Aggregator

Инженеры создали летающую тележку для перевозки клеток и микросхем без прикосновений.

If you think phishing is just clicking a bad link and landing on a fake login page, Tycoon2FA will prove you wrong. This new wave of phishing-as-a-service isn’t playing the old game anymore; it’s running a 7-stage obstacle course built to wear down both humans and machines. It’s already slipping past trusted security tools. If […]

The post New Multi-Stage Tycoon2FA Phishing Attack Now Beats Top Security Systems appeared first on Cyber Security News.

Google 向美国和印度用户推出名为“Preferred Sources”的新功能，允许用户从搜索结果中选择自己喜欢的新闻网站和博客，之后用户会在搜索结果中看到更多来自自己喜欢内容源的内容。但 Google 此举被认为和社交平台算法类似，限制用户的选择，将用户困住回音室里，而高质量的搜索结果需要的是更多元化的内容源，而不是更少的内容源。用户搜索需要的不是偏爱的内容源，而是减少低质量的内容源，用黑名单限制低质量内容源。

German Manufacturing Company Data Sale, 188,000+ Records Allegedly for Sale

A vulnerability was found in Wireshark up to 3.6.12/4.0.4. It has been classified as problematic. Affected is an unknown function of the component RPCoRDMA Dissector. The manipulation leads to denial of service. This vulnerability is traded as CVE-2023-1992. It is possible to launch the attack remotely. There is no exploit available.

История о том, как спецслужбы спрятали GPS прямо в сердце серверов.

Creator, Author and Presenter: Mabel Soe

Our deep appreciation to Security BSides - San Francisco and the Creators, Authors and Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon - certainly a venue like no other; and via the organization's YouTube channel.

Additionally, the organization is welcoming volunteers for the BSidesSF Volunteer Force, as well as their Program Team & Operations roles. See their succinct BSidesSF 'Work With Us' page, in which, the appropriate information is to be had!

Permalink

The post BSidesSF 2025: Fake Hires, Real Threats: When Background Checks Aren’t Enough appeared first on Security Boulevard.

AI-powered trading platforms have been observed exploiting deepfake technology to trick investors with fake endorsements

A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function ndlc_remove of the file drivers/nfc/st-nci/ndlc.c. The manipulation leads to use after free. This vulnerability is handled as CVE-2023-1990. The attack can only be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

The Ruđer Bošković Institute (RBI), the largest Croatian science and technology research institute, has confirmed that it was the one of “at least 9,000 institutions worldwide” that were attacked using the Microsoft SharePoint “ToolShell” vulnerabilities. The attack happened on Thursday, July 31, 2025, and resulted in the deployment of ransomware. “The ransomware attack affected part of the network related to the business processes of the [Institute]’s administrative and professional services, and all those documents and … More →

The post Croatian research institute confirms ransomware attack via ToolShell vulnerabilities appeared first on Help Net Security.

Proofpoint researchers have uncovered a novel technique allowing threat actors to bypass FIDO-based authentication through downgrade attacks, leveraging a custom phishlet within adversary-in-the-middle (AiTM) frameworks. This method exploits gaps in browser compatibility and user agent handling, forcing victims to revert to less secure multi-factor authentication (MFA) mechanisms, thereby enabling credential theft and session hijacking. While […]

The post Hackers Deploy Dedicated Phishlet for FIDO Authentication Downgrade Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Биометрия, анализ видео и простое «приходите лично» — новые фильтры против ИИ-мошенников.

If It Builds, It Should Be Secure Let’s be honest, your CI/CD pipeline probably wasn’t designed with security in mind. It was built to ship fast, to keep developers happy,...

The post DevSecOps Pipeline Checklist → are you doing enough for security in CI/CD? appeared first on Strobes Security.

The post DevSecOps Pipeline Checklist → are you doing enough for security in CI/CD? appeared first on Security Boulevard.

A vulnerability was found in Insyde H2O up to 05.39.17/05.47.17/05.55.17/05.62.17/05.71.17. It has been declared as critical. This vulnerability affects unknown code of the component UsbCoreDxe. The manipulation leads to improper input validation. This vulnerability was named CVE-2025-4276. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Insyde H2O up to 05.71.20. It has been rated as critical. This issue affects the function Tcg2Smm. The manipulation leads to improper input validation. The identification of this vulnerability is CVE-2025-4277. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in VMware NSX-T. Affected is an unknown function of the component NSX Manager. The manipulation leads to privilege escalation. This vulnerability is traded as CVE-2020-3993. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in VMware NSX-T. Affected is an unknown function of the component Role Based Access Control. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2021-21981. An attack has to be approached locally. There is no exploit available.

A vulnerability has been found in Foxit PDF Reader and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Doc Object Handler. The manipulation leads to use after free. This vulnerability is known as CVE-2023-27366. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in IBM Security Verify Privilege 11.6.25. This affects an unknown part. The manipulation leads to exposure of sensitive system information to an unauthorized control sphere. This vulnerability is uniquely identified as CVE-2024-31887. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in IBM QRadar Suite Software and Cloud Pak for Security. This issue affects some unknown processing of the component Web UI. The manipulation leads to cross site scripting. The identification of this vulnerability is CVE-2023-47731. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.