与「security」相关的搜索结果

⚠️ Cursor has published a security incident report on the earlier supply chain attack. According to the investigation, the attacker used access keys issued by Cursor to Fireworks and subsequently exposed on Fireworks’ side to gain access to some of Cursor’s SaaS services and internal systems. The attacker ultimately tampered with the distribution cache for the Claude Code extension to collect information about users’ machines and install SSH backdoors. The compromised versions were Anthropic.claude-code 2.1.312 and 2.1.313 in Cursor’s VS Code extension marketplace distribution cache, affecting macOS and Windows. The exposure window ran from October 29 at 17:27 to October 30 at 04:35 (UTC+8), with up to approximately 5,000 users affected. Security recommendation: If you installed or updated to either affected version through Cursor’s marketplace during this window, read the official notice as soon as possible and run the remediation script for your platform to check for and remediate any compromise: Fireworks’ initial announcement and subsequent update:

I think the best case is to make the "monitor" as un-agentic as possible. We don't mind being "monitored" by various random tiny insects we don't even notice, even guard dogs are fine, but we really do mind if it's a globally connected networked system. And the intermediate case, human security guards with no recording equipment, we mind only a medium amount. The best idea I've come up with so far is to make these monitoring devices out of open-source verifiable hardware that has etched on it an open-weight LLM that classifies for a limited number of activities (basically, just violence; sorry, no scanning for jaywalking or not wearing a mask or drugs or unauthorized manufacturing or illegal immigrants, really just violence) and only records and forwards if that's what it sees. The device has no storage, no ability to load new algorithms, this is all it does. Also, a hash of every recording is published onchain (and a device can't record the next one until it sees confirmation of the previous one) so we can all count how much recording is done. Finally, everyone has a legal right to take any such device they see and grab it and dissassemble and verify the hardware themselves. Explicitly fund university clubs, hacker groups, etc to regularly do this.

🇺🇸🇨🇳 Rubio reportedly set Jensen Huang's downfall in motion... with a memo that hit harder than the CIA report it was based on The Washington Post reports the Secretary of State took a CIA report on Jensen's relationship with a suspected Chinese spy and rewrote it in his own, more forceful terms, according to one person familiar with it. When that memo's findings leaked, the scandal began. A former official who worked on chip policy described what Trump's national security team was after: "They wanted to destroy the influence Jensen had over the president." Trump still calls him a "legend." The agencies still can't prove she was a spy. But three bills restricting chip sales to China are now headed for the defense bill, and the one executive who used to talk Congress out of them is gone. So ask yourself who came out ahead this week, and you have a good idea why that memo found its way to reporters. Source: Washington Post / Writer: Daniel

is worth checking out for recon and external attack surface management. It doesn't just list subdomains. It verifies them and grabs screenshots. It checks for takeover risks and flags open ports. All in one scan. The free tier gives you 2 domains/day with no account needed. It runs entirely in the browser. No setup. No agents. Visit: #SubdomainFinder# #AttackSurfaceManagement# #CyberSecurity# #Recon# #BugBounty# #OSINT# #InfoSec# #SubdomainTakeover# #SecurityTools# #Pentesting#

U.S. NATIONAL SECURITY IS DAMAGED WHEN CHINA GETS ADVANCED AI CHIPS Doesn’t matter if that happens because the person is a spy, a useful idiot or just a tech businesswoman having an affair with Jensen Huang. Alice Huang used Jensen to get advanced AI chips to China. Get it?

@GeminiApp We built these tools with security and privacy at the center. If you choose to connect your Wallet, Gemini can only read your accounts; it can’t move, manage, or invest your money. Learn more.