Information security
fromTechzine Global
12 hours agoIs 46% of your AI-generated code vulnerable?
46% of AI-generated code contains security vulnerabilities, necessitating integrated governance throughout the software delivery lifecycle.
#xss-vulnerabilities
#xss-vulnerabilities
[ follow ]
#cybersecurity #remote-code-execution #vulnerabilities #malware #supply-chain-attack #axios #security #npm #ai #nodejs
fromSecurityWeek
7 hours agoApple Intelligence AI Guardrails Bypassed in New Attack
The first is Neural Execs, a known prompt injection attack that uses 'gibberish' inputs to trick the AI into executing arbitrary, attacker-defined tasks. These inputs act as universal triggers that do not need to be remade for different payloads.
Apple
#cybersecurity
Information security
fromSilicon Canals
2 days agoOne maintainer, one compromised laptop: How North Korean hackers hijacked the Axios open source project - Silicon Canals
North Korean hackers compromised the Axios HTTP library by socially engineering its maintainer, publishing malicious versions that exposed sensitive data.
Web development
fromTheregister
3 weeks agoBrilliant backups landed web developer in big trouble
A website migration oversight caused a two-year disconnect where office staff viewed outdated content due to hardcoded DNS settings, while the client only discovered the issue when accessing the site from the office.
Web development
fromMozilla Hacks - the Web developer blog
1 month agoGoodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 - Mozilla Hacks - the Web developer blog
Firefox 148 introduces the standardized Sanitizer API, enabling developers to safely remove malicious HTML and JavaScript from user-generated content before inserting it into the DOM.
fromDevOps.com
3 days agoIs Your AI Agent Secure? The DevOps Case for Adversarial QA Testing - DevOps.com
The most dangerous assumption in quality engineering right now is that you can validate an autonomous testing agent the same way you validated a deterministic application. When your systems can reason, adapt, and make decisions on their own, that linear validation model collapses.
Information security
Information security
fromSilicon Canals
3 days agoA single maintainer, a fake company, and a three-hour window: inside the Axios supply chain hijack - Silicon Canals
A single maintainer's vulnerability led to a significant security breach in a widely used JavaScript library, exposing thousands of systems to potential credential theft.
Information security
fromThe Hacker News
3 weeks agoAI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
Amazon Bedrock AgentCore Code Interpreter's sandbox allows outbound DNS queries, enabling attackers to exfiltrate data and establish command-and-control channels despite network isolation configuration.
Information security
fromSecurityWeek
4 weeks agoPolyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea
The 2024 Polyfill.io supply chain attack affecting over 100,000 websites involved both Chinese and North Korean threat actors, with Funnull serving as a corporate front for the operation.
#n8n-vulnerabilities
Information security
fromSecurityWeek
4 weeks agoCritical N8n Vulnerabilities Allowed Server Takeover
Two critical vulnerabilities in n8n allowed unauthenticated remote code execution and sandbox escape, potentially exposing all stored credentials including AWS keys, passwords, OAuth tokens, and API keys.
Information security
fromThe Hacker News
4 weeks agoCritical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
Two critical vulnerabilities in n8n workflow automation platform enable arbitrary command execution through sandbox escape and unauthenticated expression evaluation, affecting both self-hosted and cloud deployments.
Information security
fromThe Hacker News
1 month agoWeb Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure
Chinese threat actor CL-UNK-1068 conducted years-long cyber espionage campaign targeting high-value organizations across aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors in South, Southeast, and East Asia.
fromCSS-Tricks
1 month agoAn Exploit ... in CSS?! | CSS-Tricks
Google credits security researcher Shaheen Fazim with reporting the exploit to Google. The dude's LinkedIn says he's a professional bug hunter, and I'd say he deserves the highest possible bug bounty for finding something that a government agency is saying "in CSS in Google Chrome before 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page."
Information security
fromBleepingComputer
1 month agoFake Next.js job interview tests backdoor developer's devices
The Microsoft Defender team says that the attacker created fake web app projects built with Next.js and disguised them as coding projects to share with developers during job interviews or technical assessments. The researchers initially identified a repository hosted on the Bitbucket cloud-based Git-based code hosting and collaboration service. However, they discovered multiple repositories that shared code structure, loader logic, and naming patterns.
Information security
Information security
fromDroids On Roids
2 months agoWhen ZeroWidth Isn't Zero: How I Found and Fixed a Vulnerability | Blog
Unicode Variation Selectors can inflate UTF-16 storage size while still passing perceived-length checks, enabling payload injection, performance issues, and possible database crashes.
Information security
fromThe Hacker News
2 months agoThree Flaws in Anthropic MCP Git Server Enable File Access and Code Execution
Three mcp-server-git vulnerabilities enable prompt-injection attackers to read or delete arbitrary files, execute code, and manipulate repositories unless updated to fixed versions.
fromThe NodeSource Blog - Node.js Tutorials, Guides, and Updates
2 months agoCVE, CVSS, and the Mistake Most Teams Keep Making
A CVE (Common Vulnerabilities and Exposures) is a unique identifier for a publicly disclosed security vulnerability in a specific product, version, or component. A CVE: Identifies that a vulnerability exists Provides a stable reference ID (for example, CVE-2023-45143) Links to descriptions, technical details, and references Does not describe abstract weaknesses or attack classes CVEs are cataloged by MITRE and assigned by authorized CVE Numbering Authorities (CNAs), which include vendors, open-source projects, and security organizations.
Information security
[ Load more ]