lemmydev2

joined 2 years ago
 

The company expects it will continue to struggle with online disruptions until at least July, due to the attack.

 

Popular VR game Gorilla Tag partnered with the company k-ID to comply with age verification laws.

 

Experts tell CyberScoop that the U.S. telecom system is just too technologically fragmented to gather a clear picture of threats, and too big to ever fully eject all espionage efforts. The post A house full of open windows: Why telecoms may never purge their networks of Salt Typhoon appeared first on CyberScoop.

 

At yesterday’s I/O conference, Google announced plans to start putting its AI chatbot, Gemini, in a variety of different places, including cars. Today, Volvo said it was shoving its way to the front of the line to be the first to receive the new tech. Volvo said it was expanding its preexisting partnership with Google […]

 

Microsoft Deployment Toolkit (MDT) shares, an often-overlooked infrastructure component, can be a goldmine of credentials for attackers. A new report published by TrustedSec highlights how red teams can easily extract domain administrator credentials from misconfigured MDT deployments, potentially leading to complete network compromise. While security professionals have long focused on System Center Configuration Manager (SCCM) […] The post Extracting Credentials from Microsoft Deployment Toolkit Shares – Red Teaming appeared first on Cyber Security News.

 

For the first time, new quantum-safe algorithms can be invoked using standard Windows APIs.

 

The VanHelsing ransomware-as-a-service operation published the source code for its affiliate panel, data leak blog, and Windows encryptor builder after an old developer tried to sell it on the RAMP cybercrime forum. [...]

 

Marks & Spencer was reported to have had its systems compromised by the Scattered Spider ransomware gang through login credentials obtained from an earlier attack against third-party IT services and consulting provider Tata Consultancy Services, according to Cybernews.

 

A threat actor named 'Hazy Hawk' has been using DNS CNAME hijacking to hijack abandoned cloud endpoints of domains belonging to trusted organizations and incorporate them in large-scale scam delivery and traffic distribution systems (TDS). [...]

 

Update before that proof-of-concept comes to bite Security researchers are sounding the alarm over a fresh flaw in the JavaScript implementation of OpenPGP (OpenPGP.js) that allows both signed and encrypted messages to be spoofed.…

 

arXiv:2505.13076v1 Announce Type: new Abstract: Autonomous browsing agents powered by large language models (LLMs) are increasingly used to automate web-based tasks. However, their reliance on dynamic content, tool execution, and user-provided data exposes them to a broad attack surface. This paper presents a comprehensive security evaluation of such agents, focusing on systemic vulnerabilities across multiple architectural layers. Our work outlines the first end-to-end threat model for browsing agents and provides actionable guidance for securing their deployment in real-world environments. To address discovered threats, we propose a defense in depth strategy incorporating input sanitization, planner executor isolation, formal analyzers, and session safeguards. These measures protect against both initial access and post exploitation attack vectors. Through a white box analysis of a popular open source project, Browser Use, we demonstrate how untrusted web content can hijack agent behavior and lead to critical security breaches. Our findings include prompt injection, domain validation bypass, and credential exfiltration, evidenced by a disclosed CVE and a working proof of concept exploit.

view more: ‹ prev next ›