Aggregator

The cybersecurity pioneer discusses the evolution of the CISO role, AI's impact on careers, and why operational resilience is the profession's next frontier.

AI-generated code is transforming software development, but it is also introducing new security risks. Learn how a real-world penetration test uncovered a critical authentication flaw that exposed sensitive customer data and what security teams can do to prevent similar issues.

The post Code at AI Speed, Risk at AI Scale appeared first on Sygnia.

在安全这个领域上，真正的迎来了 AI 时代

More than 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller (BMC) interface. [...]

Борьба за open source стала вопросом выживания для производителя ускорителей

An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced in 2004. That controller runs underneath the operating system. It power-cycles the host, mounts virtual media, opens a remote console, and flashes firmware. Host security tools watch the layer above it. Example BMC web … More →

The post Exposed BMCs hand out password hashes before login appeared first on Help Net Security.

A highly disruptive incident can feel overwhelming. New guidance provides a framework for response and recovery.

The Iranian state-backed hacking group tracked as Nimbus Manticore (aka GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been attributed to a fresh set of attacks targeting entities across the Middle East, Africa, and South Asia. The intrusions involve the use of a previously undocumented Windows backdoor called NightLedger and two custom WebSocket tunnelers,

A significant evolution in the CastleLoader malware ecosystem, with new campaigns deploying the NeedleStealer framework to harvest cryptocurrency wallet seed phrases and hijack browser sessions. The findings expand on earlier research by Huntress and LevelBlue, confirming that CastleLoader remains a central delivery mechanism for multi-stage intrusions while introducing new tooling written in Rust and Golang. […]

The post CastleLoader Campaign Deploys NeedleStealer to Steal Crypto Wallet Seeds and Browser Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Нейросети не любят корпорации и не верят в рынок.

Modern AI runs on shared, high-performance infrastructure that processes enormous volumes of sensitive data and valuable model weights.…

JetBrains patched a critical TeamCity flaw (CVE-2026-63077) enabling unauthenticated code execution on affected on-premise servers. JetBrains has released security updates for TeamCity On-Premises after discovering a critical vulnerability, tracked as CVE-2026-63077 (CVSS score of 9.8). The flaw could allow unauthenticated attackers to execute arbitrary commands on affected servers. All on-premise versions are impacted, while TeamCity […]

Чертежи ракет и автомобилей утекли через дыру, которую не закрыли вовремя.

请各位师傅关注系统维护日期，合理安排漏洞提交时间，感谢大家的理解与等待~

关键词漏洞💥 漏洞概述2026年7月27日，奇安信CERT发布紧急安全通告：Fastjson2存在远程代码执

关键词AI💥 事件概述2026年7月27日，美国威胁情报厂商Hunt.io披露了一起针对泰国财政部的网络攻击

Coca Cola claims data was stolen from its Fairlife business after a recent ransomware attack

JetBrains has announced a critical vulnerability in TeamCity On-Premises, identified as CVE-2026-63077. This vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on affected servers. The issue impacts every version of the self-hosted continuous integration and continuous delivery platform, making it urgent for organizations that expose TeamCity instances over HTTP or HTTPS to […]

The post Critical TeamCity Flaw Lets Unauthenticated Attackers Execute System Commands appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.