Aggregator

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws impacting Citrix Session Recording and Git to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2024-8068 (CVSS score: 5.1) - An improper privilege management vulnerability in Citrix Session Recording

大型语言模型重塑了数字生态系统，但也带来了提示注入、数据中毒等新安全风险。AI驱动的渗透测试结合自动化与人工分析，帮助组织检测并修复漏洞，确保LLM应用的安全性。

Android 正以安全的名义变得日益封闭。Google 宣布将验证所有 Android 应用开发者的身份，不再局限于在 Play Store 应用商店发布应用的开发者。从明年开始，Google 将屏蔽未经身份验证的开发者的 Android 应用的侧载（sideload）。Google 给出的理由是安全。Google 称，它从 2023 年要起求所有 Google Play 应用开发者验证身份，此后恶意软件和欺诈大幅下降。于是搜索巨人得出一个结论：验证所有开发者的身份将有助于增强 Android 生态系统的安全性。

Google为提升Android安全性，将要求所有开发者验证身份，并限制未验证者应用的侧载。

The energy sector remains a major target for cybercriminals. Beyond disrupting daily routines, a power outage can undermine economic stability and public safety. Rising demand for electricity, fueled by technology and digital growth, only adds to the sector’s vulnerability. A major driver of that demand is artificial intelligence: Goldman Sachs predicts that data center power consumption could rise by 160% by 2030, as AI’s enormous energy appetite strains already fragile grids. From blackouts to breaches … More →

The post The energy sector has no time to wait for the next cyberattack appeared first on Help Net Security.

Какие революционные новшества Windows 95 мы используем до сих пор.

Anyone who has set up a smart home knows the routine: one app to dim the lights, another to adjust the thermostat, and a voice assistant that only understands exact phrasing. These systems call themselves smart, but in practice they are often rigid and frustrating. A new paper by Alakesh Kalita, IEEE Senior Member, suggests a different path. By combining LLMs with IoT networks at the edge, devices could respond to natural language commands in … More →

The post LLMs at the edge: Rethinking how IoT devices talk and act appeared first on Help Net Security.

Perplexity AI 推出 Comet Plus 订阅方案（5 美元/月），付费用户在搜索时点击或引用网站内容，网站可获收益分成。公司寻找优质合作网站，并为 Pro 和 Max 用户免费提供此功能。收益分为人工访问、搜索引用和代理行动三种方式。仅合作伙伴可参与分成，免费用户不产生收益。

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2025-08-26, 28 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Peter Girnus (@gothburz) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-26, 80 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Charles Yang @ CoreCloud Tech.' was reported to the affected vendor on: 2025-08-26, 163 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Charles Yang @ CoreCloud Tech.' was reported to the affected vendor on: 2025-08-26, 163 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'kimiya' was reported to the affected vendor on: 2025-08-26, 84 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'GuYongZeng @0x0dee' was reported to the affected vendor on: 2025-08-26, 85 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'kimiya' was reported to the affected vendor on: 2025-08-26, 85 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'kimiya' was reported to the affected vendor on: 2025-08-26, 85 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'kimiya' was reported to the affected vendor on: 2025-08-26, 85 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Hossein Lotfi (@hosselot) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-26, 77 days ago. The vendor is given until 2025-12-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A vulnerability, which was classified as problematic, was found in MedDream PACS Premium 7.3.5.860. This vulnerability affects unknown code of the file radiationDoseReport.php. Executing manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2025-32731. The attack may be launched remotely. There is no exploit available.

A vulnerability has been found in MedDream PACS Premium 7.3.3.840 and classified as critical. This issue affects some unknown processing of the file login.php. The manipulation leads to improper access controls. This vulnerability is referenced as CVE-2025-27724. Remote exploitation of the attack is possible. No exploit is available.