Langflow offers a visual programming tool for building LLM-powered workflows using LangChain components. An unauthenticated RCE vulnerability where Langflow's /api/v1/validate/code endpoint, which is designed to validate user-submitted code, runs any code with no sandboxing or sanitization. CISA has now reported that this vulnerability is being actively exploited and has given federal agencies until May 26 to upgrade the software or add mitigations such as placing the software behind a firewall.
Threat actors have been observed exploiting a new vulnerability in the OttoKit WordPress plugin. The vulnerability could allow unauthenticated attackers to connect to impacted sites that have never enabled or used an application password due to a lack of proper authentication checks in the create_wp_connection() function. Attackers have been observed attempting to exploit the vulnerability to create an admin user account through the automation/action endpoint.
Unsophisticated hackers are increasingly targeting industrial control systems in the energy and transportation sectors. Federal agencies recommend removing internet connections, changing default passwords, securing remote access, segmenting networks, and maintaining manual operation capabilities to protect critical infrastructure.
IAM role trust policies are the best-practice foundation for cross-account access. However, many users misunderstand the security implications associated with them. When creating role trust policies, users should keep in mind the risk of lateral movement in both their account and the account that they're trusting and therefore be aware that other principals could potentially use the role then those specified in the policy and could potentially gain access to other roles that the policy is not applied to. Many users also mistake the security importance of the management/payer account and allow trust policies to flow between less secure and more secure accounts within an organization.
The OrgSec Guide structures essential topics for effectively running a successful security program. It includes a compilation of resources, checklists, and addresses in DevSecOps, endpoint and product security, GRC, IAM, infrastructure, operational and cloud security, security operations, and AI.
This guide explains how to use Osquery to detect container escape vulnerabilities in real-time by monitoring suspicious system calls and container activities. It presents three practical SQL queries that can be scheduled to run at 30-second intervals to detect namespace pivots, CVE-2024-21626 style escapes, and containers attempting to access the host kernel or metadata services. The guide also covers deployment steps, performance tuning tips, and integration options with logging platforms like Uptycs, Fleet, Splunk, and Loki.
AppSignal can identify abnormal behavior that could signal vulnerabilities and misconfigurations while enabling developers to identify performance issues and errors.
Touti Cracker is a cross-platform educational tool that demonstrates ethical password recovery through brute-force techniques. It offers a fun, neon-styled UI with powerful features like Hashcat automation, registry backup, and password list generation.
Even with MFA, seasoned professionals like Troy Hunt can still be victims of phishing attacks. In this article, Hunt demonstrates how to set up passkeys on various sites for either an authentication method or an MFA factor, depending on the site's support. Hunt also demonstrates how to store passkeys in either 1Password or a Yubikey to make them available on other devices.
The widely used easyjson Golang JSON deserialization library is owned, maintained, and controlled by the VK Group. Russian state-owned entities control the VK Group, and it has leadership that is subject to US and EU sanctions. There is high potential for exploitation as the package is widely used in CNCF projects such as Helm, Istio, and Kubernetes.
Europol has dismantled six DDoS-for-hire services used for thousands of cyberattacks globally. The platforms (cfxapi, cfxsecurity, neostress, jetstress, quickdown, and zapcut) offered user-friendly interfaces for launching attacks for as little as €10.
The UK launched the voluntary Software Security Code of Practice to establish cyber security baselines for technology vendors with 14 baseline principles on SBOMs, patching, default MFA, and more.
PowerSchool warns that a hacker from a previous cyberattack is extorting schools for ransom, threatening to release stolen student and teacher data if not paid.
The LockBit ransomware gang's dark web panels were hacked, exposing sensitive data like negotiation messages, plaintext passwords, and bitcoin addresses.
Qwiet AI's Multi-AI Agent Approach revolutionizes application security by using multiple AI agents to provide enhanced code security and significantly improve efficiency between security and developer
Malware has backdoored at least 500 e-commerce sites by compromising three software providers (Tigren, Magesolution, and Meetanshi) that supply Magento-based extensions. The dormant malware, active after six years, executes malicious code in visitors' browsers to steal payment information and personal data.
The Solana Foundation recently patched a zero-day bug in Solana that could have allowed an attacker to mint unlimited Token-22 confidential tokens or steal them from other users. The vulnerability was due to some algebraic components of the ZK ElGamal Proof Program not being included in the hash used to generate a transcript for the Fiat-Shamir Transformation. Solana worked with several security partners to verify the fix and found no evidence of exploitation.
‘Venom Spider' is a threat actor that has been running a spear-phishing campaign targeting recruiters and hiring managers. Targets are sent an email containing a zip file supposedly containing the attacker's application materials. The zip file contains a JPG distractor and uses a .lnk file to download an obfuscated BAT file loader, which ultimately downloads a dropper called More_eggs.
Snowflake's CORTEX Search Service may expose sensitive data despite security policies. The post navigates how this AI-driven search tool could inadvertently reveal protected information to authorized users, illustrating a broader concern with AI integration in business tools.
In this interview with John Kindervag, creator of the Zero Trust security model in 2009, he talks about himself as a hacker and professional penetration tester in the early 2000s. Now Chief Evangelist at Illumio since 2023, he promotes Zero Trust Segmentation, challenging traditional definitions of what constitutes a "hacker.
ClickFix is a sneaky malware that tricks users into triggering attacks through innocent-looking prompts like CAPTCHAs. It evades detection by staying dormant until a real user interacts with it, making it hard for traditional security tools to spot. To catch ClickFix, interactive sandboxes effectively reveal hidden behavior and protect businesses from potential threats.
Black Duck addresses the strategic risks of AI-generated code with True Scale Application Security [11]. As a seven-year leader in the Gartner Magic Quadrant leader for Application Security Testing, Black Duck is the only choice for securing mission-critical software everywhere code happens. Discover how Black Duck delivers True Scale
NetFoundry provides microsegmented overlay networks that hide assets behind closed inbound firewall ports and identity, authentication, and authorization at the application level.
The trust-minimized, zero-knowledge bridging protocol is designed for censorship resistance, extremely high security, and usage in decentralized finance.
There's a common belief that paying a ransom may be effective in getting operations up and running quickly in the event of a ransomware attack. Organizations that have paid ransoms, such as Travelex, have sometimes faced broken or slow decryptors and other issues that led to recovery taking months. Additionally, paying ransoms encourages and funds further cybercrime activity.
An engineer at ListenLabs.AI created an AI-driven PowerPoint slide generator by reverse engineering Microsoft's detailed Office Open XML format. This project addressed technical challenges like custom solutions for image borders and colored links, enabling the automatic generation of well-structured presentation decks from user interview data. It highlights the potential of AI in simplifying document creation and the possible security implications of proprietary file formats.
A federal jury awarded WhatsApp $168 million in damages from NSO Group for infecting users with spyware. The ruling is a win for WhatsApp's lawsuit against the spyware maker. NSO Group plans to explore legal options following the verdict.
Disney experienced cyberattacks from a former employee and an external hacker in 2024 that led to the theft of 1.1TB of sensitive data and sabotage of its internal systems.
Cybersecurity researchers have identified two threat actors behind investment scams that used fake celebrity endorsements and deceptive web forms to collect user data on social media platforms like Facebook - Reckless Rabbit and Ruthless Rabbit.
Microsoft's newly unveiled AI agents for Windows are expected to allow users to easily change computer settings using natural language prompts without much direct involvement.
Kelly Benefits experienced a data breach where hackers accessed systems from December 12-17, 2024, exposing personal information, including names, SSNs, and financial data. Initially affecting 264,000 people, the number has grown to 413,032. The company is notifying impacted individuals across multiple client organizations, with investigations ongoing.
404 Media revealed that TeleMessage, the modified version of Signal that national security adviser Michael Walz was using, has been hacked. The hacker obtained plaintext conversations showing that the app is not end-to-end encrypted. The hacker says they did not obtain Walz's conversations and that it only took 15-20 minutes to hack the app.
Anonymous hacked the website of GlobalX, the airline used by the Trump administration for controversial deportations. The hackers criticized Trump's actions and leaked confidential flight information. GlobalX has not commented on the hack, which comes after Anonymous leaked Russian government data earlier this month.
The Square team built an adaptive security layer on OPA for their Kubernetes clusters. Kube-Policies was designed to allow for a phased rollout process, minimal user disruption, support a robust testing framework, allow for extensibility and exceptions, and be observable. This post dives into the strategies used to accomplish each goal, such as using kind for testing and warning HTTP Headers for phased rollouts.
In Windows systems, PID 0 is a special process called the System Idle Process, which contains threads that execute when no other thread is ready to run on a given processor. The author of this post found that they could swap the pointer inside any _KPRCB to run code in PID 0 via the nt!PpmIdleSelectStates function. Hooking into PID 0 is advantageous as traditional detection APIs and lookups will fail and the execution does not require any system calls.
Doppel provides digital risk protection through continuous monitoring, rapid detection, and seamless takedowns across traditional channels like web domains, social media platforms, and the dark web, as well as emerging channels such as Telegram and crypto.
The "Matrix" project is a meticulously crafted and entirely self-managed DNS Firewall utilising Response Policy Zones (RPZ). Its primary objective is to safeguard your privacy by obstructing access to malicious domains and tracking servers, thereby providing a secure online environment.
Ireland's data regulator fined TikTok €530 million for illegally transferring European user data to China and for lacking transparency. TikTok breached EU privacy laws by failing to protect data from Chinese surveillance laws. The company plans to appeal the decision.
Apple sent out notifications to an undisclosed number of individuals it believes were targeted by government spyware campaigns. An Italian journalist and a Dutch right-wing activist both shared that they received the notification, which mentioned that the notification was sent to users in 100 different countries.
The White House plans to cut $491 million from the CISA budget, claiming the agency focused too much on censorship instead of cyber defense. The proposed budget cut aims to refocus CISA on its core mission and eliminate redundant programs. Department of Homeland Security Secretary Kristi Noem emphasized the need for CISA to prioritize hands-on cyber defense support for critical systems.
Apple is enhancing online safety for children by introducing new parental controls that allow parents to share their children's ages with app developers and simplify account setup.