Cybersecurity firm's election system findings halted amid political pressure
Mojave Research's examination of Dominion voting systems in Puerto Rico revealed at least a dozen high- or critical-severity software vulnerabilities.
SC Media
20 articles
Hacktivist group Head Mare exploits TrueConf vulnerabilities to deliver backdoors
The attackers leverage vulnerabilities, tracked as KLCERT-26-057 and KLCERT-26-058, to execute arbitrary code and gain elevated privileges on the server, acc...
Nearly 800 malicious npm packages deliver cross-platform malware
The campaign, tracked as Flooding Dropper by Sonatype, employs a novel approach by instructing developers to load packages using "require()", bypassing typic...
OpenAI's new Astra model may pose critical cybersecurity risks
Polish researchers find thousands of public websites vulnerable to cyberattacks
Two Polish security researchers, Robert Kruczek and Kamil Szczurowski, discovered over 10,000 affected public entities with 250,000 websites exhibiting secur...
Metabase SQL injection vulnerability exploited in zero-day attacks
The vulnerability, affecting Metabase versions 1.58 and above, allows unauthenticated remote attackers to inject arbitrary SQL, potentially gaining administr...
Scammers use AI deepfakes to impersonate OnlyFans creators
The fraudulent scheme involves creating fake identities using AI to generate deepfakes of real OnlyFans creators.
WordPress 'XSS2Shell' flaw allows admin takeover and remote code execution
The XSS2Shell flaw begins with a specially crafted username that bypasses WordPress's initial HTML tag sanitization.
Framework notifies customers of data breach following upstream cyberattack
The breach affected customer names, email addresses, phone numbers, and physical addresses.
Defense supplier IEH Corporation discloses Microsoft 365 mailbox breach via phishing
The breach occurred when an employee fell victim to a phishing scam, impersonating a business contact and presenting a fake Microsoft sharing link.
CISA cautions against overly restrictive legislation for global vulnerability program
A funding scare last year highlighted the program's reliance on a single U.S.
Updoc data breach exposes customer contact information
The incident at Updoc, an Australian telehealth service, was detected on July 31 and involved unauthorized access to an external system used for operational ...
AI inference attacks pose new data privacy risks
Gartner predicts that by 2029, most privacy incidents will arise from AI-generated inferences rather than direct exposure of personal information.
New NatJack attack class exploits NAT vulnerabilities to hijack TCP sessions
NatJack exploits a fundamental assumption in many NAT implementations: that systems behind the same NAT will not interfere with each other's connection states.
Windows Hello for Business keys can be silently abused by malware
Researcher Dirk-jan Mollema demonstrated that malware can exploit Windows Hello for Business keys on TPM-backed systems without extracting private keys, reco...
Attackers exploit AI skills registry for credential theft
Researchers at Zenity Labs discovered a campaign on skills.sh, a Vercel-hosted registry for AI skills.
Rubrik and Wipro partner to offer enterprise resilience as a service
The consultancy-led scheme is designed to help enterprises prevent, withstand, and rapidly recover from cyber and operational disruptions.
Three interviews: system fragility, operational clarity, and Identity for AI agents - Robin Macfarlane, Kyle Sandy, Todd Thiemann - ESW #471
Black Hat: AI isn't the problem. We are
The obstacles in trying to secure AI use boil down to one issue: We're thinking about it the wrong way.
Bugcrowd's Braden Russell on launching Pathseeker
Russell on launching Savant Pathseeker, the first product in its new Agentic Offensive Testing line.