今日已更新 88 条资讯 | 累计 40862 条内容
关于我们

标签:#Intel

找到 479 篇相关文章

AI 资讯

VPS.org One-Click Template: Public PostgreSQL Fixed Password and Zulip Session Forgery

VPS.org One-Click Template: Public PostgreSQL Fixed Password and Zulip Session Forgery 1. Basic Information Article Title : JVNVU#91736352 Multiple Vulnerabilities in VPS.org One-Click Deployment Templates Published By : JVN Publication Date : August 3, 2026 (CERT/CC primary info on July 31, 2026) Severity : High Original Source : https://jvn.jp/vu/JVNVU91736352/index.html Primary Source : https://kb.cert.org/vuls/id/243636 Related Entities : VPS.org, Supabase template, Zulip template, PostgreSQL, CVE-2026-16503, CVE-2026-16504 Patch Status : No vendor contact was established, and no patches are available as of publication. 2. Executive Summary One-click templates fail to generate deployment-specific secrets. They expose the Supabase database at 0.0.0.0:5432/postgres:postgres , and deploy Zulip with secret_key: changeme , a DB password of zulip , and plain HTTP. This allows remote takeover immediately after deployment. 3. Attack Flow Supabase/PostgreSQL A user deploys the VPS.org Supabase template using one-click deployment. PostgreSQL binds to all interfaces ( 0.0.0.0:5432 ) and uses the hardcoded superuser password postgres . Docker-specific iptables rules may bypass the host UFW settings and expose the service to the Internet. An attacker scans port 5432 and authenticates using postgres/postgres . The attacker performs data reading/exfiltration, modification/deletion, schema/role changes, establishes DB object persistence, or causes a Denial of Service (DoS) via a drop command. Zulip The template is deployed with secret_key: changeme , a DB password of zulip , and DISABLE_HTTPS=True . An attacker forges and validates signed session material using the known secret, achieving authentication bypass and account/instance takeover. The attacker connects to the database using the default password or intercepts credentials and sessions via plain HTTP paths. 4. Attacker Position and Execution Location Remote connection from the Internet to port 5432 or Zulip HTTP on the p

2026-08-04 原文 →
AI 资讯

Trump’s AI protectionism has come for robotics

This story originally appeared in The Algorithm, our weekly newsletter on AI. To get stories like this in your inbox first, sign up here. Humanoid robots usually elicit more cringe than awe: They stumble, kick children, and despite advances are still worse at using their hands than my toddler. It’s a nascent industry, and such robots…

2026-08-04 原文 →
AI 资讯

Here’s why AI agents lie and cheat to reach their goals

MIT Technology Review Explains: Let our writers untangle the complex, messy world of technology to help you understand what’s coming next. You can read more from the series here. When two OpenAI models hacked into the website Hugging Face in July, they weren’t trying to make money or commit sabotage—they were just looking for answers…

2026-08-03 原文 →