Search results for New Level

MAÑANA sale uno de los lanzamientos más esperados para PS5: The Blood of Dawnwalker 🩸⚔️Un RPG de acción en mundo abierto creado por ex-desarrolladores de The Witcher 3. 🌖 Humano de día, vampiro de noche. ⏳ Tienes 30 días para salvar a tu familia. ¿Lo vas a jugar? 👇 https://t.co/pKOE3Np0WZ

Exactly — the 100% score is almost the least interesting part. The deeper signal is that capability is starting to become an ACCESS-CONTROL PROBLEM. Astra was not evaluated as a generic chatbot. It was placed inside an environment with: TOOLS + CODE EXECUTION + BROWSER ACCESS + TARGET SYSTEMS + EXPLOIT DEVELOPMENT CAPABILITY + PERSISTENT MULTI-STEP REASONING. That changes the security question completely. We used to ask: “HOW CAPABLE IS THE MODEL?” Now we also need to ask: “WHAT CAPABILITY TIER WAS THE MODEL ALLOWED TO OPERATE UNDER?” Because the exact same underlying model can represent radically different risk depending on whether it gets: TEXT ONLY ↓ READ-ONLY TOOLS ↓ CODE EXECUTION ↓ NETWORK ACCESS ↓ REAL TARGETS ↓ CREDENTIALS ↓ AUTONOMOUS ACTION ↓ PERSISTENT EXECUTION. That is effectively a new form of: CAPABILITY-BASED ACCESS CONTROL. And this is where benchmark discussions become misleading. “100% on ExploitBench” sounds like a model-quality number. But operationally, what matters is the combination: MODEL CAPABILITY × TOOL AUTHORITY × ENVIRONMENT PRIVILEGE × AUTONOMY × TIME × TARGET ACCESS. A model with extreme cyber capability but no tools may be largely advisory. The same model with: shell access + browser control + network reachability + exploit tooling + persistent memory + permission to iterate autonomously becomes something fundamentally different. That means future AI security policy will probably look less like: MODEL A IS SAFE MODEL B IS DANGEROUS. And more like: MODEL + CAPABILITY TIER + AUTHORIZED TOOLS + TARGET CLASS + AUTONOMY LEVEL + EXECUTION BUDGET + HUMAN OVERSIGHT REQUIREMENT. ↓ ACCESS DECISION. In other words: the model may remain the same, while the SECURITY CLASSIFICATION changes according to the environment we allow it to inhabit. That is a major architectural shift. Because capability evaluations are increasingly becoming: POLICY INPUTS. A score can determine: which tools the model gets, which systems it may touch, which actions require approval, which networks it can reach, how long it may operate, and whether it can act autonomously at all. The sandbox tier therefore matters enormously. A cyber model demonstrating zero-day discovery inside an isolated research environment is one thing. The same capability with: PRODUCTION NETWORK ACCESS + REAL CREDENTIALS + AUTONOMOUS EXECUTION + NO HUMAN GATE is an entirely different security object. This is why the real control plane for frontier agents may not ultimately sit inside the model. It may sit around it. IDENTITY ↓ CAPABILITY CLASSIFICATION ↓ TOOL ENTITLEMENTS ↓ ENVIRONMENT ATTESTATION ↓ TARGET POLICY ↓ RUNTIME MONITORING ↓ HUMAN APPROVAL ↓ REVOCATION. And access should be continuously recalculated. Because if a model crosses a capability threshold during an update, the permissions that were acceptable yesterday may suddenly become unacceptable today. That is the part enterprises should be preparing for now. The future of AI security may not be: “Can we trust this model?” It may be: “Given what this model is currently capable of, WHAT AUTHORITY ARE WE WILLING TO DELEGATE TO IT?” That is a much harder question. And probably the right one.

I’m sure there are some real hardcore criminals seeing these PNLs/ portfolios (which they know are on people’s iPhone apps) and foaming at the mouth. There’s been horror stories in the past ofc, but the way it’s playing out, I don’t see how this bull market won’t have more horror stories than in the past. Social trading is dope- being doxxed is chill- but having generational wealth on your iPhone app and being public about it is beyond retarded/ dangerous/ naive. For some reason we’ve all lulled ourselves into a false sense of security about this, but just think about what most people are willing to do for even a fraction of this kind of money and then be smarter/ protect yourself. Imo we aren’t too far off from a wave of violent/ devestating robberies that teach CT the hard way that they cant keep 6-7 figs 2 clicks away on their hip. I imagine it becomes one of the themes of this cycle seeing as how we are experiencing a whole new level of adoption. Just be smart and don’t invite it into your life. Don’t be one of the cautionary tales. And also to the social trading app devs, there are absolutely preventative measures/ solutions - I don’t know what they are yet, and I’m sure it won’t be easy- but that should be a top priority imo.

Kincora Copper: Catalyst-Rich Stretch Ahead ⛏️ 🌊 Mike Fagan, Editor of Resource Stock Digest, highlights a busy period ahead for Kincora Copper as it advances its NSW copper-gold portfolio. 📋 Key catalysts: • Results from 9 completed Condobolin drill holes; • AngloGold Ashanti-funded drilling at Nevertire South; • Potential new asset-level partnerships; • US$5M remaining from the Mongolian divestment. Kincora’s hybrid prospect-generator model has attracted more than A$10M in partner-funded exploration since late 2024. Read the full analysis: 👉 https://t.co/S4clmtqb26 $KCC.V $BZDLF #Mining #Copper #Gold

🎙️ Whole Health Weekly Ep. 82: The Menopause Strength Shift w/ Sheila Wood, Betty's Box BC - Tonight at 8:30 This week on Whole Health Weekly, Dr. Jeromy sits down with Sheila Wood, founder of Betty's Box BC — a Battle Creek gym built specifically for women navigating strength, mobility, and hormonal change at every stage of life. Sheila is a retired educator turned CrossFit Level 1 Trainer, endurance athlete, and HYROX racer who built Betty's Box around a simple mission: helping women who feel intimidated by traditional gyms discover that strength training is accessible at any age — especially through the peri-menopause and post-menopause years, when the old playbook stops working. In this conversation, we dig into: ✅ Why strategies that worked in your 20s and 30s stop producing results as hormones shift ✅ How strength training protects bone density, muscle mass, and long-term independence ✅ Building a gym community where women feel welcomed, not intimidated ✅ Sheila's own journey into coaching — and what "training like a Betty" really means Whether you're just getting started or looking for a smarter way to train through midlife and beyond, this episode is packed with encouragement and practical takeaways. 🎧 Listen & Subscribe: 📺 YouTube → https://t.co/ttAxZj00oO 📡 Rumble → https://t.co/kkLAluhrm8 📩 Substack → https://t.co/vEr6Yzm1kV 🐦 Follow on X → https://t.co/4wY5IKWkhA Spotify - https://t.co/5NrcOWSXX2... New episodes dropping regularly — follow so you never miss one. https://t.co/aUExslB3Wq https://t.co/Y97GR0zo0d

🚨 [ACTIVE EXPLOITATION] — ATTACKERS ARE USING A CRITICAL JFROG ARTIFACTORY AUTHENTICATION BYPASS TO CREATE THEIR OWN ADMIN TOKENS No valid account is required under affected default configurations. And the target sits directly inside the software supply chain. CyberSignal Priority: 🔴 VERY HIGH 📅 September 2, 2026 🆔 CVE-2026-82329 ⚠️ CVSS: 9.8 CRITICAL 🏢 JFrog Artifactory 🏷️ Active Exploitation · Authentication Bypass · CI/CD · Software Supply Chain A vulnerability in a normal web application is dangerous. A vulnerability providing administrative access to the system storing: packages containers binaries build artifacts AI models is a different category of problem. ### 🔎 What happened JFrog disclosed: CVE-2026-82329 on August 28. The vulnerability is an: IMPROPER AUTHENTICATION issue affecting self-managed Artifactory. JFrog says that under default configuration: an unauthenticated attacker + with network access may obtain: ADMINISTRATIVE PRIVILEGES. Now exploitation has been observed in the wild. watchTowr researchers reported attackers: MINTING ADMIN TOKENS. ### ⚔️ Attack chain Network access to vulnerable Artifactory ↓ Authentication boundary bypass ↓ Administrative privilege obtained ↓ Admin token generated ↓ Repository / identity / configuration access ↓ Potential software-supply-chain impact Observed post-exploitation probing reportedly included enumeration of areas such as: users groups credentials federated-access topology. ### 🎯 Why Artifactory matters Artifactory can sit between: DEVELOPER ↓ SOURCE / PACKAGE ↓ BUILD SYSTEM ↓ ARTIFACT REPOSITORY ↓ CI/CD ↓ PRODUCTION. An administrator-level compromise therefore creates possibilities far beyond stealing files. Depending on the environment, attackers could potentially attempt to: alter artifacts ↓ replace packages ↓ steal credentials ↓ modify repositories ↓ poison downstream builds. That does NOT mean all of these actions have been confirmed in observed attacks. It means administrative control over an artifact repository creates that trust exposure. ### 🧠 Why this matters Security teams often treat package repositories as: developer infrastructure. They should increasingly be treated as: HIGH-VALUE SECURITY INFRASTRUCTURE. Because the package repository can become a trust bridge into every system that automatically consumes what it stores. ### 🎯 What is affected JFrog lists patched Artifactory releases including: 7.111.21 7.117.28 7.125.20 7.133.29 7.146.38 7.161.20 for the respective affected branches. JFrog says affected cloud environments have already been fortified. The urgent concern is therefore: SELF-MANAGED DEPLOYMENTS. ### ⚠️ Important caveat JFrog's public advisory currently provides limited technical information about the precise vulnerability mechanism. Do NOT assume unverified explanations circulating online represent the vendor-confirmed root cause. What is confirmed: unauthenticated access + affected default configuration + administrative privilege + in-the-wild exploitation. ### 🛡️ Defender action Self-managed Artifactory operators should: PATCH IMMEDIATELY ↓ identify whether the instance was Internet/network reachable ↓ review newly issued administrative tokens ↓ audit new users / groups / permission changes ↓ review federation configuration ↓ inspect repository modifications ��� rotate exposed high-value credentials ↓ validate artifacts produced during the exposure window. If Artifactory participates directly in CI/CD: consider downstream artifact integrity part of the incident investigation. ### 🧠 CyberSignal Insight Compromising an endpoint compromises one machine. Compromising the repository that machines trust for software can compromise: the process that creates the machines. That's why artifact repositories should increasingly be treated like: IDENTITY PROVIDERS + SIGNING INFRASTRUCTURE + PRODUCTION CONTROL SYSTEMS. Not ordinary developer tooling. Sources: JFrog · watchTowr · BleepingComputer · SecurityWeek · Canadian Centre for Cyber Security

$CYPH — Mapping the next move Not a prediction — just two bullish paths I’m watching as CYPH consolidates after the explosive August breakout. 🟢 Path 1: Shallow consolidation CYPH continues chopping above the rising 20/50 EMA area, establishes a higher low, and eventually works its way back toward $2.00+. 🟡 Path 2: Full breakout retest Momentum cools further and CYPH retraces toward the $1.25–$1.30 zone — former major resistance — before buyers step back in and attempt the next leg higher. What makes that second path interesting is the confluence developing around $1.24–$1.30: old resistance + the rising 100 EMA. A move down there would look ugly, but a successful retest could actually strengthen the larger setup by confirming old resistance as new support. Right now: 20 EMA: ~$1.71 50 EMA: ~$1.49 100 EMA: ~$1.24 Major breakout level: ~$1.30 I don't know which path the market chooses — and it doesn't need to follow either perfectly. The bigger question is where the next higher low gets established. Hold the upper range → quicker attack on $2. Deeper wash + defend $1.25–$1.30 → potentially cleaner reset before another attempt. Volatility isn't necessarily a broken trend. Structure is what matters.

🚨 [SUPPLY-CHAIN ATTACK] — ATTACKERS HIJACKED INTERNET ROUTING, OBTAINED A VALID TLS CERTIFICATE AND USED THE REAL VIRTUALIZOR UPDATE CHANNEL TO DELIVER MALWARE They did not need to compromise the vendor's legitimate server first. They changed where the Internet routed the traffic. CyberSignal Priority: 🔴 VERY HIGH 📅 September 2, 2026 🏢 Softaculous · Virtualizor 🌐 BGP · TLS · Software Supply Chain 🎯 Virtualization / Hosting Infrastructure 🏷️ BGP Hijacking · Malicious Updates · Root Compromise · Supply Chain This is one of the most interesting supply-chain attacks of the year because several security mechanisms worked exactly as designed — and the attackers still reached production servers. ### 🔎 What happened Between August 28 and August 30, an unauthorized network began announcing: 162.55.80.0/24 a block containing Softaculous infrastructure. That included systems used for: Virtualizor updates ↓ APIs ↓ client services ↓ other Softaculous infrastructure. Because the malicious route was more specific than Hetzner's normal route, networks accepting the announcement routed traffic toward: ATTACKER-CONTROLLED INFRASTRUCTURE. But the attack went further. The attacker was also able to obtain: A TECHNICALLY VALID TLS CERTIFICATE for affected Softaculous domains. So users reaching the attacker-controlled server did not necessarily receive: a certificate warning. ### ⚔️ Attack chain Unauthorized BGP announcement ↓ Internet route changes ↓ Softaculous traffic diverted ↓ Attacker controls destination ↓ TLS validation follows hijacked route ↓ Valid certificate obtained ↓ Virtualizor update request intercepted ↓ Malicious package returned ↓ Update client accepts package ↓ Root-level compromise possible Softaculous confirmed that a malicious Virtualizor package was delivered to: a small number of installations. A hosting provider separately reported finding the malicious modifications on: 5 OF 34 Virtualizor hypervisor nodes it checked. ### 🤯 The security lesson The most important part of this incident is what the attacker DID NOT need to break. They did not need to: break TLS cryptography. They did not need to: forge a CA signature. They did not necessarily need to: compromise the legitimate update server. Instead: ROUTING TRUST ↓ CERTIFICATE TRUST ↓ UPDATE TRUST were chained together. And one final control was missing: cryptographic verification of the software package itself. Virtualizor says its update clients did not yet cryptographically verify update packages. That meant: HTTPS said: “You are securely connected to the server at the end of this route.” But nothing independently proved: “THIS UPDATE WAS ACTUALLY SIGNED BY SOFTACULOUS.” Those are not the same security guarantee. ### 🎯 What is affected Virtualizor operators should treat systems that checked for updates during the affected periods as potentially exposed. Softaculous says it cannot produce a definitive victim list because malicious requests terminated on infrastructure it did not control. That makes ordinary server-side logs incomplete. ### ⚠️ Important caveat Softaculous describes the confirmed affected population as: a handful of servers. This was NOT a compromise of every Virtualizor installation. The company also says it has not identified malicious packages for its other products, although its investigation is continuing. ### 🛡️ Defender action Virtualizor operators should: run the vendor's security analyzer ↓ inspect unexpected system services ↓ audit SSH keys and new accounts ↓ review cron jobs / scheduled persistence ↓ rotate Virtualizor API credentials ↓ restrict API access ↓ review unusual outbound connections. If ROOT compromise is confirmed: do not assume deleting the visible malware restores trust. Rebuilding the host from a known-good state should be strongly considered. Infrastructure operators should also examine: RPKI / Route Origin Validation + BGP monitoring + cryptographically signed update metadata + mandatory package-signature verification. ### 🧠 CyberSignal Insight TLS can prove the identity associated with the connection it reaches. It cannot prove that the Internet routed you to the right infrastructure in the first place. And neither BGP nor TLS should be the final authority for software integrity. A secure update pipeline needs: NETWORK TRUST + TRANSPORT TRUST + PUBLISHER SIGNATURE. The publisher signature is what should survive even when the network itself lies. Sources: Virtualizor · Softaculous · SecurityWeek · The Hacker News · Ars Technica