Aggregator

禅道最新版的一个任意文件读取，两个任意文件删除

MSSPs optimize for SLA metrics, not security outcomes. Autonomous SOC platforms like Morpheus can replace them at 10x lower cost.

The post From MSSP to Autonomous SOC: Replacing Linear Headcount with Infinite Compute appeared first on D3 Security.

The post From MSSP to Autonomous SOC: Replacing Linear Headcount with Infinite Compute appeared first on Security Boulevard.

DeepChat FilePresenter 组件未校验路径参数，导致通过 ../ 路径遍历可读写 userData 目录外任意文件，包括明文存储的 API 密钥。

在数字化浪潮席卷全球的今天，代码安全已成为企业生存的命脉。从GitHub到GitLab，从开源项目到企业私有仓库，代码泄露事件频发，让无数开发者夜不能寐。

使用EtherHiding技术隐藏C2通信流量窃密木马样本分析

Agentic AI Is Reshaping Security Faster Than Traditional Defenses Can Keep Up
Agentic artificial intelligence is fundamentally altering organizational workflows and how risk materializes. In 2026, emerging cybersecurity trends will push organizations to move from deterministic, rule-based risk models toward adaptive models built for autonomous, non-deterministic systems.

Four Principles Positioning the Nuclear Ecosystem for Long-Term Cyber Resilience
OT weaknesses are compounding across utilities, with 22% of critical infrastructure firms reporting OT incidents and external access driving half of breaches. U.K. NCSC's new guidance outlines connectivity principles that utilities can embed to avoid costly retrofits and compliance issues.

OpenAI Tests Promos, Anthropic Rejects Them Amid Rising Compute Costs
OpenAI has a problem: Most users don't pay for access to ChatGPT. The company is now doing what almost every Silicon Valley company before it has done and turning to digital advertising. Whether ads can bridge OpenAI's well-documented revenue gap without users fleeing is another question.

CIOs Say Stalled Pilots, Vendor Regret and Growing Fatigue Stifle AI Ambition
These may be the halcyon days for enterprise artificial intelligence, where money and ambition are only hindered by imagination as tech vendors race to gain a competitive edge. But CIOs say they're feeling increasing pressure to show ROI - and the reckoning is coming soon.

Deal Targets GenAI Risks, Prompt Injection Attacks and Autonomous Agents
Proofpoint has acquired AI security startup Acuvity to address fast-evolving risks tied to generative AI, prompt injection and autonomous agents. The company says intent-based guardrails and deep AI forensics will help enterprises secure tools such as ChatGPT, Claude and emerging agent frameworks.

VoidCrypt Ransomware Variant Taps RMM Tools, Says Huntress
Management isn't the only advocate for employee monitoring software, according to new research from cybersecurity firm Huntress. RMM tools - simultaneously open to remote connections and with privileged local access - are good for wiggling into corporate networks.

A vulnerability was found in ESRI ArcGIS Server 10.9.1/11.1/11.2/11.3. It has been rated as critical. Affected by this issue is some unknown functionality of the component Edit Operation Handler. Performing a manipulation results in sql injection. This vulnerability is identified as CVE-2024-51962. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as critical has been discovered in ESRI ArcGIS Server 10.9.1/11.1/11.2/11.3 on Windows. This affects an unknown part. Executing a manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2024-51954. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Dell NetWorker Management Console up to 19.11.0.3. It has been classified as problematic. This issue affects some unknown processing. The manipulation leads to open redirect. This vulnerability is listed as CVE-2025-21104. The attack may be initiated remotely. There is no available exploit.

A vulnerability marked as problematic has been reported in Microsoft Dataverse. The impacted element is an unknown function. This manipulation causes deserialization. This vulnerability is registered as CVE-2025-47732. Remote exploitation of the attack is possible. No exploit is available. This product is a managed service. This means that users are not able to maintain vulnerability countermeasures themselves.