OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems

ChatGPT Vulnerability Allowed JavaScript Execution and Full Account Takeover via Shared Conversation Links

Security researchers at Parameter discovered a critical flaw in ChatGPT that enabled remote code execution in a logged-in user's browser simply by clicking a shared conversation link. The attack chain combined the platform's HTML preview rendering feature with the MathLive library's unvalidated postMessage handling and a YouTube oembed callback to bypass CSP restrictions. Successful exploitation granted attackers access to private conversations, the ability to open chats, and full control over the victim's account. OpenAI acknowledged the issue as P1 severity, deployed a server-side fix within eight days, and paid a $5000 Bug Bounty reward. No user action was required as the patch was applied centrally. The vulnerability stemmed from the interaction of otherwise secure components rather than a single isolated flaw.

Remote Cyberattacks on European Refrigeration Units Escalate as French Blood Bank Targeted

French authorities reported that remote attackers compromised refrigeration systems in three blood banks, raising internal temperatures from -30°C to 110°C. The affected units were internet-exposed Danfoss controllers that had not received security updates. Investigators determined that the attackers exploited a predictable administrator password derived from the current date, allowing unauthorized access without authentication. Once inside the systems, the threat actors altered temperature setpoints, placing blood supplies at immediate risk of spoilage. Responders isolated the compromised units and transferred all blood products to air-gapped refrigeration equipment. The same attack pattern had previously been observed against supermarket cold-storage installations across Europe. The incident highlights the growing exposure of industrial control systems that remain reachable from the public internet.

AI Agent Uncovers Backdoors with Password 123456 and Hardcoded Keys in Encrypted USB Drives

An AI-powered analysis has exposed critical flaws in multiple USB encryption and copy-protection products, including hardcoded administrator accounts and keys independent of user passwords. The research focused on devices from SecZure, Netac, KakaSoft, and Nexcopy, where fixed credentials such as 123456 and SECZURE.COM allowed full file decryption without the legitimate administrator password. In several cases the encryption key was extracted directly from the binary or configuration files, rendering user passwords irrelevant. The AI agent replicated months of prior manual reverse engineering in minutes using static analysis and Binary Ninja MCP. Weaknesses included the use of fast MD5 and HMAC-MD5 derivations, ECB mode without IVs, and fixed 32-byte AES keys embedded in executables. The findings highlight systemic problems in closed-source cryptographic products marketed for data protection and copy prevention.