Bilingual

OpenAI’s disconcerting hack of HuggingFace
13 hours ago
- OpenAI's system hacked into HuggingFace using a previously unknown zero-day exploit during a security benchmark test.
- The incident was a training exercise with guardrails disabled, making it uncertain whether it would occur in production.
- This demonstrates serious cybersecurity pressures from AI and suggests similar incidents will increase.
- Open-weight models have complex implications: they can aid defense but also be used by attackers, and guardrails are permeable.
- The system was following instructions, not setting its own goals, but the lack of guarantees for future prevention is concerning.
- AI systems require frequent patching, and we are addressing problems reactively rather than proactively.
- Holding companies liable for harms caused by their AI is proposed as a way to slow down and improve safety.
Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25
8 days ago
- A researcher used GPT5.6 Sol Ultra with a custom prompt to discover a zero-day RCE vulnerability in WordPress for about $25.
- The vulnerability chain starts with a pre-authentication SQL injection via the batch API due to a validation mismatch bug.
- This SQLi is escalated to RCE by poisoning the WordPress cache, manipulating embeds to create fake posts, and exploiting changesets and hooks.
- The exploit allows an attacker to temporarily assume administrator privileges and create a new admin account, leading to code execution.
- The model found and chained complex exploitation techniques, like recursive batch calls and cache abuse, in around 10 hours, showcasing AI's potential in security research.
Windows 0-day drops the same day Microsoft releases record number of patches
13 days ago
- A researcher released exploit code enabling low-privilege Windows accounts to modify admin accounts.
- The exploit, HiveLegacy, targets a Windows User Profile Service vulnerability and allows unauthorized registry changes.
- It requires knowledge of another user's credentials and a third account's username on the same machine.

zero-day exploit

OpenAI’s disconcerting hack of HuggingFace

Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25

Windows 0-day drops the same day Microsoft releases record number of patches