Author: anonymousmedia_tal70o

  • Anonymous money fuels $5 million in attacks on Georgia’s Lt. Gov. Burt Jones

    Anonymous money fuels $5 million in attacks on Georgia’s Lt. Gov. Burt Jones


    ATLANTA (AP) — It’s the biggest mystery in Georgia politics right now: Who’s paying for the attacks on Republican Lt. Gov. Burt Jones?

    Someone operating under the name “Georgians for Integrity” has dumped around $5 million into television ads, mailers and texts. The attacks claim Jones, who already has President Donald Trump’s endorsement in his run for governor next year, has been using his office to enrich himself.

    For any Georgian settling down to watch a football game, the ads have been nearly inescapable since Thanksgiving. They’re the opening shot in the public battle for the Republican nomination that will be settled in May’s primary election. But the ads also show how dark money is influencing politics not only at the national level but in the states, with secretive interests dropping big sums seeking to shift public opinion.

    The Jones campaign is hopping mad, threatening legal action against television stations if they don’t stop airing ads that a lawyer calls “demonstrably false” and slanderous.

    So far, the ads remain on air.

    “They want to be anonymous, spend a lot of money, and create a lot of lies about myself and my family,” Jones told WSB-AM in an interview Dec. 16, calling the ads “fabricated trash.”

    Attorney General Chris Carr and Secretary of State Brad Raffensperger, Jones’ top rivals for the Republican nomination, say they are not involved in the attacks. All three want to succeed Republican Gov. Brian Kemp, who can’t run again because of term limits. There are also multiple Democrats vying for the state’s top office.

    Dark money marches on

    The Georgia Republican Party has filed a complaint with the State Ethics Commission. The GOP claims the ads violate Georgia’s campaign finance law against spending on an election without registering and disclosing donors.

    “I think there are far-reaching consequences to allowing this activity to go forward unchecked,” state Republican Party Chairman Josh McKoon told The Associated Press. “And the consequences are much broader than the outcome of the May primary.”

    It’s a further filtering down of the U.S. Supreme Court’s 2010 Citizens United decision, which led to dramatic increases in independent spending in U.S. elections, said Shanna Ports, senior legal counsel for the Washington, D.C.-based Campaign Legal Center, which seeks to reduce the influence of money in politics.

    “Dark money is becoming more and more the norm in races, up and down the ballot, and at early times,” Ports said.

    Claims that Jones has been engaged in self-dealing are nothing new —- Carr has been making similar attacks for months. But things escalated after Georgians for Integrity was incorporated in Delaware on Nov. 24, according to that state’s corporation records. The entity identifies itself as a nonprofit social welfare organization under the federal tax code, a popular way to organize campaign spending that lets a group hide its donors.

    The Jones campaign says the ad falsely leads viewers to believe that Jones enabled government to take land through eminent domain to help support his family’s interest in a massive data center development in Jones’ home county south of Atlanta. As a state senator, Jones did vote for a 2017 law that opened a narrow exception in Georgia’s law prohibiting governments from conveying property seized through condemnation proceedings to private developers. But eminent domain isn’t being used to benefit the $10 billion development that government filings show could include 11 million square feet (1 million square meters) of data centers.

    Group’s records are a dead end

    Georgians for Integrity lists its local address as a mailbox at an Atlanta office supply store east on some paperwork submitted to television stations. A media buyer named Alex Roberts, with a Park City, Utah, address, is also listed on those papers, but he hasn’t responded to an email from the AP. Neither has Kimberly Land, a Columbus, Ohio, lawyer listed on incorporation papers. After weeks of heavy spending, no one has proved who’s providing the cash.

    The Republican Party contends Georgians for Integrity is an independent committee under Georgia law. That means it can raise and spend unlimited sums, but must register before accepting contributions and must disclose its donors.

    But that law identifies such committees as expending “funds either for the purpose of affecting the outcome of an election for any elected office or to advocate the election or defeat of any particular candidate.” And the ads targeting Jones don’t ever identify him as running for governor or mention the 2026 elections, instead urging viewers to call Jones and “Tell Burt, stop profiting off taxpayers.”

    But McKoon said those are “semantic games” and that regular voters would definitely think the ads are designed to influence them.

    “If you are funding a message that is designed to impact an election — and I think it strains credulity to argue that that is not the case here — then you ought to have to comply with the campaign finance laws that the legislature has seen fit to pass,” McKoon said.



    Source link

  • Fire at Charlotte home connected to deadly child abuse set intentionally

    Fire at Charlotte home connected to deadly child abuse set intentionally



    Fire at Charlotte home connected to deadly child abuse set intentionally



    Source link

  • Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

    Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection


    Dec 26, 2025Ravie LakshmananAI Security / DevSecOps

    Critical LangChain Core Vulnerability

    A critical security flaw has been disclosed in LangChain Core that could be exploited by an attacker to steal sensitive secrets and even influence large language model (LLM) responses through prompt injection.

    LangChain Core (i.e., langchain-core) is a core Python package that’s part of the LangChain ecosystem, providing the core interfaces and model-agnostic abstractions for building applications powered by LLMs.

    The vulnerability, tracked as CVE-2025-68664, carries a CVSS score of 9.3 out of 10.0. Security researcher Yarden Porat has been credited with reporting the vulnerability on December 4, 2025. It has been codenamed LangGrinch.

    “A serialization injection vulnerability exists in LangChain’s dumps() and dumpd() functions,” the project maintainers said in an advisory. “The functions do not escape dictionaries with ‘lc’ keys when serializing free-form dictionaries.”

    Cybersecurity

    “The ‘lc’ key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.”

    According to Cyata researcher Porat, the crux of the problem has to do with the two functions failing to escape user-controlled dictionaries containing “lc” keys. The “lc” marker represents LangChain objects in the framework’s internal serialization format.

    “So once an attacker is able to make a LangChain orchestration loop serialize and later deserialize content including an ‘lc’ key, they would instantiate an unsafe arbitrary object, potentially triggering many attacker-friendly paths,” Porat said.

    This could have various outcomes, including secret extraction from environment variables when deserialization is performed with “secrets_from_env=True” (previously set by default), instantiating classes within pre-approved trusted namespaces, such as langchain_core, langchain, and langchain_community, and potentially even leading to arbitrary code execution via Jinja2 templates.

    What’s more, the escaping bug enables the injection of LangChain object structures through user-controlled fields like metadata, additional_kwargs, or response_metadata via prompt injection.

    The patch released by LangChain introduces new restrictive defaults in load() and loads() by means of an allowlist parameter “allowed_objects” that allows users to specify which classes can be serialized/deserialized. In addition, Jinja2 templates are blocked by default, and the “secrets_from_env” option is now set to “False” to disable automatic secret loading from the environment.

    The following versions of langchain-core are affected by CVE-2025-68664 –

    It’s worth noting that there exists a similar serialization injection flaw in LangChain.js that also stems from not properly escaping objects with “lc” keys, thereby enabling secret extraction and prompt injection. This vulnerability has been assigned the CVE identifier CVE-2025-68665 (CVSS score: 8.6).

    Cybersecurity

    It impacts the following npm packages –

    • @langchain/core >= 1.0.0,
    • @langchain/core
    • langchain >= 1.0.0,
    • langchain

    In light of the criticality of the vulnerability, users are advised to update to a patched version as soon as possible for optimal protection.

    “The most common attack vector is through LLM response fields like additional_kwargs or response_metadata, which can be controlled via prompt injection and then serialized/deserialized in streaming operations,” Porat said. “This is exactly the kind of ‘AI meets classic security’ intersection where organizations get caught off guard. LLM output is an untrusted input.”



    Source link