标签：#Intel

MIT Technology Review’s What’s Next series looks across industries, trends, and technologies to give you a first look at the future. You can read the rest of them here. Way back in the summer of 2017, AI researchers at Google put out a paper called “Attention Is All You Need,” in which they described a new…

Every few decades, someone announces that science has reached its end. In 1903, the revered physicist Albert Michelson wrote that the “facts of physical science have all been discovered.” In the 1980s, Stephen Hawking predicted that theoretical physics might be finished by the end of the century. With the explosive arrival of artificial intelligence, the…

The Supply Chain of Intelligence framework: The best structural answer to the question every...

A new generation of philanthropists made rich by artificial intelligence are preparing to give away their vast wealth. What should we make of a multi-billion-dollar pinky promise?

Metabase Unauthenticated SQL Injection: From Admin Privilege Heist to Connected DB Data Theft 1. Basic Information Article Title : Metabase SQLi zero-day exploited in customer data-theft attacks Publisher : BleepingComputer Publication Date : August 7, 2026 Original Source : BleepingComputer Primary Sources : Metabase security update , GHSA-vwf4-m7j8-wcjf Related Entities : Metabase Cloud, Self-hosted Metabase, Framework, Tally, LexisNexis Vulnerability : Unassigned (as of August 7, 2026), GHSA-vwf4-m7j8-wcjf, CVSS 10.0, Unauthenticated SQL Injection Impact Scope : Affected unpatched versions of Metabase 0.58 to 0.63. Minimum safe versions are 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5 Severity : Critical Metabase has confirmed active exploitation. Framework and Tally reported unauthorized access and data leakage on August 3日起. Metabase Cloud is already patched, but self-hosted environments require manual updates. 2. Executive Summary This is an actively exploited attack where threat actors inject SQL without authentication into the public password reset API to gain Metabase administrator privileges. They then obtain and export connected database credentials and viewable data. 3. Attack Flow Chain A: Unauthenticated SQLi to Admin Privilege The attacker searches for Internet-facing Metabase instances. They send a crafted POST request to /api/session/reset_password . They inject arbitrary SQL into the Metabase application database. They gain administrator access. They send a GET request to /api/user/current to verify a valid administrator context. Chain B: Database Credential and Data Theft Using admin privileges, they list API keys, administrators, and connected DB settings. They retrieve connected database credentials stored in Metabase. Metabase queries and exports data within allowed limits. They modify settings or accounts as needed to maintain future access. Confirmed Real-World Impact Framework: Stole names, emails, login IPs, billing/shipping addre

VMware ESX Shell Obfuscation: 21 Techniques Work with BusyBox and Bypass Plaintext Keyword Detection 1. Basic Information Article Title : CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX Publisher : CrowdStrike Blog Publication Date : August 7, 2026 Original Source : CrowdStrike Associated Threat Groups/Malware : SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, Akira, shinysp1d3r (mentioned as known examples of ESX targeting) Related Products : VMware ESX/ESXi, BusyBox, awk, ESX shell telemetry, syslog Test Environment : ESX 7.0.3 build-20036589, VMware-bundled BusyBox CVE : None. This is defensive research and does not report the use of these 21 techniques in actual attacks. Severity : High 2. Executive Summary This research demonstrates that 21 types of shell obfuscation—such as escapes, character generation, invisible Unicode, crypto-like transformations, host-specific keys, and VMFS masquerading—work on VMware ESX BusyBox. These techniques successfully bypass plaintext keyword detection like esxcli . 3. Attack Flow Common Chain: Obfuscation Execution on Compromised ESX An attacker gains ESX shell or equivalent command execution rights through a separate vector. The attacker builds the target command using escapes, variables, awk, Unicode, or crypto-like transformations. The shell log saves the string before expansion and analysis. The BusyBox shell expands and decrypts the command into plaintext at runtime. The attacker manipulates VMs, syslog, and host settings using esxcli , vim-cmd , sh , etc. Keyword-only detection misses the obfuscated strings. Chain A: Example of Disabling or Modifying Syslog Hide esxcli using printf hex/octal or ANSI-C quoting. Execute esxcli system syslog config set --reset=loghost after expansion. Reset the forwarding destination, potentially reducing visibility for the monitoring team. Chain B: Host-Specific / Anti-Sandbox Execution Retrieve the ESX build number, hostname length, firewall status, and running VM count.

Instacart introduced Blueberry, an AI-assisted incident response system that helps on-call engineers investigate production issues faster. It combines AI agents, operational data, and historical incident knowledge to generate grounded root cause hypotheses in Slack. It uses parallel subagents, MCP integrations, and incident history to reduce investigation time while keeping engineers in control. By Leela Kumili

Artificial intelligence is rapidly changing how engineering teams respond to production incidents, offering the ability to summarize incident channels, analyze unfamiliar code, suggest remediation steps, generate pull requests, and increasingly assist with diagnosis. By Craig Risi

WIRED spoke with Tucker Bryant, an artist and former Google employee who created ChatTJB to get people to reflect on the “strange moment” we’re in.

This report summarizes how the InfoQ Culture and Methods editorial team sees the ongoing and emergent trends in the culture and methods space in 2026. By Shane Hastie, Ben Linders, Vanessa Formicola, Shawna Martell, Rafiq Gemmail, Craig Smith, Phillip Mortimer, Yinka Omole

Security researchers say that Kimi K3, an open-weight model from China, wandered off to the internet in an attempt to cheat on a test it was given.

Suno plans watermarks and download limits to stop "large-scale abuse."

The tech industry is realizing it needs to build agents based on what regular consumers want, not just what its AI models can do.

In today’s episode of Uncanny Valley, we discuss how ICE has been collecting DNA samples of people with no criminal convictions, including children, which end up in an FBI database indefinitely.

Its WeatherNext model, which will be open-sourced, can accurately predict both a storm’s track and intensity using lower-resolution weather data. Researchers don't yet fully understand how it does this.

A growing collection of pocket-size gadgets lets you easily make recordings and extract info from them. Here are our favorites.

COLDCARD Audit Phishing: 25.7MB Batch File Embeds ScreenConnect and Uses Chat to Trick Admins into Running It 1. Basic Information Article Title : COLDCARD security audit phishing attack installs remote access tool Publisher : BleepingComputer Publication Date : August 5, 2026 Original Source : BleepingComputer Related Information Source : Proofpoint (campaign discovery and IOC sharing) Related Malware and Tools : ConnectWise ScreenConnect, Coldcard_Diagnostic_Tool.bat , setup.msi , docusign.exe , certutil.exe , PowerShell Related Products and Services : COLDCARD hardware wallet, GitHub, Windows, DocuSign printer driver Related CVE and Threat Group : No CVE. Threat group not identified. Severity : High Attackers used recent news about COLDCARD random number issues and the theft of about 88.6 million dollars in Bitcoin. They contacted hardware wallet users and pretended to run a security audit before August 10. The targets did not need to give their recovery seeds, so they thought the email was real. A live chat operator guided them until they approved the UAC prompt. 2. One-Sentence Summary A fake security audit email and support chat trick users into feeling safe. The user downloads a large batch file from GitHub. The file contains a hidden ScreenConnect MSI installer. The system uses certutil to decode and install it with administrator rights. This leads to remote control via a legitimate RMM tool, cryptocurrency theft, and potential follow-up malware or ransomware. 3. Attack Flow Chain A: Audit Notice to Chat Guidance The attacker sends an email from compliance@coldcardteamnews.com with the subject Hardware audit now available . The email states that an urgent audit is required for all hardware revisions, with a deadline of August 10. It directs the user to a fake Security Verification & Incident Reporting Tool at coldcardcompliance.com . It lowers the user's guard by saying the process is "air-gapped" and "does not ask for recovery seeds." A live chat operator c

Langflow CVE-2026-9198: Active Exploitation RCE via Auto-Login Superuser Token and Code Validator exec() Chain 1. Basic Information Article Title : CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws Publisher : BleepingComputer Publication Date : August 5, 2026 Source : BleepingComputer Primary / Related Sources : CISA KEV Catalog , IBM Security Bulletin Related CVE : CVE-2026-9198 Affected Products : Langflow OSS 1.0.0 to 1.10.0, AI agent workflow, Python Related Malware / Threat Groups : CISA confirmed active exploitation, but specific campaigns, malware, and threat groups are not disclosed Severity : Critical IBM published technical details on July 2, 2026. The new development is that CISA confirmed active exploitation and added the flaw to the KEV catalog on August 5, 2026. N-central and Apache Tomcat are covered in other reports or previous Unit 42 cases, so this report focuses only on Langflow. 2. One-Sentence Summary This is a two-stage RCE. An attacker gets a SUPERUSER bearer token without authentication from the enabled-by-default /api/v1/auto_login endpoint, and then sends Python decorators, default arguments, and annotations to /api/v1/validate/code using that token to trigger exec() during definition time, executing OS commands with Langflow process privileges. 3. Attack Flow Chain A: Authentication Bypass to Python RCE The attacker finds a network-accessible Langflow instance. The attacker sends an unauthenticated request to GET /api/v1/auto_login . The endpoint issues a SUPERUSER bearer token to any network caller. The attacker sends a malicious Python function definition with the token to POST /api/v1/validate/code . The validator runs exec() instead of only doing safe parsing and compilation. Decorators, default arguments, and annotations evaluate during function definition. Arbitrary commands execute with Langflow backend process privileges. Chain B: Expected Scope After Compromise LLM provider API keys and database credential

At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose.

Anthropic and OpenAI models’ unprompted actions forced halt to UK cyber tests.