Aggregator

Why Cyber Risk Is Now Shaped as Much by Nations as by Hackers
Wars are becoming more frequent, and are no longer only kinetic. They are just as active in the cyber world, with impacts much larger than can be imagined. This also leads to state-sponsored hacktivists targeting the critical infrastructure of nations.

Veteran Hardware Hacker's Chip Facilitates More Trustworthy and Secure Devices
How can we trust hardware to not betray us? Enter the Baochip-1x, a piece of largely open-source silicon created by Andrew "Bunnie" Huang, which he said is designed to give developers an affordable, security-focused and attestable chip, not least for building high-assurance, embedded devices.

European Governments Grow Suspicious of Silicon Valley
French abandonment of American software for open-source alternatives continues apace, with all government ministries now facing a fall deadline for outlining plans to reduce their dependence on U.S. tech. France must "regain control of our digital destiny," said public action minister David Amiel.

Patients Allege Health Entities Did Not Get Consent to Record Conversations
Proposed federal class action litigation alleges that two California healthcare organizations violated patient privacy in their use of an AI-enabled ambient tool that records, transcribes, and processes sensitive conversations between clinicians and patients without individuals' consent.

Ex-Microsoft CIO: Mythos Could Surface Known Flaws Faster Than Vendors Can Fix Them
Former Microsoft CIO Jim DuBois and IDC's Frank Dickson say Claude Mythos Preview could rapidly surface long-known but unfixed software flaws at scale, forcing vendors and enterprises to strengthen patch validation, orchestration and deployment before attackers exploit the backlog.

好，我现在需要帮用户总结一篇文章的内容，控制在100个字以内。用户已经提供了文章的详细内容，我得先仔细阅读并理解主要内容。 文章主要讲的是欧盟计划将ChatGPT视为超大型搜索引擎平台，并纳入数字服务法案（DSA）的监管范围。这意味着OpenAI必须加强透明度和各类保护措施。同时，ChatGPT在欧盟有超过1.2亿的活跃用户，超过了成为看门人的门槛。成为看门人后，OpenAI需要改造推荐系统、处理非法内容，并防止对公众健康和心理健康的影响。 接下来，我需要将这些关键点浓缩到100字以内。首先明确欧盟的计划，然后提到ChatGPT的活跃用户数，接着说明被列为看门人后的要求和影响。 可能会这样组织句子：欧盟计划将ChatGPT纳入数字服务法案监管，因其在欧盟拥有超1.2亿活跃用户。作为看门人应用，OpenAI需加强透明度、处理非法内容，并防止对公众健康和心理健康的影响。 检查一下字数是否在限制内，并确保没有遗漏关键信息。 欧盟计划将ChatGPT纳入数字服务法案监管，因其在欧盟拥有超1.2亿活跃用户。作为看门人应用，OpenAI需加强透明度、处理非法内容，并防止对公众健康和心理健康的影响。

AI agents need credentials to work. They authenticate with LLM platforms, connect to databases, call SaaS APIs, access cloud resources, and orchestrate across dozens of external services. Every integration point requires an identity. Most organizations are handling this badly, and the evidence is in the code. GitGuardian’s State of Secrets Sprawl Report found 28,649,024 new secrets exposed in public GitHub commits across 2025, a 34% year-over-year increase and the largest annual jump in the report’s … More →

The post 29 million leaked secrets in 2025: Why AI agents credentials are out of control appeared first on Help Net Security.

好，我现在要帮用户总结这篇文章。首先，我得仔细阅读文章内容，了解主要事件和关键点。文章讲的是IBM与美国司法部达成了一项1700万美元的和解协议，涉及招聘和晋升中的非法DEI实践，以及用政府合同资金支付DEI项目并寻求报销的问题。IBM否认了这些指控，并且和解协议不代表承认责任。 接下来，我需要控制在100字以内，所以要抓住重点：IBM、司法部、和解金额、指控内容、IBM的回应以及背景信息。同时，用户要求不要以“文章内容总结”或“这篇文章”开头，直接描述即可。 然后，我要组织语言，确保信息准确且简洁。可能的结构是先点明和解协议的基本情况，接着简述指控内容和IBM的立场，最后提到司法部长邦迪的调查背景。 最后检查字数是否符合要求，并确保没有遗漏重要信息。这样就能提供一个清晰、准确的总结。 IBM与美国司法部达成1700万美元和解协议，涉及招聘晋升中的非法DEI实践及用政府资金支付DEI项目并寻求报销的指控。IBM否认不当行为，并表示其人才战略以合适技能为核心。此调查源于前司法部长邦迪要求消除私营企业中非法DEI项目。

A CVSS score 6.8 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Piotr Ptaszek and Mateusz Wójcik' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Muhammad Fadilullah Dzaki' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Do Quoc Anh (@anhdq201) from mbbank.com.vn' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of TrendAI Zero Day Initiative' was reported to the affected vendor on: 2026-04-14, 45 days ago. The vendor is given until 2026-08-12 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A dangerous malware campaign has been silently targeting cryptocurrency users by hiding inside a fake version of Proxifier, a popular proxy software tool. Threat actors set up a GitHub repository designed to look like a legitimate Proxifier download, but the installer bundled inside it is actually a Trojan that monitors and hijacks clipboard activity to […]

The post Hackers Use Fake Proxifier Installer on GitHub to Spread ClipBanker Crypto-Stealing Malware appeared first on Cyber Security News.

A vulnerability was found in Christmas Greetings Plugin up to 1.2.5 on WordPress. It has been rated as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-2116. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as problematic has been found in OceanWP Plugin up to 3.5.4 on WordPress. This affects an unknown part. Such manipulation leads to file inclusion. This vulnerability is referenced as CVE-2024-2476. The attack needs to be initiated within the local network. No exploit is available.