AI-powered browsers are rapidly reshaping the familiar landscape of web browsing, evolving from passive tools for displaying pages
The post New Threat Landscape: AI Browsers Create Agentic Vulnerabilities & Amplified Data Risk appeared first on Penetration Testing Tools.
安全研究员最新发现，威胁者目前正活跃利用Windows系统的一个SMB高危提权漏洞，在未打补丁的设备上获取SYSTEM权限（系统最高权限）。
该漏洞编号为CVE-2025-33073，影响所有版本的Windows Server、Windows 10系统，以及最高至Windows 11 24H2版本的Windows 11系统。
据悉，微软在2025年6月的“补丁星期二”中修复了该漏洞，并披露其根源是“访问控制不当”——授权攻击者可通过网络利用该缺陷实现权限提升。
微软解释漏洞利用原理如下：
1. 攻击者可诱骗受害者连接至由其控制的恶意应用服务器（如SMB服务器）；
2. 受害者连接后，恶意服务器会破坏SMB协议；
3. 攻击者还可执行特制恶意脚本，迫使受害者设备通过SMB协议回连攻击系统并完成认证，最终实现权限提升。
值得注意的是，微软当时在安全公告中提及，该漏洞信息在安全更新发布前已公开。但截至目前，微软尚未公开认可CISA关于“CVE-2025-33073遭活跃利用”的说法。随后，Microsoft 将此漏洞的发现归因于多名安全研究人员。
目前CISA尚未公布关于CVE-2025-33073活跃攻击的更多细节，但已将该漏洞纳入“已知被利用漏洞目录”。
根据约束性作指令 （BOD） 22-01 的规定，FCEB需在11月10日前完成系统加固，修复窗口期为三周。此外，CISA建议相关企业应尽快为系统打上该漏洞的修复补丁——毕竟该漏洞正被活跃利用，风险极高。
YouTube has found itself at the center of a new debate over the limits of automated moderation. The
The post “Serious Injury or Death”: YouTube AI Deletes Windows 11 Tutorials, Sparks Moderation Crisis appeared first on Penetration Testing Tools.
Rust has received a major update — version 1.91 has officially elevated support for Windows on 64-bit ARM
The post Rust 1.91 Elevates Windows on ARM Support, Boosting Safety and Stability appeared first on Penetration Testing Tools.
After installing the KB5067036 update for Windows 11, some users began noticing peculiar system behavior — when launching
The post Windows 11 Task Manager Refuses to Die, Multiplying Processes and Slowing Down PCs appeared first on Penetration Testing Tools.
The Open VSX Registry and the Eclipse Foundation have completed their investigation into a significant security incident involving exposed developer tokens and malicious extensions. The comprehensive response reveals how the platform is strengthening defenses across the entire VS Code extension ecosystem following the breach. The security incident began when researchers at Wiz identified multiple extension […]
The post Open VSX Registry Addresses Leaked Tokens and Malicious Extensions in Wake of Security Scare appeared first on Cyber Security News.
SANTA CLARA, Calif., November 4, 2025 – The 18th Global Security Analyst Summit (SAS) concluded successfully in Khao Lak, Thailand. Focused on the complexity of APT attacks, the summit exposed the latest attack activities from Hacking Team and disclosed multiple major security risk incidents. It gathered top global cybersecurity experts, academic elites, and law enforcement representatives to […]
The post NSFOCUS in SAS 2025: Unveiling Secrets Behind Large-Scale DDoS Attacks on AI Platform and Social Media appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..
The post NSFOCUS in SAS 2025: Unveiling Secrets Behind Large-Scale DDoS Attacks on AI Platform and Social Media appeared first on Security Boulevard.
Cybersecurity researchers and firewall monitoring services have detected a dramatic surge in reconnaissance activity targeting Windows Server Update Services (WSUS) infrastructure. Network sensors collected from security organizations, including data from Shadowserver, show a significant increase in scans directed at TCP ports 8530 and 8531 over the past week. While some scanning activity appears connected to […]
The post Hackers Actively Scanning for TCP Port 8530/8531 Linked to WSUS Vulnerability CVE-2025-59287 appeared first on Cyber Security News.