Aggregator

Car tire giant Bridgestone confirms it is investigating a cyberattack that impacts the operation of some manufacturing facilities in North America. [...]

About CyberFlex CyberFlex is an Outpost24 solution that combines the strengths of its Pen-testing-as-a-Service (PTaaS) and External Attack Surface Management (EASM) solutions. Customers benefit from continuous coverage of their entire attack application attack surface, while enjoying a flexible consumption model. Outpost24’s expert pen testers deliver deep, actionable insights on critical apps, with ongoing management as an extension of your security team. With a single, flexible agreement, you get fast, scalable, and business-driven pen testing, all seamlessly … More →

The post CyberFlex: Flexible Pen testing as a Service with EASM appeared first on Help Net Security.

The digital refuge: Abortion clinics, activist groups, and other organizations are turning to overseas hosting providers willing to keep their data — and their work — safe.

The threat actor known as NoisyBear has launched a sophisticated cyber-espionage effort called Operation BarrelFire, using specially designed phishing lures that imitate internal correspondence to target Kazakhstan’s energy sector, particularly workers of the state oil and gas major KazMunaiGas. Security researchers at Seqrite Labs first observed the campaign in April 2025 and noted its rapid […]

The post NoisyBear Exploits ZIP Files for PowerShell Loaders and Data Exfiltration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Red Canary’s Threat Hunting team recently uncovered a malicious OAuth application attack, demonstrating the need for specific defenses.

139 мышей, 600 000 нейронов в одной симуляции.

ESET security researchers have uncovered a sophisticated cyber threat campaign targeting Windows servers across multiple countries, with attackers deploying custom malware tools designed for both remote access and search engine manipulation. Cybersecurity experts at ESET have identified a previously unknown threat group dubbed GhostRedirector, which has successfully compromised at least 65 Windows servers primarily located in […]

The post GhostRedirector Hackers Target Windows Servers Using Malicious IIS Module appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

作者分享了近期的阅读书单、观影体验、游戏探索以及生活感悟。推荐了包括《幽灵塔》《假面的告白》《乔布斯传》等书籍，并介绍了《空洞骑士：丝之歌》的游戏玩法。此外还记录了烹饪心得、博客样式调整以及使用多邻国学习英语的经历。

Wilmington, United States, September4th, 2025, CyberNewsWire: Veteran email security leader to expand MSP and VAR partnerships and accelerate DMARC adoption.  Sendmarc today announced the appointment of Rob Bowker as North American Region Lead. Bowker will oversee regional expansion with a focus on growing the Managed Service Provider (MSP) partner community, developing strategic Value-Added Reseller (VAR) […]

The post Sendmarc appoints Rob Bowker as North American Region Lead appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

本文链接

《大模型应用落地安全风险和防护实践》由火山引擎郑炎亭主讲，聚焦后DeepSeek时代的真实攻防：提示词越狱、RAG数据窃取、Log4j 诱导RCE、算力DDoS、幻觉误导五大高危场景，并给出从接入层到训练层的全栈防护方案——大模型应用防火墙+密文RAG+熔断限流+幻觉检测。报告强调，AI已进生产核心，安全即业务连续性，防护目标正从合规转向核心资产保险。

火山引擎大模型应用防火墙产品负责人 郑炎亭在《大模型应用落地的安全风险与防护实践》的分享中，探讨大模型应用在各行各业落地过程中面临的安全风险及相应的防护实践。

郑炎亭观察到，过去，不同行业在引入新技术时注重快速验证和部署，安全往往被视为次要考虑因素。随着 DeepSeek 等工具的普及，AI 技术的成本降低、门槛变低，越来越多的企业开始重视 AI 应用的安全性，特别是在生产环境暴露面增大后带来的潜在威胁。

当前的安全挑战不仅包括传统的 DDoS 攻击、薅羊毛滥用等，还涉及大模型特有的风险，如提示词注入、模型幻觉等问题。以提示词注入为例，通过简单的拼接即可实现对模型的操控，使得攻击成本大幅降低，这对企业的数据安全构成严重威胁。

为应对这些挑战，郑炎亭提出一些实践思路：一是对提示词过滤与监控，对输入输出实施严格过滤，减少恶意利用的可能性。二是对运行环境做安全保障，使用加密技术和机密计算来保护敏感信息处理过程中的安全性。三是模型安全性测评，测试模型识别并拒绝执行恶意代码或生成有害内容。

郑炎亭谈到大模型的幻觉问题确实不易解决。大模型幻觉分为事实性幻觉和忠实性幻觉。对于不同的幻觉应设计不同的应对方案，郑炎亭介绍几种在推理端处理幻觉问题的方法，强调在推理端更具性价比且更可控。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

Darktrace reports new malware hijacking Windows Character Map for cryptomining, exposing risks of hidden attacks in everyday software…

本文链接

《安全领域大模型构建范式与实践》由腾讯安全科恩实验室吴石主讲，提出“高质量语料 + 科学评测”双轮驱动范式：自建SecCorpus对20 B token清洗去噪，使160 M小模型即达通用1.8 B效果；发布SecBench平台，5万道题覆盖证书、问答与攻防场景，为行业首套安全大模型评测基线。实践上，以混元+BinaryAI亿级函数向量RAG为核心，打造Security-X研判助手，输入IOC即可自动生成多智能体协同的综合报告，日调用破亿。报告总结：大模型落地需“数据-评测-场景”闭环，科恩已把AI能力嵌入腾讯云、iOA、电脑管家全线产品，实现精准威胁识别与智能运营。

自 2018 年起，科恩实验室开始对 AI+ 安全的研究，致力探索如何提升安全产品的智能化水平，落地相关产品，腾讯内部包含 QQ、微信在内的多个重要产品均在使用科恩实验室 AI+ 安全的能力。

当前在利用大模型解决实际安全问题上仍面临一些挑战，主要原因在于大模型本身并不产生新的知识，对于安全领域的专业知识掌握有限，导致其输出的实际效用不高。对此，吴石分享了科恩实验室在这方面所开展的工作：一是建立安全语料库，通过从多源收集数据并利用关键词过滤和分列器进行初步筛选，经过一系列数据清洗步骤，最终完成数据质量评测，目前此安全语料已部分开源。二是开发针对大模型安全能力的评测体系，填补行业空白，并部分开源评测工具，显著提升行业标准。

吴石介绍腾讯内部如何落地大模型+安全：首先通过优化 prompt 提高提问质量，解决大部分基础问题；其次，利用外挂的知识库和数据库增强大模型的能力，实现快速反应；还有，开发 Agent 来提升处理复杂任务的能力。其中，科恩实验室自研 BinaryAI 可以模糊匹配开源库信息识别恶意代码，现日调用量超 1 亿次。基于RAG的 Security-X 助手广泛应用于 URL 处理、威胁情报检索等场景。总的来说，科恩实验室具备三大核心能力：优秀的安全攻防技术、全面的基础安全大数据以及自安全算法，这些为大模型的应用提供坚实基础，并推动通用大模型与小模型的有效结合。

吴石指出，大模型作为网络安全领域的重要技术力量，已显著提升了威胁检测效率与安全防护能力，尤其在复杂场景中展现出独特价值。然而，当前技术范式下仍需理性看待其局限性：大模型在处理低频威胁、对抗性样本防御及实时决策场景中仍存在性能瓶颈。他强调，安全工作的核心仍需回归对抗本质——通过构建高保真威胁情报体系与攻击成本动态评估机制，迫使攻击者在技术、资源与时间维度付出更高代价。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

本文链接

《安全大模型发展路径洞察与实践》由360集团CTO潘剑锋主讲，提出“快思考-深度思考-慢思考”三级跃迁模型：先用统计性快思考解决告警降噪、钓鱼识别等高频任务，再借CoE多专家架构与Agentic Workflow实现复杂威胁狩猎的“慢思考”。依托360百亿级终端与网络攻防语料，CCoE模型在52个恶意家族检测中全面超越GPT-4；并通过“思想钢印”记忆机制与蒙特卡洛树搜索，持续沉淀专家经验，驱动终端、流量、云、浏览器全线产品升级。报告最终呼吁以安全大模型重塑攻防思维模式，迈向“AI即安全服务”新时代。

潘剑锋先是讨论大模型的理解能力，引入“快慢思考”概念来评估当前大模型的能力。他表示目前大模型的价值是很好地模拟人脑的“快思考”，即大模型通过海量数据训练，做文字符号层面的统计处理，从数据中找出统计性规律，在概括的意义上掌握学习样本所反映的隐含知识，并以此为基础生成内容。而“慢思考”需要对事物具有本质性理解，需借助事实性知识，通过多步推理、反思，是“深思熟虑”的结晶。针对慢思考任务的场景中，当前可编排专家经验，整合安全大模型、知识库、工具库的能力，实现半自主的推理 Agent。

当前，国内大模型赋能安全产品主要采用两种不同层次的方式：一是直接使用通用大模型的能力实现安全应用；二是应用安全垂直大模型。这两种方式之间的区别就像“一个博学的人拿着医科全书”与“主任医师”，前者虽然能够查到专业知识，但是不能够贯通运用；后者是具有丰富的临床实践经验。安全垂直大模型能够将专业的安全数据真正训练进入模型中。

潘剑锋分享如何基于以上理论进行落地实践，包括安全语料生产、模型分区训练和慢思考实现方式。高质量的安全语料被视为行业的护城河，360 首创的 CoE 技术架构允许不同的安全专家分区训练各自的模型，有效减少多任务冲突、过拟合等问题，保证训练效果同时降低资源消耗。

潘剑锋目前基于推理时计算扩展的方法，在外延方面进行创新，还尝试做本质性理解的相关工作。通过团队的持续探索，有望进一步提升大模型在安全领域的效能与适用范围，寻找新的发展范式。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

本文链接

《AI智能体：从思考规划到落地执行的安全赋能之旅》由安恒信息王欣主讲，系统描绘了AI Agent 从“会聊天”到“会做事”的跃迁路径：通过恒脑大模型+300+安全插件的编排，形成可视化报告、代码审计、钓鱼研判、数据分类分级等10大“硅基员工”，把14天等保报告缩短至2人天、告警研判效率提升93%。报告以Manus全球Agent商用化趋势为例，强调“记忆-规划-工具-反思”闭环让安全运营从人力密集转向智能托管；并预判2025年Agent将成为安全产业标配，重塑攻防协同、RPA流程、自适应架构与合规审核，实现知识经验平台化、一线专家超级个体化。

王欣详细介绍安恒信息在 AI 智能体的布局和发展历程。他表示，智能体与网络安全体系的融合将是未来的发展趋势，而非孤立存在。通过引入智能中台，将数据、知识、情报及安全产品整合为 Agent 的一部分，实现任务的调度与执行，来应对各类安全场景。预计在未来 3-5 年内，这种模式将成为面向客户侧的主要发展方向，提升整体安全效能和响应速度。

接着，王欣分享 AI 智能体给行业带来的变革：第一，Agent 的引入标志着安全运营从量变到质变的过程，技术发展需要一定的周期；第二，智能体的出现使得业务专家从专才转变为超级个体，通过减少辅助工程和岗位，让专家的知识经验成为核心，未来逐步出现一人当岗、一人多能的情况，并利用编排系统将个人经验沉淀为平台经验，以完成更多任务。

最后，王欣回顾了过去一年对 AI 智能体在安全领域的八个预测，例如 Agent 将成为产业标配，AI native 工具将成为 Agent 的手和脚；ASA 架构将在 AI 智能体影响下升级等等，他指出，部分预测可能未能完全符合实际发展轨迹，并提出今年将重新审视相关趋势，依托更严谨的分析框架与数据支撑体系，结合对技术演进的深度洞察，探索实现类似 AI 级精准预测的可能性。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

Wilmington, United States, September4th, 2025, CyberNewsWire: Veteran email security leader to expand MSP and VAR partnerships and accelerate DMARC adoption.  Sendmarc today announced the appointment of Rob Bowker as North American Region Lead. Bowker will oversee regional expansion with a focus on growing the Managed Service Provider (MSP) partner community, developing strategic Value-Added Reseller (VAR) […]

The post Sendmarc appoints Rob Bowker as North American Region Lead appeared first on Cyber Security News.

本文链接

《AI赋能的未来安全》由深信服张振礼主讲，提出“安全AGI”四阶段演进路线：从单点ChatBot到智能体闭环，最终让AI承担95%安全运营。报告详解深信服800张A100、400+硕博打造的千亿级安全大模型体系，结合RAG、微调、智能体编排，把钓鱼邮件、Web攻击、数据泄露、UEBA异常等场景做成开箱即用的“安全GPT”。通过2024HW实战验证，实现100%告警自动研判、工单自动下发、漏洞整改闭环，真正把大模型从“聊天玩具”变成“值守同事”。面向未来，倡议用AI原生应用替代传统工具，让安全团队从重复沟通中解放，聚焦高阶决策。

张振礼先是分享对 AI 赋能安全的理解：第一，安全本来就碎片化，不能每个安全 GPT 场景单独的模型分开部署，要统一规划，通过良好的架构设计实现各类大模型算力的统一调度和适配；第二，基础大模型持续进化，安全大模型需要具备快速融合、集成、吸收优秀基础模型的知识和推理能力，智能体的元年开启，持续为安全场景带来体验和效果的改进；第三，安全团队在 AI 时代要具备 RAG、微调等技能；四是开放性，AI 时代，安全产品需具备适应性以匹配不同行业的具体场景需求。

张振礼表示，网络安全是一个对检出率、准确率有极高追求的 toB 领域，将任何的开源基座大模型落地于安全领域，都绝非简单的接入、缝合，而是一个复杂的系统工程。比如 DeepSeek 在安全垂直领域商业落地，必须具有安全垂域大模型的实践数据、对基座模型的安全场景驯化经验、面向安全业务的 AI 系统工程，才能强化优势，应对挑战。我们需经过指令微调、预训练及强化学习三个阶段，并结合专业经验和安全语料进行优化，才能适应特定安全场景需求。张振礼将 DeepSeek、GPT-4.5 等通用大模型比作安全“本科生”，通过安全指令微调和安全细分领域优化，这些模型成长为“硕士”，经过系统化的构建与实际应用验证，它们将成为“博士”或有经验的安全专家。

接着，张振礼分享深信服 AI 安全的落地实践。如团队开发基于 AI 的安全助手，不仅改善安全管理，还优化安全规范及日常沟通，实现从被动响应到主动审计的转变，并推动全面自动化。此外，团队还提供 AI 安全培训体系，以增强大家的安全能力和安全技能。

谈及未来，张振礼表示，从长远来看，随着多智能体协同技术的发展，安全行业将实现高度自动化，形成人监督机器等的新模式，释放更多人力资源去处理更有价值的任务。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

本文链接

《AI系统的安全风险和挑战》由CertiK AI安全监管与治理专家李康撰写，聚焦大模型时代“系统级”威胁。报告先以欧盟AI法案风险金字塔为框架，剖析近期字节跳动实习生投毒、DeepSeek数据库泄露、ShadowRay等真实事件，指出AI Agent浪潮下传统漏洞（RCE、供应链投毒、对抗样本）与新型风险（沙箱逃逸、物理世界攻击）并存。通过GPT-Academic、Invoke AI等沙箱绕过案例，演示攻击者如何利用模型加载、文件解析、任务执行链实现远程控制；并以Tesla FSD闯红灯攻击为例，警示物理AI Agent的安全边界。最后呼吁在“AI平权”趋势下，安全监管必须超越传统网络安全假设，建立覆盖模型、数据、运行环境、物理交互的全栈治理体系。

Certik 首席安全官 李康在《AI 系统的安全风险和挑战》的主题演讲中，谈到目前 AI 安全讨论通常集中在抽象层面（如 AI 对人类社会的威胁）和算法层面，但忽略系统安全层面的重要性和紧迫性，如今，AI 智能体的普及带来新的安全挑战，这些智能体带有执行环境，允许代码执行，这为攻击者提供机会。李康举例如何利用传统安全手段攻击 AI 智能体，通过简单的手段如命令注入、越权访问等，可轻易地对 AI 智能体进行攻击。

“攻击者并不一定针对AI的偏见或利用Prompt和幻觉进行攻击智能体，而是寻找有价值的目标，并用最简单的方式达成目的，当前AI的安全监管和检测尚未充分考虑这一点，未来需关注具体事件的爆发以应对这些潜在威胁。”李康提醒说。

随后，李康进一步分析物理世界中的 AI Agent 同样面临安全风险，阐述 AI 系统在现实世界中的安全隐患。李康表示，AI Agent 为安全研究带来机会与责任，既让我们重新审视和应用过去的安全手段进行防护，同时也要求我们在发现攻击路径和方法上进行创新，尤其是在面对真实场景时，不依赖传统的直接互动方式。

李康提醒道，AI 的普及不仅带来技术平权，也引入新的安全风险，希望安全从业者获得更多话语权和重视，尤其是在监管层面应更加关注底层安全问题。最后，李康呼吁更多人参与到 AI 安全的研究和实践中来。

https://mp.weixin.qq.com/s/6rlyOEhF1CkX7Kvnj4ZISw

LinkedIn is rolling out new verification rules to make it easier to confirm that people and companies are who they claim to be. The company will now require workplace verification when someone adds or updates a leadership or recruiter role on their profile. The goal is to cut down on fake accounts and scams while helping businesses, recruiters, and professionals build credibility. Here is what’s changing: 1. Premium Company Page verification Until now, only a … More →

The post LinkedIn expands company verification, mandates workplace checks for certain roles appeared first on Help Net Security.

Compromised credentials are now the leading cause of cloud breaches, making identity your most critical attack surface. A new IDC white paper explores why this shift is happening and where traditional defenses fall short. Read on to learn how Tenable's identity-first approach turns this risk into your strongest defense.

Hack the user, own the cloud.

Attackers aren’t spending months trying to breach your cloud environment. They’re waltzing in the front door with stolen keys.

How? By targeting the biggest blind spots in any cloud environment: identity exposures.

Indeed, in the era of AI and multi-cloud sprawl, attackers no longer need to exploit systems — they exploit users. Whether through phishing, credential stuffing or over-permissioned roles, cloud identities are often the weakest link.

The identity explosion: A minefield of privileges

Think about your cloud environment. Chances are it’s a chaotic web of tens of thousands of human and machine identities, each with its own set of permissions, access rights — and identity risks.

The challenge lies in managing these identities and their associated privileges effectively across a multi-cloud or hybrid environment. Without a robust identity and access management (IAM) strategy, you leave the doors to your most critical cloud systems and data unlocked. 

As IDC notes in the white paper “Bridging Cloud Security and Exposure Management for Unified Risk Reduction,” commissioned by Tenable: “IDC research highlights that compromised credentials are now the leading cause of breaches, driving the adoption of CNAPP identity-centric security measures.”

“For example, ransomware delivered via phishing typically succeeds by compromising credentials, moving laterally, escalating privileges, and then encrypting and possibly exfiltrating data,” the white paper reads.

Complicating the picture is the now common scenario where organizations have multiple cloud service providers, each with distinct identity models and entitlements, creating what IDC calls “identity sprawl.” The result is a fragmented cloud security landscape with inconsistent policies and lack of visibility into who has access to what — amplifying your risk.

So what’s the solution? Read on to learn how Tenable can help you streamline and boost your management and protection of cloud identities.

What IDC says about Tenable’s cloud identity security capabilities

IDC highlights as a “key strength” of the Tenable Cloud Security cloud-native application protection platform (CNAPP) its focus on “identity-intelligent cloud security.”

With the integration of cloud infrastructure entitlement management (CIEM) and just-in-time (JIT) access capabilities, Tenable Cloud Security detects and mitigates identity-based risks proactively, IDC notes.

“This focus is vital, as compromised credentials and over-privileged access remain leading causes of breaches — and are key factors in toxic combinations contributing to lateral movement during attacks. Automating temporary elevated access requests enforces least-privilege policies while supporting business responsiveness,” the white paper reads.

Moreover, Tenable Cloud Security’s scope, spanning on-premises and cloud environments, is “crucial” for organizations with hybrid environments and a diversity of identity systems, according to IDC.

“Its CNAPP bakes cloud security best practices into the management of each supported provider, offering a unified view that reduces identity sprawl and addresses shadow IT,” the white paper reads.

The Tenable difference: Making identity your strongest defense

Unfortunately, many platforms continue to treat identity as an isolated module, rather than integrating it across risk workflows. They might flag an over-permissioned user, but they fail to connect the dots.

Instead, Tenable’s CNAPP architecture goes beyond alerting on over-permissioned identities. It correlates identity data with runtime behavior, asset sensitivity and known misconfigurations to uncover “toxic combinations” — risk scenarios where users or services have dangerous levels of access to vulnerable systems.

By integrating identity-aware capabilities into Tenable Cloud Security and the Tenable One Exposure Management Platform, we empower your entire team:

• IAM teams: Enforce least-privilege with automated JIT controls.
• Security operations centers (SOCs): Cut through the noise and prioritize alerts based on actual identity risks.
• Architects: Baseline and remediate misaligned roles across cloud and hybrid infrastructure.

This way, Tenable Cloud Security and Tenable One help you prevent lateral movement, privilege escalation and insider threats — particularly in large organizations with complex, distributed access models.

What this means for cloud security leaders

Managing entitlements across Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP) and on-prem environments requires unified visibility and policy enforcement. Tenable addresses this through embedded CIEM capabilities that continuously monitor and assess user access, flag anomalies and provide actionable remediation guidance.

Because identity signals are integrated into Tenable One’s exposure management framework, architects gain visibility into how identities influence overall risk posture. This enables threat modeling that accounts for real-world attack paths rather than theoretical vulnerabilities alone.

Supercharge your cloud security program

Identity is the new perimeter. By adopting an identity-centric approach to cloud security, you can boost your defenses’ resiliency and agility, and keep pace with the ever-evolving threat landscape.

Choose a CNAPP that treats identity risks as a central part of exposure — not a feature buried in a submenu.

To get a deeper understanding of how you can leverage a unified CNAPP to build a robust, identity-intelligent security posture, we encourage you to download the IDC white paper “Bridging Cloud Security and Exposure Management for Unified Risk Reduction.”