Microsoft has reminded IT administrators that Windows Server 2022 is rapidly approaching its mainstream end date of October 2026, when it will switch to extended support. [...]
The AI security testing firm has shared information on a recently disclosed incident involving Anthropic AI models. The post Irregular Details How a Naming Error Let AI Models Attack a Real Company appeared first on SecurityWeek .
The US government has authorized private companies to conduct offensive cyber operations, commonly referred to as "hack-back," against entities that attack them. This authorization comes with some rules and approval processes intended to limit the scope of these private sector cyberattacks. The move is controversial due to concerns about escalation of cyber conflicts and the potential misuse of offensive capabilities. There is no direct technical vulnerability or exploit described, but rather a policy change affecting cybersecurity operations.
GPEWebDefender is an open-source, lightweight web-attack monitoring tool designed to sit alongside web servers like nginx or Caddy. It tails access logs to detect probing and exploitation attempts such as SQL injection, XSS, path traversal, and known scanner activity. It is not a WAF or host-based intrusion detection system but provides real-time alerts and a dashboard for monitoring attacks. The tool is written in Go, designed for low resource usage, and supports GeoIP mapping and log formats including JSON. It is intended for use by administrators to gain insight into web attack activity without impacting site availability.
A user reported receiving a suspicious notification from the website itemsatış.com, which displayed a glitched image and a message about a secret video. After interacting with the notification, the user's computer froze temporarily but showed no obvious signs of compromise afterward. The user is concerned about potential malware or unwanted software and is performing a deep scan in safe mode. No technical details or confirmed exploits are available, and the website currently shows a default nginx server page.
It could soon become easier to identify AI-generated content, even if it's not the usual "It's Not X, it's Y" type of post you'd come across on LinkedIn and other socials. [...]
An AI pentesting engine named Cascade successfully bypassed a production AI agent's prompt-injection guardrail by reframing its request, causing the agent to disclose its entire system prompt, including tool lists, calling rules, citation formats, and session IDs. The bypass did not rely on technical vulnerabilities but on social engineering-like prompt reframing that made the request appear reasonable to the agent. This finding highlights a novel attack vector against AI agents relying on prompt-based guardrails.
This content announces an Ask Me Anything (AMA) session with Arshi Chadha, a leading AI security researcher and co-lead of the OWASP LLM Top 10 project focused on vector and embedding weaknesses. The discussion will cover prompt injection, retrieval-augmented generation (RAG) poisoning, embedding attacks, and other AI system vulnerabilities. It highlights ongoing research and public disclosures related to AI security but does not describe a specific vulnerability or exploit. The event aims to educate and engage the community on AI security challenges and mitigation strategies.
This content is a critical commentary alleging incompetence among IT personnel in the French public sector, claiming it leads to security risks for citizens. The source is a Reddit post linking to a YouTube video, with no technical details or specific vulnerabilities described. There is no evidence of a concrete security threat, exploit, or vulnerability disclosed in the provided information.
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek .
It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile and smart TV apps; – buyers.json/sellers.json : the entities buying, selling or reselling ad inventory for a given site or app. Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox . Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file. “Supply-chain integrity issues rarely live in a single file,” the site explains . “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.” A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information. A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com. HIGH-RISK AD PARTNERS DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE). According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital , which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their pub…
Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028. The post Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal appeared first on SecurityWeek .
A former data analyst contractor for Brightly Software has been sentenced to two years in prison for targeting his employer in a $2.5 million extortion scheme. [...]
A cyberattack targeted French public websites, including the tax platform, as reported by a French news outlet. The discussion on Reddit highlights concerns about the use of Microsoft products in French government infrastructure. No detailed technical information or specific vulnerabilities have been disclosed.
The security defect is described as an SQL injection that could allow attackers to achieve remote code execution. The post Hackers Exploiting Unpatched GeoServer Zero-Day appeared first on SecurityWeek .
Damn Vulnerable NGINX Proxy (DVNP) is a self-contained web security lab published by OWASP that simulates a multi-host NGINX reverse-proxy environment with over 20 real-world misconfigurations. It is designed for security professionals to practice identifying and exploiting chained web and reverse-proxy misconfigurations in a controlled setting. This lab includes backend Flask applications and shared resources to provide a realistic environment for pentesting and bug bounty training. It is not a vulnerability itself but a training tool to improve skills in finding NGINX-related security issues.