The Hacker News Expert Insights

A nonprofit in California is doing what Hugging Face has not—attempting to hold OpenAI legally accountable for the actions of its agents. GitLab fixes critical AI Gateway flaw that could let authenticated Duo users escape a prompt sandbox and execute commands on self-hosted gateways. Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide.

Attackers can create, adapt, and launch attacks faster than before. For the past decade, cybersecurity has been built on assuming the breach. Human-written code has always contained vulnerabilities…. That acceleration creates an important challenge for security teams.

• Apple has announced that it’s taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents.
• The control most organizations still treat as the finish line does not touch it.
• Before AI can help you work smarter, it needs access to your information.
• The rules of the program , called the Open Source Software Vulnerability Reward Program (OSS VRP), now carry a notice of the stop.
• A suspected member of the ShinyHunters digital extortion group, who goes by the online alias “Rey,” has been allegedly detained by authorities in Jordan, Reuters reported , citing three people familiar with the matter.
• Unlike deterministic scripts, which produce fixed outcomes given the same input, we use agents because they can take a loosely defined objective and determine the steps themselves.

Teams now need to check if those controls still work, what risks remain as things change, and who is responsible if risks go beyond what the organization can accept. They email something from a personal account, then upload a file to a cloud drive, then plug in a USB stick two weeks later. Find SANS training for app sec and cloud teams who inherited GenAI risk, from RAG pipelines to AI agents. The Windows maker said an authenticated attacker can exploit this flaw to gain unauthorized access to other users’ mailboxes within the same organization and read email messages and attachments. A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, security researchers have shown.

• Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide.
• The announcement comes after Trump hosted top executives of AI companies at the White House last week.
• Most security teams know that dwell time matters.
• AI is changing software development by compressing work that once took days into hours.
• Users of affected on-premises Microsoft Exchange Server products are a…

Defense Cyber Spending Set to Surge Amid Rising Attacks on Military Systems

Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. Thus, when the victim is prompted to paste and execute a malicious command – as is the case with ClickFix attacks – it executes the cached website content that’s already on the device. A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser’s cache. Its account comes from the notification it received from the register a day earlier. Any instance reachable from the public internet, including one that requires a login, should be restricted from … Atlassian advises customers who cannot upgrade all at once to take the instance offline if possible.

Google called the stop temporary in a post on X on October 1 and said it was due to “a significant rise in automated submissions, the vast majority of which are not valid.” The post gave no figures. Reports about supply chain compromises are still accepted, and reports filed before October 1 are not affected. See which agent permissions security teams aren’t reviewing, and why it matters now.

When AI Writes the Code, Who Owns the Security Decisions?

AI-assisted research uncovered a critical Rejetto HFS flaw that enables authentication bypass and remote code execution, now exploited in the wild. I have a decent idea what the next eleven days look like inside most of those companies, having spent close to thirty years watching software organizations get ready for a date on a calendar. The real problem is that tools such as Claude Code, OpenAI Codex, Claude Cowork, and GitHub Copilot are becoming extensible agent runtimes. Dwell time is the period between an attacker gaining access and the security team containing the threat.

The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. To that end, Wikimedia said it identified edits to Wikimedia wikis suspected to be from agents operated by OpenAI. The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. So far, it has only been shown as a proof of concept, and there are no reports of its use in real attacks.

Insider risk used to be the line item nobody fought for in the security budget. AI comes in through web and desktop applications, browser extensions, developer environments, … Frontier AI can speed up vulnerability discovery and shorten the time to exploitation.

AI coding agents are already inside engineering organizations. During that window, a threat actor has time to learn the environment, steal credentials, move between systems, and reach sensitive data. An agent can read context, choose tools, query systems, revise its plan, and take a path nobody explicitly programmed.

The web application root directory is the folder on the server that holds the web application itself. Neither the post nor the notice gives a date for accepting p… It https://alcitynews.com/financial-revolution-of-2024-how-octobank-strengthened-its-position-in-uzbekistan-and-beyond.html commits Google to an update in the first quarter of 2027 while it reworks this part of the program.

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. Once the setting is enabled for an application, it allows that program to bypass certain security restrictions and read and writ… — Software production is accelerating beyond the growth assumptions that shaped many of today’s security controls. This is how humans, systems, and now AI, all connect to data, services, and each other securely. ⚡ Threat of the Week Citrix Warns of Newly Exploited NetScaler ADC and Gateway Flaw — Citrix released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited https://event-miami24.com/unlocking-business-potential-through-data-management.html as part of targeted zero-day attacks. This week’s threats keep finding leverage in small things that were easy to overlook.

How to Evaluate a Unified Security Platform Using a One-Incident Test

Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Every week, the best security articles from Security Affairs are free in your email box. A new round of the weekly Security Affairs newsletter has arrived! A suspected https://homeimprovemtpro.com/electronic-access-control-in-stuttgart-buhler-schlussels-cutting-edge-solutions/ member of ShinyHunters, the group that claims to … A suspected ShinyHunters member arrested in Jordan is reportedly cooperating with the FBI, helping investigators track down the group.