Google’s Gemini-powered tools tripped up by image-scaling prompt injection Security researchers with Trail of Bits have found that Google Gemini CLI and other production AI systems can be deceived by image scaling attacks, a well-known adversarial challenge for machine learning…
Category: The Register – Security
Congressman proposes bringing back letters of marque for cyber privateers
Bill would let US President commission white hat hackers to go after foreign threats, seize assets on the online seas It’s been more than 200 years since the United States issued a letter of marque allowing privateers to attack the…
Orange Belgium mega-breach exposes 850K customers to serious fraud
Everything a criminal needs for targeted attacks exposed, but telco insists ‘no critical data compromised’ A significant data theft at Orange Belgium has opened hundreds of thousands of its customers to serious cybersecurity risks.… This article has been indexed from…
US cops wrap up RapperBot, one of world’s biggest DDoS-for-hire rackets
Feds say Mirai-spawned botnet blasted 370K attacks before AWS and pals helped yank its servers RapperBot, a botnet-for-hire blamed for hundreds of thousands of DDoS attacks, has been yanked offline by the Feds, who also hauled in its alleged Oregon-based…
Colt changes tune, admits data theft as Warlock gang begins auction
Worried about your data? Not to worry, we’ll check the dark web for you! Yes really A week after its services were disrupted by a cyberattack, UK telco Colt Technology Services has gone back on its initial statement to confirm…
Apple rushes out fix for active zero-day in iOS and macOS
Another ‘extremely sophisticated’ exploit chewing at Cupertino’s walled garden Apple has shipped emergency updates to fix an actively exploited zero-day in its ImageIO framework, warning that the flaw has already been abused in targeted attacks.… This article has been indexed…
Google yet to take down ‘screenshot-grabbing’ Chrome VPN extension
Researcher claims extension didn’t start out by exfiltrating info… while dev says its actions are ‘compliant’ Security boffins at Koi Security have warned of a shift in behavior of a popular Chrome VPN extension, FreeVPN.One, which recently appears to have…
AI crawlers and fetchers are blowing up websites, with Meta and OpenAI the worst offenders
One fetcher bot seen smacking a website with 39,000 requests per minute Cloud services giant Fastly has released a report claiming AI crawlers are putting a heavy load on the open web, slurping up sites at a rate that accounts…
China cut itself off from the global internet for an hour on Wednesday
Took out all traffic to port 443 at a time Beijing didn’t have an obvious need to keep its netizens in the dark China cut itself off from much of the global internet for just over an hour on Wednesday.……
Microsoft stays mum about M365 Copilot on-demand security bypass
Redmond doesn’t bother informing customers about some security fixes Microsoft has chosen not to tell customers about a recently patched vulnerability in M365 Copilot.… This article has been indexed from The Register – Security Read the original article: Microsoft stays…
Amazon quietly fixed Q Developer flaws that made AI agent vulnerable to prompt injection, RCE
Move along, nothing to see here Amazon has quietly fixed a couple of security issues in its coding agent: Amazon Q Developer VS Code extension. Attackers could use these vulns to leak secrets, including API keys from a developer’s machine,…
FBI: Russian spies exploiting a 7-year-old Cisco bug to slurp configs from critical infrastructure
Snarfing up config files for ‘thousands’ of devices…just for giggles, we’re sure The FBI and security researchers today warned that Russian government spies exploited a seven-year-old bug in end-of-life Cisco networking devices to snoop around in American critical infrastructure networks…
Commvault releases patches for two nasty bug chains after exploits proven
Researchers disclosing their findings said ‘it’s as bad as it sounds’ Researchers at watchTowr just published working proof-of-concept exploits for two unauthenticated remote code execution bug chains in backup giant Commvault.… This article has been indexed from The Register –…
‘Limited’ data leak at Aussie telco turns out to be 280K customer details
iiNet breach blamed on single stolen login, with emails, phone numbers, and addresses exposed Aussie telco giant TPG Telecom has opened an investigation after confirming a cyberattack at subsidiary iiNet.… This article has been indexed from The Register – Security…
McDonald’s not lovin’ it when hacker exposes nuggets of rotten security
Burger slinger gets a McRibbing, reacts by firing staffer who helped A white-hat hacker has discovered a series of critical flaws in McDonald’s staff and partner portals that allowed anyone to order free food online, get admin rights to the…
Don’t want drive-by Ollama attackers snooping on your local chats? Patch now
Reconfigure local app settings via a ‘simple’ POST request A now-patched flaw in popular AI model runner Ollama allows drive-by attacks in which a miscreant uses a malicious website to remotely target people’s personal computers, spy on their local chats,…
Like burglars closing a door, Apache ActiveMQ attackers patch critical vuln after breaking in
Intruders hoped no one would notice their presence Criminals exploiting a critical vulnerability in open source Apache ActiveMQ middleware are fixing the flaw that allowed them access, after establishing persistence on Linux servers.… This article has been indexed from The…
Casino tech outfit Bragg cops to intrusion but says data jackpot untouched
Toronto company says weekend cyber raid hit internal IT, not punters’ wallets Canadian casino software slinger Bragg Gaming Group has disclosed a “cybersecurity incident,” though it’s adamant the intruders never got their hands on customer data.… This article has been…
US spy chief claims UK backed down over Apple backdoor demand
Tulsi Gabbard boasts Washington forced Blighty to drop iPhone encryption fight The UK government has reportedly abandoned its attempt to strong-arm Apple into weakening iPhone encryption after the White House forced Blighty into a quiet climb-down.… This article has been…
More customers asking for Google’s Data Boundary, says Cloud Experience boss
Developer demand for sovereign cloud from tech giant is on the rise, says exec Interview Google’s President of Customer Experience, Hayete Gallot, offered some words of comfort to developers who are looking nervously at the rise of AI assistants while…