Category: EN

US Tops Hit List as 396 SharePoint Systems Compromised Globally

A total of 396 compromised Microsoft SharePoint systems have been identified globally, affecting 145 organizations across 41 countries in the wake of the ToolShell zero-day vulnerability This article has been indexed from www.infosecurity-magazine.com Read the original article: US Tops Hit…

Cobalt Strike Beacon delivered via GitHub and social media

A campaign targeting Russian entities leveraged social media, Microsoft Learn Challenge, Quora, and GitHub as intermediate C2 servers to deliver Cobalt Strike Beacon. This article has been indexed from Securelist Read the original article: Cobalt Strike Beacon delivered via GitHub…

Social Engineering on the Rise — New Unit 42 Report

How cybercriminals and nation-state actors are leveraging sophisticated social engineering techniques to attack global organizations at scale. The post Social Engineering on the Rise — New Unit 42 Report appeared first on Palo Alto Networks Blog. This article has been…

Tonic Security Launches With $7 Million in Seed Funding

Tonic Security has emerged from stealth mode to tackle the complexity of exposure and vulnerability management. The post Tonic Security Launches With $7 Million in Seed Funding appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the…

Skild AI Shows General-Purpose Robot ‘Brain’

Pittsburgh-based start-up Skild shows general-purpose AI model that enables robots to carry out range of tasks in homes or factories This article has been indexed from Silicon UK Read the original article: Skild AI Shows General-Purpose Robot ‘Brain’

Opera Antitrust Complaint Targets Microsoft, Edge

Opera calls for Microsoft to end allegedly anticompetitive practices tying Edge browser to Windows in latest challenge to Windows maker This article has been indexed from Silicon UK Read the original article: Opera Antitrust Complaint Targets Microsoft, Edge

Cadence To Pay $140m In Settlement Over China Exports

Cadence pleads guilty and pays $140.5m to US authorities to settle charges it sold chip-design tools to sanctioned Chinese university This article has been indexed from Silicon UK Read the original article: Cadence To Pay $140m In Settlement Over China…

Free Decryptor Released for AI-Powered FunkSec Ransomware

Researchers at Avast have unveiled a free decryptor tool for victims of the FunkSec ransomware, marking a significant step in combating this now-defunct malware strain. Developed in collaboration with law-enforcement agencies, the decryptor enables affected users to recover encrypted files…

Hackers Target SAP NetWeaver to Deploy New Auto-Color Linux Malware

Cybersecurity researchers at Darktrace have uncovered a sophisticated attack targeting a US-based chemicals company, marking the first observed instance of threat actors exploiting SAP NetWeaver vulnerabilities to deploy Auto-Color backdoor malware. The incident, which occurred over three days in April…

Enterprise LLMs Under Risk: How Simple Prompts Can Lead to Major Breaches

Enterprise applications integrating Large Language Models (LLMs) face unprecedented security vulnerabilities that can be exploited through deceptively simple prompt injection attacks.  Recent security assessments reveal that attackers can bypass authentication systems, extract sensitive data, and execute unauthorized commands using nothing…

OWASP Launches Agentic AI Security Guidance

The comprehensive guidance focuses on technical recommendations for securing agentic AI applications, from development to deployment This article has been indexed from www.infosecurity-magazine.com Read the original article: OWASP Launches Agentic AI Security Guidance

Google Brings AI-Powered Search Mode To UK

Google rolls out AI chatbot-powered searches in UK as publishers and other online groups accuse it of destroying their business models This article has been indexed from Silicon UK Read the original article: Google Brings AI-Powered Search Mode To UK

Enterprise LLMs Vulnerable to Prompt-Based Attacks Leading to Data Breaches

Security researchers have discovered alarming vulnerabilities in enterprise Large Language Model (LLM) applications that could allow attackers to bypass authentication systems and access sensitive corporate data through sophisticated prompt injection techniques. The findings reveal that many organizations deploying AI-powered chatbots…

Artemis: Open-source modular vulnerability scanner

Artemis is an open-source modular vulnerability scanner that checks different aspects of a website’s security and translates the results into easy-to-understand messages that can be shared with the organizations being scanned. “The most important feature of the tool is report…

Orange Hit by Cyberattack, Internal Systems Hacked

French telecommunications giant Orange confirmed it suffered a significant cyberattack on Friday, July 25th, targeting one of its critical information systems. The incident has disrupted services for business customers and some consumer services, primarily affecting operations in France as the…

Why CISOs should rethink identity risk through attack paths

Identity-based attack paths are behind most breaches today, yet many organizations can’t actually see how those paths form. The 2025 State of Attack Path Management report from SpecterOps makes the case that traditional tools like identity governance, PAM, and MFA…

The food supply chain has a cybersecurity problem

It’s unsettling to think that our food supply chain could be targeted or that the safety of our food could be compromised. But this is exactly the challenge the agri-food sector is dealing with right now. Despite agriculture’s importance, cybersecurity…

Dropbox Passwords to shut down in 2025

Users of the cloud file storage service Dropbox have access to several related tools. One of those, Dropbox Passwords, is being shut down later this year. Dropbox introduced Passwords back in June […] Thank you for being a Ghacks reader.…

Boards shift focus to tech and navigate cautious investors

Corporate boards are adjusting to a more uncertain proxy landscape, according to EY’s 2025 Proxy Season Review. The report highlights four key 2025 proxy season trends shaping governance this year: more oversight of technology, fewer shareholder proposals (especially on sustainability),…

AI is here, security still isn’t

Although 79% of organizations are already running AI in production, only 6% have put in place a comprehensive security strategy designed specifically for AI. As a result, most enterprises remain exposed to threats they are not yet prepared to detect…

How Microsoft defends against indirect prompt injection attacks

Summary The growing adoption of large language models (LLMs) in enterprise workflows has introduced a new class of adversarial techniques: indirect prompt injection. Indirect prompt injection can be used against systems that leverage large language models (LLMs) to process untrusted…

CISA Releases Five Industrial Control Systems Advisories

CISA released five Industrial Control Systems (ICS) advisories on July 29, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-158-04 Johnson Controls Software House iStar Pro Door Controller (Update A) ICSA-24-338-06 Fuji Electric…

Orange reports major cyberattack, warns of service disruptions

Orange, France’s largest telecom provider, reported a cyberattack on one of its internal systems, impacting its operations in Europe and Africa. Orange is a leading French multinational telecommunications operator providing services to individuals, businesses, and governments across Europe, Africa, and…

Apple Updates Everything: July 2025, (Tue, Jul 29th)

Apple today released updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS. This is a feature release, but it includes significant security updates. Apple patches a total of 29 different vulnerabilities. None of these vulnerabilities has been identified as exploited. …

Samsung HVAC DMS

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.5 ATTENTION: Exploitable remotely Vendor: Samsung Equipment: HVAC DMS Vulnerabilities: Execution After Redirect (EAR), Deserialization of Untrusted Data, Absolute Path Traversal, Use of Potentially Dangerous Function, Improper Limitation of a Pathname to a…

National Instruments LabVIEW

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: National Instruments Equipment: LabVIEW Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to…

Delta Electronics DTN Soft

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION: Low attack complexity Vendor: Delta Electronics Equipment: DTN Soft Vulnerability: Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use a specially crafted…

What Amazon Q prompt injection reveals about AI security

<p>It was an attack scenario that has played out in code repositories, particularly open source repositories, for years — a credentials leak allowed an attacker to publish a malicious command.</p> <div class=”ad-wrapper ad-embedded”> <div id=”halfpage” class=”ad ad-hp”> <script>GPT.display(‘halfpage’)</script> </div> <div…