Aggregator

Microsoft announced on Wednesday that systems running Windows 10 Enterprise LTSB 2016 and Home and Pro editions of Windows 11 24H2 will stop receiving updates in three months. [...]

More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions. The investigation revealed previously undocumented backdoor behavior, hidden infrastructure relationships, and multiple attack arms behind a campaign

Malware / Endpoint SecurityMore than 20 Brazilian government websites were hijacked and turned int

Next.js maintainers have announced a scheduled security release for July to address nine vulnerabilities, four rated high severity and five rated medium severity. The patches are expected to be released on July 20, 2022, and will include updated versions for Next.js 16.2 and 15.5. Next.js July Security Release This announcement initiates a formal security release […]

The post Next.js Announces July Security Release to Fix 4 High-Severity and 5 Medium Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The perpetrators of the 2024 TfL cyber-attack have been jailed for five and a half years each after pleading guilty to Computer Misuse Act offences

ValorC3 Data Centers today announced the general availability of Backup as a Service, a fully managed offering that protects the SaaS data businesses rely on most, including Microsoft 365, Entra ID and Salesforce. Every backup is immutable, so data stays recoverable after deletion, corruption or a ransomware attack. Most companies falsely assume SaaS vendors provide backup service. In reality, recent cloud governance tracking shows that 80% of organizations have experienced at least one cloud security … More →

The post ValorC3 extends SaaS protection with immutable cloud backups appeared first on Help Net Security.

A vulnerability identified as problematic has been detected in Linux Kernel. This issue affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. Performing a manipulation results in race condition. This vulnerability is reported as CVE-2022-3521. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to install a patch to address this issue.

A vulnerability marked as problematic has been reported in Linux Kernel. The affected element is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. This vulnerability is traded as CVE-2022-3523. It is possible to initiate the attack remotely. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in SourceCodester Sanitization Management System 1.0. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component User Creation Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. This vulnerability is listed as CVE-2022-3518. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in SourceCodester Sanitization Management System 1.0. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks results in cross site scripting. This vulnerability is cataloged as CVE-2022-3519. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability marked as critical has been reported in vim up to 9.0.764. Affected by this issue is some unknown functionality. Performing a manipulation results in heap-based buffer overflow. This vulnerability was named CVE-2022-3520. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

WhatsApp users are being targeted by a social-engineering technique called GhostPairing that can give scammers access to an account without requiring a password or one-time verification code. Instead of breaking into the service directly, the scam abuses WhatsApp’s legitimate device-linking feature and relies on a victim being persuaded to approve a new connected device. The […]

The post WhatsApp GhostPairing Lets Scammers Hijack Accounts Without Stealing Passwords appeared first on Cyber Security News.

日本计划从英伟达公司采购2.75万枚Rubin芯片，用于在本土开发机器人基础人工智能模型。周四，新成立的Noetra公司在官网宣布，将于2027年4月在英伟达的合作下启动AI计算平台的建设，并于202

JetBrains has addressed six security vulnerabilities in its software development and project management products. The affected applications include IntelliJ IDEA, TeamCity, and YouTrack. The most critical vulnerability, tracked as CVE-2026-59792, is an improper path handling (CWE-23) flaw that could allow attackers to exploit project workspace ID processing to perform path traversal and potentially execute code […]

The post JetBrains Patched 6 Vulnerabilities Across TeamCity, YouTrack and IntelliJ IDEA appeared first on Cyber Security News.

OpenAI has introduced GPT-Red, an automated safety red-teaming model trained to identify and exploit prompt injection weaknesses in AI agents. Prompt injection occurs when malicious instructions hidden in webpages, emails, local files, code repositories, or tool outputs manipulate an AI system into ignoring its intended task, potentially causing data theft, unauthorized actions, or policy bypasses. […]

The post OpenAI Unveils GPT-Red AI Model That Automatically Finds Prompt Injection Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Оказывается, «добросовестное использование» означало скачать весь YouTube, Deezer и Genius.

Kaspersky says OkoBot targets crypto users through fake software, stealing wallet files, seed phrases and passwords while recording activity inside wallet apps.

Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it click "Buy Now" instead. Ask a coding assistant to apply a maintainer's fix from a GitHub thread, and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task. Each one just corrupts the facts it trusts and lets it carry on with the job you

Ask an AI agent to summarize the reviews on a product page, and a single planted review can make it

Intruder has announced the launch of AI Pentesting for web applications, providing on-demand penetration testing. Following its initial release of issue-level investigations last quarter, the platform now allows organizations to securely connect their codebases via GitHub or GitLab to automatically scope and launch penetration tests in minutes, with results and audit-ready reporting in hours. Mythos and Daybreak have proven that AI is extremely adept at finding security vulnerabilities. At the same time, AI is accelerating … More →

The post Intruder brings AI-powered, on-demand penetration testing to web applications appeared first on Help Net Security.