Aggregator

微软的 Entra ID 漏洞可能造成灾难性的后果(link is external)

Solidot
23 hours 53 minutes ago
世界各地的企业过去十年将其数字基础设施从自托管服务器迁移至云端，它们受益于云服务提供商如微软提供的安全功能。但如果云服务商本身出现问题，后果可能将是灾难性的。安全研究员 Dirk-jan Mollema 在微软云服务 Azure 的身份和访问管理平台 Entra ID 发现了两个漏洞，可用于获得管理员权限，允许他访问 Entra ID 中储存的所有用户账号，从而造成灾难性影响。Mollema 于 7 月 14 日向微软披露了漏洞，微软于 7 月 17 日发布了补丁。微软之后向 Mollema 确认，问题已于 7 月 23 日修复，8 月实施了额外补救措施。微软于 9 月 4 日公开了漏洞的 CVE。

BlackLock Ransomware Attacking Windows, Linux, and VMware ESXi Environments(link is external)

Cyber Security News
1 day ago

A sophisticated new ransomware operation dubbed BlackLock has emerged as a significant threat to organizations worldwide, demonstrating advanced cross-platform capabilities and targeting diverse computing environments.  Originally operating under the name “El Dorado” since March 2024, the group rebranded to BlackLock in September 2024, establishing itself as a formidable player in the ransomware landscape with victims […]

The post BlackLock Ransomware Attacking Windows, Linux, and VMware ESXi Environments appeared first on Cyber Security News.

Florence Nightingale

智能体 JWT：面向自主人工智能智能体的安全委托协议 (link is external)

Seebug Paper
1 day ago
作者：Abhishek Goswami 译者：知道创宇404实验室翻译组 原文链接：https://arxiv.org/html/2509.13597v1 摘要 自主大型语言模型（LLM）智能体每小时可发起数千次API调用，且无需人工监督。OAuth 2.0协议假设客户端具有确定性，但在智能体场景中，随机性推理、提示注入或多智能体协同可能会悄无声息地扩大权限范围。本文提出智能体JWT（A...

CVE-2025-10848 | Campcodes Society Membership Information System 1.0 /check_student.php student_id sql injection(link is external)

VulDB Recent Entries
1 day ago
A vulnerability, which was classified as critical, was found in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.php. Such manipulation of the argument student_id leads to sql injection. This vulnerability is listed as CVE-2025-10848. The attack may be performed from remote. In addition, an exploit is available.
vuldb.com

How Juventus protects fans, revenue, and reputation during matchdays(link is external)

Help Net Security
1 day ago

In this Help Net Security interview, Mirko Rinaldini, Head of ICT at Juventus Football Club, discusses the club’s approach to cyber risk strategy. Juventus has developed a threat-led, outcomes-driven program that balances innovation with protections across matchdays, e-commerce, and digital platforms. Rinaldini shares lessons in governance, workforce awareness, and AI-enabled risk management that other high-stakes organizations can apply. Juventus is one of the world’s most high‑profile football clubs, which naturally makes it a target. How … More →

The post How Juventus protects fans, revenue, and reputation during matchdays appeared first on Help Net Security.

Mirko Zorz

Managed ad