Aggregator

A vulnerability has been found in OpenHarmony up to 5.0.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component tcb. The manipulation leads to use after free. This vulnerability is known as CVE-2025-27128. Local access is required to approach this attack. There is no exploit available.

A vulnerability, which was classified as critical, was found in OpenHarmony up to 5.0.3. Affected is an unknown function of the component tcb. The manipulation leads to race condition. This vulnerability is traded as CVE-2025-25278. An attack has to be approached locally. There is no exploit available.

A vulnerability, which was classified as critical, has been found in OpenHarmony up to 5.0.3. This issue affects some unknown processing of the component tcb. The manipulation leads to use after free. The identification of this vulnerability is CVE-2025-24298. The attack needs to be approached locally. There is no exploit available.

日本读卖新闻集团向东京地方法院起诉了使用生成 AI 提供搜索服务的美国新兴公司 Perplexity。诉讼称Perplexity 通过 AI 搜索未经授权使用文章侵犯了著作权，要求赔偿约 21.68 亿日元。这是日本媒体首次围绕AI搜 索提起诉讼。诉状显示，Perplexity 于 2025 年 2～6 月获取并复制了 11 万 9467 篇读卖新闻在线文章的信息，制作并向用户发送了包含相似文本和图像的内容。诉状指出，Perplexity 侵犯了著作权法规定的复制权和公众传播权，并因用户不能访问原始网站的“零点击搜索”妨碍了经营。诉讼还要求停止复制文章等行为。

 In Nigeria, scammers who specialize in Romance Scams and BEC are called "Yahoo Boys."  In Ghana, the term for the same activity is "Sakawa."  Several Ghanaian headlines are talking about this case with headlines such as "Multimillion dollar Sakawa" or "Sakawa Chairman Busted" or "Sakawa Kingpin Bows to Extradition!" 

On 08AUG2025 the US Attorney's office in the Southern District of New York announced the extradition of four Ghanaian scammers who stole more than $100 Million via Romance Scams and Business Email Compromise. 

https://www.justice.gov/usao-sdny/pr/ghanaian-nationals-extradited-roles-criminal-organization-stole-more-100-million

The names likely are not well known in the US, but the first two are creating a stir in some parts of Ghana: Isaac Boateng, Inusah Ahmed, Derrick Van Yeboah, and Patrick Kwame Asare.

Inusah Ahmed, also known as Pascal, and "Agony" is the owner of the PAC Academy Football Club in the Ashanti region of Ghana. Ghana Soccer quotes one source as saying "Pascal was not just the owner; he was the heart and soul of PAC Academy.  This is a huge blow!" 

https://ghanasoccernet.com/pac-academy-fc-faces-uncertain-future-amid-owner-inusah-ahmed-pascals-arrest-over-alleged-internet-fraud

Isaac Kofi Oduro Boateng, better known as "Kofi Boat," claims to be the owner of ICEFOOD, a frozen food company specializing in chicken and fish in Ghana. But he is better known as the "godfather" of singer Shatta Wale.  

Kofi Boat

Shatta, whose real name is Charles Nii Armah, was featured on the Beyonce track "Already" on her 2019 Lion King album.  Last week he had his 2019 Lamborghini Urus seized by the government of Ghana, after the FBI informed them it was purchased with stolen funds.

https://www.bbc.com/news/articles/cq687q927r7o Ghana and the City of Lexington BEC

The source of those Lambo funds was Nana Kwabena Amuah, another Ghanian, who performed a $3.9 Million Business Email Compromise against the city of Lexington, Kentucky. When Amuah was arrested in 2023, he posted bail and four days later was arrested attempting to flee to Canada on an Amtrak train. 

In an unusual court document, 58 victims of Amuah's BEC crimes are listed with complete street address and the amount of money stolen.  Victims are identified in Alabama, Arizona, California, Colorado, Florida, Georgia, Iowa, Illinois, Michigan, Minnesota, Missouri, North Carolina, Oklahoma, Pennsylvania, Tennessee, Texas, Vermont, Wisconsin, the United Kingdom and Switzerland.  Collectively they were tricked into sending $4,743,443 to Amuah and his co-conspirator, Shimea Maret McDonald.  McDonald had opened a shell company, Gretson Company LLC, and had bank accounts at many major banks in that name that were used to receive the funds. 

Victim Restitution Worksheet (1-20 of 58)

There were others arrested in this ring, including Samuel Kwadwo Osei, who was recruited into "Sakawa" by a Nigerian computer programmer, Sapphire Egemasi, who the Nigerian media calls a "Tech Queen." Nigerian blogger Linda Ikeji (who I've followed for many years) shared this photo of Sapphire: 

https://www.lindaikejisblog.com/2025/6/fbi-arrests-nigerian-tech-queen-sapphire-egemasi-over-alleged-fraud-in-us-2.html

Samuel Kwadwo Osei ("Tuga"), Derick Nii Ashitey, Chinemezu Sapphire Egemasi, and Fred Brobbey Awuah were all charged in the same ring as McDonald and Amuah. 

Osei laundered funds through his BofA account in the name "Lasko Company LLC."
Ashitey operated from the United Kingdom. Sapphire operated from Nigeria, while Awuah resided in the Netherlands. 

Another Boateng? Dada Joe Remix  Perhaps the first linked case in this string of Ghana-related arrests comes from the 27MAY2025 arrest of  Joseph Kwadwo Badu Boateng, who was extradited to Arizona for ties to a romance scam case.  In Ghana, he is known as "Dada Joe Remix" and claims to be involved in oil and gas as well as real estate. According to "Pulse Ghana" he is "rumoured to be the man behind Shatta Bandle, Ghanian self-acclaimed billionaire and richest man in Africa."  A Ghanian "prophet" Abusua is now claiming that Dada Joe was formerly "his small boy." Abusua claims that he took him into the bush for three months to teach him how to invoke spiritual powers to help him have success in his frauds.  https://x.com/StateDeptDSS/status/1940078310156865950

Are Ghana's "Elite" panicking? 

My favorite paragraph in the Pulse story "Accra socialite Dada Joe Remix nabbed in alleged FBI sting"  reads:  "Since news of the arrest broke, panic has reportedly gripped Accra’s elite social circles. Several prominent figures allegedly involved in cryptocurrency, forex trading, and high-end real estate have gone underground. Phones have reportedly been switched off, luxury homes have fallen silent, flights are rumoured to be hastily booked, and inner circles – including partners, baby mamas, and close associates – are allegedly being coached on what to say should they be questioned."

The post Ghanaian fraudsters arrested for BEC/Sakawa appeared first on Security Boulevard.

A vulnerability classified as critical was found in bulletphysics bullet3 up to 3.25. This vulnerability affects unknown code of the component LoadOFF. The manipulation leads to buffer overflow. This vulnerability was named CVE-2025-8854. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

Researchers have compromised OpenAI’s latest GPT-5 model using sophisticated echo chamber and storytelling attack vectors, revealing critical vulnerabilities in the company’s most advanced AI system.  The breakthrough demonstrates how adversarial prompt engineering can bypass even the most robust safety mechanisms, raising serious concerns about enterprise deployment readiness and the effectiveness of current AI alignment strategies. […]

The post GPT-5 Jailbreaked With Echo Chamber and Storytelling Attacks appeared first on Cyber Security News.

《地球》（Earth）期刊发表的一项研究显示，自 1800 年以来，人类与自然的联结度下降了 60% 以上。通过城市化进程、社区野生动植物减少的数据，以及父母不再向子女传递亲近自然的习惯等因素，研究人员追踪了 220 年来人类生活中自然元素的缺失。结果显示从 1800 年到 2020 年，自然词汇在书籍中逐渐消失，其中 1990 年的降幅达到 60.6% 的峰值。计算机模型预测，如果没有深远的政策和社会变革，人类与自然的联结度将继续下降。随着社区日益城市化、父母不再传递“面向自然”的价值观，下一代将继续失去对自然的认知。而最有效的干预措施是让儿童从小接触自然，以及对城市环境进行大规模绿化。

关键词黑客攻击当地时间8月6日，央视记者获悉，美国联邦司法系统的电子案件档案系统近日遭遇大规模黑客入侵，波及多

关键词上海医保、崩了8月11日上午，有网友反映上海医保系统疑似出现故障，无法结算。

A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. Affected is an unknown function of the component Static Routing Configuration Handler. The manipulation of the argument next-hop-interface leads to command injection. This vulnerability is traded as CVE-2023-1457. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the component OSPF Handler. The manipulation of the argument area leads to command injection. This vulnerability is known as CVE-2023-1458. The attack can be launched remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function tipc_link_xmit of the component TIPC Module. The manipulation leads to excessive platform resource consumption within a loop. This vulnerability is known as CVE-2023-1390. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6. This issue affects some unknown processing of the component NAT Configuration Handler. The manipulation leads to command injection. The identification of this vulnerability is CVE-2023-1456. The attack may be initiated remotely. Furthermore, there is an exploit available. The real existence of this vulnerability is still doubted at the moment. The vendor position is that post-authentication issues are not accepted as vulnerabilities.

A vulnerability has been found in GitLab up to 15.9.3/15.10.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Child Epics Handler. The manipulation leads to improper access controls. This vulnerability is known as CVE-2023-1417. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in X.Org Server. It has been declared as problematic. This vulnerability affects unknown code of the component Overlay Window. The manipulation leads to use after free. This vulnerability was named CVE-2023-1393. An attack has to be approached locally. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function brcmf_get_assoc_ies of the file drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. The manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2023-1380. The attack can only be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, has been found in Esoteric YamlBeans up to 1.15. This issue affects some unknown processing of the component YAML Document Handler. The manipulation leads to uncontrolled memory allocation. The identification of this vulnerability is CVE-2023-24620. Access to the local network is required for this attack. There is no exploit available.

In this Help Net Security interview, Robert Buljevic, Technology Consultant at Bridge IT, discusses how the coexistence of legacy systems and SaaS applications is changing the way organizations approach security. He explains why finding the right balance between old and new technology is essential for maintaining protection. As more companies move from traditional on-prem setups to SaaS, how is that changing the way they approach security? Are most organizations handling that shift well, or are … More →

The post From legacy to SaaS: Why complexity is the enemy of enterprise security appeared first on Help Net Security.