Aggregator

Amazon Quick authorization bypass let users reach blocked AI chat agents

Help Net Security
1 month ago

Enterprises running Amazon Quick, the AWS business intelligence and agentic AI service, rely on a feature called custom permissions to restrict who inside an account can use AI chat agents. Fog Security founder Jason Kao discovered that those restrictions were enforced only in the user interface for a period earlier this year, and direct calls to the backend API returned successful chat responses from agents that administrators had explicitly disabled. A locked door that was … More →

The post Amazon Quick authorization bypass let users reach blocked AI chat agents appeared first on Help Net Security.

Mirko Zorz

Veeam Intelligent ResOps unifies data context and recovery

Help Net Security
1 month ago

Veeam Software announced Veeam Intelligent ResOps, a new solution that unifies data context and recovery operations. As agentic AI accelerates change at machine speed, Intelligent ResOps gives teams the insight they need into their data to quickly understand impact and recover precisely – without broad rollbacks when something happens. When insights are disconnected from recovery, response slows and risk rises. Intelligent ResOps is the first resilience offering on the new Veeam DataAI Command Platform and … More →

The post Veeam Intelligent ResOps unifies data context and recovery appeared first on Help Net Security.

Industry News

土星冰环可能源自其卫星

Solidot
1 month ago
长期以来，土星环究竟是如何形成的，一直都是争论的焦点。最新的数值模拟指出，壮丽的行星环系统并非与土星同时诞生，而是在约 1 亿年前才形成。这项由美中联合研究团队提出的假说，将环的起源归功于一颗被命名为蝶蛹（Chrysalis）的古老卫星，在强大引力作用下发生的结构性毁灭。该卫星的物理规格与现今的土星第三大卫星土卫八（Iapetus）相仿，直径约 1,469 公里，且具备分层化的内部结构，由岩石核心与外层冰壳组成。研究指出，蝶蛹卫星原本运行于非常狭长的椭圆轨道，最近轨道距离土星半径的1至1.5倍区域，这正是冰质天体的洛希极限（Roche limit）临界范围。在此区域内，土星强大的潮汐力克服了卫星自身的结构强度，迫使其在引力撕扯下发生彻底的崩解。卫星解体后的残骸大部分被土星引力捕获，历经演化后形成了广阔的行星环，其余部分则逃逸至太空。研究显示，初期的土星环规模可能远超现今观测所见，但随后受到土卫六（Titan）等大型卫星的引力影响，大量物质被移除或重新分配。

The world’s most “Dangerous” AI, Anthropic’s Mythos, found only one flaw in curl

Security Affairs
1 month ago
Anthropic’s AI found five vulnerabilities in curl, but only one low-severity issue proved to be a real vulnerability. In April, Anthropic made considerable noise announcing Mythos, a new artificial intelligence model described as so effective at identifying vulnerabilities in code as to be, in the company’s own words, “dangerously good.” So good, in fact, that […]
Pierluigi Paganini

RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded

The Hackers News
1 month ago
RubyGems, the standard package manager for the Ruby programming language, has temporarily paused account sign ups following what has been described as a "major malicious attack." "We're dealing with a major malicious attack on RubyGems right now," Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, said in a post on X. "Signups are paused for the time being.
The Hacker News

Instructure took a risky approach to recover stolen Canvas data

Help Net Security
1 month ago

Instructure, the company behind the online learning platform Canvas, said it reached an agreement with the extortion group ShinyHunters to prevent data stolen in a recent breach from being leaked online. According to the company’s website, Canvas has more than 30 million active users worldwide and serves more than 8,000 institutions. Although Instructure did not disclose the terms of the arrangement, the statement strongly suggests a ransom payment was made. “We know that concerns about … More →

The post Instructure took a risky approach to recover stolen Canvas data appeared first on Help Net Security.

Sinisa Markovic

欧洲企业据称向侵犯人权者出口间谍软件

不安全
1 month ago
欧洲企业据称向侵犯人权者出口间谍软件一份新报告发现，欧洲企业已将有争议的监控技术出售给以侵犯人权而闻名的国家。根据人权观察本周二发布的这份报告，这些发现表明，欧盟于2021年出台的旨在控制该技术出口的

Managed ad