Aggregator

美国总统特朗普宣布将对进口半导体和芯片征收100%关税，并要求厂商在美国建厂或承诺建厂以豁免关税。苹果公司此前已承诺在未来四年投资1000亿美元于美国制造业。

Microsoft has disclosed a high-severity security vulnerability affecting Exchange Server hybrid deployments that could allow attackers with administrative access to escalate privileges and potentially compromise an organization’s entire cloud and on-premises infrastructure. The vulnerability, tracked as CVE-2025-53786, was announced on August 6, 2025, prompting immediate action from cybersecurity agencies worldwide. Vulnerability Overview The Microsoft Exchange Server […]

The post New Microsoft Exchange Server Vulnerability Allows Unauthorized Admin Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cybercriminals are deploying unidentifiable phishing kits (58% of phishing sites) to propagate malicious campaigns at scale, indicating a trend towards custom-made or obfuscated deployments, according to VIPRE Security. These phishing kits can’t easily be reverse-engineered, tracked, or caught. AI makes them affordable, too. Among the most prevalent are Evilginx (20%), Tycoon 2FA (10%), 16shop (7%), with another 5% attributed to other generic kits. Manufacturing is the top target sector For the sixth quarter in a … More →

The post Cybercriminals are getting personal, and it’s working appeared first on Help Net Security.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-07, 68 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Michael DePlante (@izobashi) of Trend Zero Day Initiative' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Eduardo Braun Prado' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Marcin Wiazowski' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Marcin Wiazowski' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Marcin Wiazowski' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'Marcin Wiazowski' was reported to the affected vendor on: 2025-08-07, 83 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Peter Girnus (@gothburz) of Trend Research' was reported to the affected vendor on: 2025-08-07, 57 days ago. The vendor is given until 2025-12-05 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

Recurity Labs成功实施并获得了ISO/IEC 27001:2022认证的信息安全管理系统（ISMS），利用Git和GitLab实现版本控制、协作审查和无缝集成。该系统由从业者为从业者设计，结合Markdown文档和GitLab流程跟踪，确保高效维护与审计准备。团队成员包括John、Nico和Lucas，在设计与实施中发挥关键作用，并将持续优化以适应发展需求。

文章介绍了如何利用Google的高级搜索技巧（称为dorks）来发现网站上的隐藏信息。通过特定的搜索语法（如inurl:"/.git"），可以找到暴露在网上的.git文件夹及其内容（如源代码、提交历史和凭证），这些信息对安全研究和漏洞赏金活动非常有用。

文章介绍了一种通过Google搜索特定代码（称为dorks）来查找隐藏信息的方法。这些代码可以帮助用户发现网站上的敏感数据或漏洞。例如，使用inurl:".git"可以查找暴露的.git文件夹。文章还提到这些技巧常用于开源情报和漏洞赏金活动，并提供了免费资源链接供进一步学习。

这篇文章介绍了一个适合初学者的渗透测试实验室——VulnOS的Legacy实验。实验通过Nmap扫描识别服务版本，使用Gobuster枚举Web服务器以获取隐藏文件中的凭证，并通过SSH登录获得用户权限。随后利用SUID二进制文件进行提权，最终获得root权限。整个过程展示了基础工具的使用和方法论的重要性。

Elastic AI SOC Engine (EASE) is a new serverless, easy-to-deploy security package that brings AI-driven context-aware detection and triage into existing SIEM and EDR tools, without the need for an immediate migration or replacement. EASE delivers agentless integrations, AI-driven alert correlation using Elastic’s Attack Discovery, and an AI Assistant that empowers SOC analysts to uncover hidden, coordinated threats faster and reduce manual investigation time. Delivered on the Elastic Cloud, EASE gives security teams a friction-reducing … More →

The post Elastic AI SOC Engine helps SOC teams expose hidden threats appeared first on Help Net Security.

文章介绍了Wifite工具用于捕获和破解WPA2预共享密钥的过程，包括使用兼容无线网卡、默认攻击流程（PMKID和脱认证攻击）、自定义字典破解及保存握手包的方法，并提供了实用技巧和工具说明。

作者发现了一款流行交友应用中的IDOR漏洞，通过修改URL参数可获取其他用户的私密信息，并获得8,000美元奖励。文章详细介绍了漏洞的发现过程和测试方法。