Aggregator

城市供排水SCADA安全建设指南

Attackers used Hermes, an autonomous open source tool, in unrestricted "YOLO mode" to conduct espionage against Thailand's Ministry of Finance.

四个问题先放在前面：两条链分别需要什么条件，本地复现和流量看到了什么，企业先做什么，威胁检索从哪里开始查。

谷歌 CEO 称正在训练 Gemini 4，据过往节奏推测有望于今年年底发布； OpenAI CEO 奥尔特曼：人类已经进入了「奇点」时代； Claude 对话分享链接意外被谷歌收录，用户隐私聊天内容曝光；

Hackers are actively exploiting a vulnerability in the FastJson open-source Java library, allowing remote code execution without user interaction or elevated privileges. [...]

Wondershare Media.io brings AI story writing, character creation, storyboards, and video generation into one workflow for faster, simpler content creation work.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks. [...]

It includes the new agentic model MAI-Cyber-1-Flash and the Project Perception platform, with the tech giant claiming it’ll do a better job than its rivals at half the cost.

The post Microsoft debuts AI cybersecurity offerings as competition heats up appeared first on CyberScoop.

In a Monday filing, the Justice Department said states sued before agencies even decided how the order would work.

The post Trump asks Supreme Court to let him curtail mail-in voting ahead of midterms appeared first on CyberScoop.

Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement. Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face […]

PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests.

A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. [...]

A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially compromise a Windows domain. [...]

This category of vulnerabilities allows an attacker to easily acquire administrative level permissions and bypass cloud providers' access controls.

Certighost allowed a low-privilege domain user obtain a valid Domain Controller certificate through AD CS. Microsoft patched the issue in the July security updates.

Intelligence Committee member Ron Wyden wants CISA, OMB and NIST to lead a federal effort to rout out obsolete VPNs from the U.S. government.

An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time.