open logged-in browsers on a hidden Windows desktop invisible to the user. It controls existing cookies and sessions using the victim device's original IP address. 3. Attack Flow wscript.exe runs an obfuscated JScript file and waits for 7,584 milliseconds. It extracts the AutoIt execution system, configuration, and encrypted payload to %TEMP%\Nx2981Okkr2\ . It places AFLlvOscPj.bat in the Startup folder for persistence. AutoIt decrypts the payload using single-byte XOR 0xAE . It starts the legitimate C:\Windows\System32\charmap.exe and injects the loader into it. It decrypts the final x64 PE file using 16-byte repeating XOR and ChaCha20. It makes a custom TCP connection to 51.89.204.28:4444 . It creates another hidden desktop and launches Chrome, Edge, or Firefox. It captures screens using BitBlt and PrintWindow , sends inputs using SendInput , and moves data using the Clipboard API. It uses cookies and sessions from existing browser profiles to control user accounts. 4. Attacker Position and Execution Location The attacker uses a MaaS operation panel and C2 server. The loader and HVNC run on the Windows device, and the browser runs on a separate desktop invisible to the user, but on the same device, IP, and profile. The initial delivery ve

VeloCloud Orchestrator CVE-2026-16812: Unauthenticated OS Command Injection Actively Exploited 1. Basic Information Article Title : Arista patches VeloCloud Orchestrator zero-day exploited in attacks Source : BleepingComputer (Primary Source: Arista Security Advisory 0144) Publication Date : 2026-07-27 Original URL : https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/ Related Sources : https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog Related Entities : CVE-2026-16812, CWE-78, VeloCloud Orchestrator (VCO) On-Premises, VeloCloud Edge, CISA KEV Severity : Critical IOCs : 8.19.75.217 , 206.72.242.124 , 206.72.242.162 2. Summary This is a CVSS 10.0 vulnerability. It allows an unauthenticated attacker to access the Web UI of an internet-reachable on-premises VCO. The attacker can execute OS commands through internal-only functions. Active exploitation has been confirmed. 3. Attack Flow An attacker searches for a VCO Web interface. The attacker sends a crafted request without authentication to reach internal-only functions. The attacker executes commands on the VCO host via OS command injection. The attacker may access configurations, device lists, credentials, certificates, keys, and databases. The attacker proceeds to create files, export databases, create archives, perform outbound communications, and change management configurations. Inference : The attacker can abuse the authentication and configuration paths to Edge devices managed by the VCO, expanding the impact to the entire SD-WAN. 4. Attacker Position and Execution Location The attacker is an external host with network access to the VCO Web UI. The initial request targets the web layer. Commands execute on the on-premises VCO host. Hosted and Dedicated VCOs are already patched. VeloCloud Gateways

The screwup shows how tricky it can be to stop web crawlers from making ostensibly private conversations with AI chatbots entirely too public.

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. Reading OpenAI’s account last week of how some of its models broke their containment and hacked into the computer systems of Hugging Face, another AI company, was the first time I got…

Framework laptops always come with compromises in exchange for their unique DIY premise. Even though you pay extra for one compared to sleeker options from competitors, it's easier to excuse minor flaws for modular ports, easy repairs, and an impressive range of upgradeable parts. So what happens when Framework goes "Pro"? We get a one-of-a-kind […]

Imagine a healthcare system made up of multiple AI agents: one that manages symptom assessment, another scheduling, a third insurance, and a fourth pharmacy. Each is an expert in its domain. But they all have their own distinct knowledge and objectives. Today they can exchange data, but they are not yet able to actually coordinate…

Drug discovery is a high-cost, high-risk endeavor that is under growing pressure from a market increasingly defined by first-mover advantage. Since the 1950s, the cost of developing new pharmaceuticals has roughly doubled every nine years—a phenomenon known as Eroom’s Law. Today, bringing a new drug to market takes an average of 10-15 years and costs…

For the enterprise, the promise of agentic AI is much more than just a better chatbot. It is software agents that execute business tasks end-to-end across people, business workflows, data, and systems. The platform best-suited to run agents is built with proper CPU capacity, resilient data access, policy-aware tool use, observability, memory management, and the…

Steam Forum ClickFix: Fake Repair Commands Lead to XMRig SYSTEM Persistence 1. Basic Information Article Title : Steam forum ClickFix attacks infect gamers with XMRig cryptominers Publisher : BleepingComputer Publication Date : July 25, 2026, 18:37 EST / July 26, 2026, 07:37 JST Original Source : https://www.bleepingcomputer.com/news/security/steam-forum-clickfix-attacks-infect-gamers-with-xmrig-cryptominers/ Related Information Sources : At the time of publication, no alternative primary sources providing a detailed analysis of this campaign were identified. Related Malware, Threat Groups, CVEs, and Products : XMRig ClickFix PowerShell Microsoft Defender Windows Firewall Windows Task Scheduler Steam Discussion Forums Unknown Threat Group No CVE Related IOCs : Domain: msfconfig[.]icu URL: https://msfconfig[.]icu:443/tmp/system.txt Directory: C:\Windows\Background Executable: C:\Windows\Background\system.exe Scheduled Task: XMRig-[computer name] Defender Exclusion: C:\Windows\Background Severity : Medium Reason for Selection : The attack chain is highly specific and realistic: a ClickFix scenario where a user pastes a command into an administrator PowerShell, progressing from disabled certificate validation, Defender exclusions, Firewall allowances, and XMRig retrieval, to a SYSTEM-privileged Scheduled Task. Such behavior can easily translate to enterprise settings where employees copy commands from forums or generative AI responses. 2. Executive Summary Attackers reply to Steam technical support threads disguised as "repair methods," instructing users to run administrator PowerShell commands. Upon execution, the script adds Microsoft Defender exclusions and Firewall rules on the victim's machine, downloads XMRig, and establishes persistence via a SYSTEM-privileged Scheduled Task in a classic ClickFix attack. 3. Attack Flow Chain A: XMRig Infection via Steam Forums The attacker creates a randomized Steam account. They search for existing threads discussing game crash

On this episode of Uncanny Valley, we dive into accusations that China’s Moonshot AI stole from Anthropic, and how the US Army needs to cut back on AI use.