Project Ire promises to use LLMs to detect whether code is malicious or benign Microsoft has rolled out an autonomous AI agent that it claims can detect malware without human assistance.… This article has been indexed from The Register –…
Category: The Register – Security
Google says the group behind last year’s Snowflake attack slurped data from one of its Salesforce instances
ShinyHunters suspected in rash of intrusions Google confirmed that criminals breached one of its Salesforce databases and stole info belonging to some of its small-and-medium-business customers.… This article has been indexed from The Register – Security Read the original article:…
Vibe coding tool Cursor’s MCP implementation allows persistent code execution
More evidence that AI expands the attack surface Check Point researchers uncovered a remote code execution bug in popular vibe-coding AI tool Cursor that could allow an attacker to poison developer environments by secretly modifying a previously approved Model Context…
Patch now: Millions of Dell PCs with Broadcom chips vulnerable to attack
Psst, wanna steal someone’s biometrics? black hat Critical security flaws in Broadcom chips used in more than 100 models of Dell computers could allow attackers to take over tens of millions of users’ devices, steal passwords, and access sensitive data,…
Study finds humans not completely useless at malware detection
Some pinpointed software nasties but were suspicious of printer drivers too Researchers from the Universities of Guelph and Waterloo have discovered exactly how users decide whether an application is legitimate or malware before installing it – and the good news…
Chained bugs in Nvidia’s Triton Inference Server lead to full system compromise
Wiz Research details flaws in Python backend that expose AI models and enable remote code execution Security researchers have lifted the lid on a chain of high-severity vulnerabilities that could lead to remote code execution (RCE) on Nvidia’s Triton Inference…
Hacker summer camp: What to expect from BSides, Black Hat, and DEF CON
These are the conference events to keep an eye on. You can even stream a few The security industry is hitting Vegas hard this week with three conferences in Sin City that bring the world’s largest collection of security pros…
Antivirus vendors fail to spot persistent, nasty, stealthy Linux backdoor
‘Plague’ malware has been around for months without tripping alarms Researchers at German infosec services company Nextron Threat have spotted malware that creates a highly-persistent Linux backdoor and say antivirus engines do not flag the code as malicious.… This article…
SonicWall investigates ‘cyber incidents,’ including ransomware targeting suspected 0-day
Bypassing MFA and deploying ransomware…sounds like something that rhymes with ‘schmero-day’ SonicWall on Monday confirmed that it’s investigating a rash of ransomware activity targeting its firewall devices, following multiple reports of a zero-day bug under active exploit in its VPNs.……
Python-powered malware snags hundreds of credit cards, 200K passwords, and 4M cookies
PXA Stealer pilfers data from nearly 40 browsers, including Chrome More than 4,000 victims across 62 countries have been infected by stealthy infostealers pilfering people’s passwords, credit card numbers, and browser cookies, which are then sold to other criminals on…
Mozilla flags phishing wave aimed at hijacking trusted Firefox add-ons
Devs told to exercise ‘extreme caution’ with emails disguised as account update prompts Mozilla is warning of an ongoing phishing campaign targeting developers of Firefox add-ons.… This article has been indexed from The Register – Security Read the original article:…
German phone repair biz collapses following 2023 ransomware attack
Founder miffed over prosecutors holding onto its Bitcoin The founder of a German mobile phone repair and insurance biz has begun insolvency proceedings for some operations in his company after struggling financially following a costly ransomware attack in 2023.… This…
When hyperscalers can’t safeguard one nation’s data from another, dark clouds are ahead
If it’s not on-prem, it’s on the menu Opinion The details of cloud data regionalization are rarely the stuff of great drama. When they’ve reached the level of an exe admitting to the Senate that a foreign power can help…
Millions of age checks performed as UK Online Safey Act gets rolling
But its ok claims Brit government, no personal data stored ‘unless absolutely necessary’ The UK government has reported that an additional five million age checks are being made daily as UK-based internet users seek to access age-restricted sites following the…
China’s botched Great Firewall upgrade invites attacks on its censorship infrastructure
Attempts to censor QUIC traffic create chance to block access to offshore DNS resolvers China’s attempts to censor traffic carried using Quick UDP Internet Connections (QUIC) are imperfect and have left the country at risk of attacks that degrade its…
Lazarus Group rises again, this time with malware-laden fake FOSS
PLUS: Slow MFA rollout costs Canucks $5m; Lawmakers ponder Stingray ban; MSFT tightens Teams; And more! Infosec In Brief North Korea’s Lazarus Group has changed tactics and is now creating malware-laden open source software.… This article has been indexed from…
Silent Push CEO on cybercrime takedowns: ‘It’s an ongoing cat-and-mouse game’
Plus: why takedowns aren’t in threat-intel analysts’ best interest interview It started out small: One US financial services company wanted to stop unknown crooks from spoofing their trading app, tricking customers into giving the digital thieves their login credentials and…
CISA roasts unnamed critical national infrastructure body for shoddy security hygiene
Plaintext passwords, shared admin accounts, and insufficient logging rampant at mystery org CISA is using the findings from a recent probe of an unidentified critical infrastructure organization to warn about the dangers of getting cybersecurity seriously wrong.… This article has…
OpenAI removes ChatGPT self-doxing option
Checkbox to make chatbot conversations appear in search engines deemed a footgun OpenAI has removed the option to make ChatGPT interactions indexable by search engines to prevent users from unwittingly exposing sensitive information.… This article has been indexed from The…
Tested: Microsoft Recall can still capture credit cards and passwords, a treasure trove for crooks
Our tests have shown there are ways to get around the promised security improvements exclusive Microsoft Recall, the AI app that takes screenshots of what you do on your PC so you can search for it later, has a filter…