Tag: access
-
Zero-Day Vulnerabilities in Cisco and Citrix Targeted by APT Group, Amazon Confirms
Amazon’s threat intelligence division has revealed a cyber-espionage campaign involving an advanced persistent threat (APT) group exploiting previously undisclosed zero-day vulnerabilities in systems from Cisco and Citrix. The investigation showed that the attackers specifically targeted critical identity and network access control infrastructure; components of enterprises rely on managing authentication and enforcing security policies across their networks. First…
-
Zero-Day Vulnerabilities in Cisco and Citrix Targeted by APT Group, Amazon Confirms
Amazon’s threat intelligence division has revealed a cyber-espionage campaign involving an advanced persistent threat (APT) group exploiting previously undisclosed zero-day vulnerabilities in systems from Cisco and Citrix. The investigation showed that the attackers specifically targeted critical identity and network access control infrastructure; components of enterprises rely on managing authentication and enforcing security policies across their networks. First…
-
Critical Dell Data Lakehouse Flaw Allows Remote Attackers to Escalate Privileges
Dell Technologies has disclosed a critical security vulnerability affecting its Data Lakehouse platform that could allow attackers with high-level privileges to escalate their access and compromise system integrity. The flaw, tracked as CVE-2025-46608, carries a maximum CVSS severity score of 9.1, indicating an exceptionally high risk to affected environments. CVE ID Product Affected Versions Remediated…
-
Beware of Fake Bitcoin Tools Concealing DarkComet RAT Malware
A newly discovered malware campaign is leveraging one of cybercriminals’ most effective lures cryptocurrency to distribute DarkComet RAT. This notorious remote access trojan continues to plague users despite being discontinued by its creator years ago. Security researchers have identified a suspicious executable masquerading as a Bitcoin wallet application, which, when executed, silently deploys the full…
-
Citrix NetScaler ADC and Gateway Flaw Allows Cross-Site Scripting (XSS) Attacks
Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler Gateway platforms. The flaw, tracked as CVE-2025-12101, poses a moderate security risk to organizations relying on these network appliances for authentication and secure access services. Field Value CVE ID CVE-2025-12101 Vulnerability Type Cross-Site Scripting (XSS) CWE Classification CWE-79: Improper Neutralization…
-
Citrix NetScaler ADC and Gateway Flaw Allows Cross-Site Scripting (XSS) Attacks
Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler Gateway platforms. The flaw, tracked as CVE-2025-12101, poses a moderate security risk to organizations relying on these network appliances for authentication and secure access services. Field Value CVE ID CVE-2025-12101 Vulnerability Type Cross-Site Scripting (XSS) CWE Classification CWE-79: Improper Neutralization…
-
Automation can’t fix broken security basics
Most enterprises continue to fall short on basic practices such as patching, access control, and vendor oversight, according to Swimlane’s Cracks in the Foundation: Why … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/13/swimlane-security-basics-still-broken-report/
-
‘CitrixBleed 2’ Wreaks Havoc as Zero-Day Bug
The same APT hammered critical bugs in Citrix NetScaler (CVE-2025-5777) and the Cisco Identity Service Engine (CVE-2025-20337) in a sign of growing adversary interest in identity and access management systems. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/citrixbleed-2-cisco-zero-day-bugs
-
Amazon pins Cisco, Citrix zero-day attacks to APT group
The vendors disclosed and patched the defects last summer, but not before advanced attackers exploited the vulnerabilities to likely gain prolonged access for espionage, according to Amazon. First seen on cyberscoop.com Jump to article: cyberscoop.com/amazon-threat-intel-apt-group-cisco-citrix-zero-days/
-
Amazon pins Cisco, Citrix zero-day attacks to APT group
The vendors disclosed and patched the defects last summer, but not before advanced attackers exploited the vulnerabilities to likely gain prolonged access for espionage, according to Amazon. First seen on cyberscoop.com Jump to article: cyberscoop.com/amazon-threat-intel-apt-group-cisco-citrix-zero-days/
-
Wie ChatGPT sich selbst eine Prompt Injection zufügt
Forscher haben neue Methoden für Angriffe über ChatGPT aufgedeckt.Forscher des Sicherheitsunternehmens Tenable haben sieben neue Möglichkeiten entdeckt, wie Angreifer ChatGPT dazu bringen können, private Informationen aus den Chat-Verläufen der Nutzer preiszugeben. Bei den meisten dieser Angriffe handelt es sich um indirekte Prompt Injections, die die Standard-Tools und -funktionen von ChatGPT ausnutzen. Etwa die Fähigkeit, den…
-
Amazon rolls out AI bug bounty program
Select researchers and academic teams will get access to Amazon’s NOVA models next year as the tech giant continues to integrate the AI tools into its own tech stack. First seen on cyberscoop.com Jump to article: cyberscoop.com/amazon-bug-bounty-program-ai-nova/
-
Amazon rolls out AI bug bounty program
Select researchers and academic teams will get access to Amazon’s NOVA models next year as the tech giant continues to integrate the AI tools into its own tech stack. First seen on cyberscoop.com Jump to article: cyberscoop.com/amazon-bug-bounty-program-ai-nova/
-
Hackers abuse Triofox antivirus feature to deploy remote access tools
Hackers exploited a critical vulnerability and the built-in antivirus feature in Gladinet’s Triofox file-sharing and remote-access platform to achieve remote code execution with SYSTEM privileges. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-abuse-triofox-antivirus-feature-to-deploy-remote-access-tools/
-
How Defence Contractors Are Fortifying Security Camera Networks For High-Stakes Live Events
In an era where security threats, hacks, and even assisination attempts at major political events have become an urgent concern, Active Security has taken a fundamentally different approach to protecting large, stadium-level gatherings: building high-fidelity camera networks where compromising one device doesn’t give attackers access to everything else. These networks are designed to integrate seamlessly…
-
Prompt Injection in AI Browsers
This is why AIs are not ready to be personal assistants: A new attack called ‘CometJacking’ exploits URL parameters to pass to Perplexity’s Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In a realistic scenario, no credentials or user interaction are required and a threat…
-
Prompt Injection in AI Browsers
This is why AIs are not ready to be personal assistants: A new attack called ‘CometJacking’ exploits URL parameters to pass to Perplexity’s Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In a realistic scenario, no credentials or user interaction are required and a threat…
-
Prompt Injection in AI Browsers
This is why AIs are not ready to be personal assistants: A new attack called ‘CometJacking’ exploits URL parameters to pass to Perplexity’s Comet AI browser hidden instructions that allow access to sensitive data from connected services, like email and calendar. In a realistic scenario, no credentials or user interaction are required and a threat…
-
OWASP Top 10: Broken access control still tops app security list
Risk list highlights misconfigs, supply chain failures, and singles out prompt injection in AI apps First seen on theregister.com Jump to article: www.theregister.com/2025/11/11/new_owasp_top_ten_broken/
-
OWASP Top 10: Broken access control still tops app security list
Risk list highlights misconfigs, supply chain failures, and singles out prompt injection in AI apps First seen on theregister.com Jump to article: www.theregister.com/2025/11/11/new_owasp_top_ten_broken/
-
Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480)
Attackers have exploited a now-fixed vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform while it was still a zero-day, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/11/gladinet-triofox-vulnerability-cve-2025-12480/
-
Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480)
Attackers have exploited a now-fixed vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform while it was still a zero-day, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/11/gladinet-triofox-vulnerability-cve-2025-12480/
-
Attackers exploited another Gladinet Triofox zero-day (CVE-2025-12480)
Attackers have exploited a now-fixed vulnerability (CVE-2025-12480) in the Gladinet Triofox secure file sharing and remote access platform while it was still a zero-day, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/11/gladinet-triofox-vulnerability-cve-2025-12480/
-
New “KomeX” Android RAT Hits Hacker Forums with Tiered Subscriptions
A sophisticated Android remote-access trojan named KomeX RAT has emerged on underground hacking forums, with the threat actor Gendirector actively marketing the malware through tiered subscription models. The malware, built on the foundation of previously documented BTMOB, poses a significant threat to Android device owners due to its extensive capabilities and aggressive advertising campaign within…