Experimental News Clipping Site

Tag: exploits

  • CSA: Consent Phishing: Bypassing MFA with OAuth

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.valencesecurity.com/resources/blogs/the-rising-threat-of-consent-phishing-how-oauth-abuse-bypasses-mfa Source: CSA Title: Consent Phishing: Bypassing MFA with OAuth Feedly Summary: AI Summary and Description: Yes Summary: The text discusses the rising threat of consent phishing as a sophisticated attack vector targeting SaaS security, distinct from conventional phishing tactics. By leveraging OAuth 2.0 protocols, attackers can gain persistent access to sensitive resources,…

  • Cisco Security Blog: AI Agent for Color Red

    —

    by

    Kurt Seifried
    in

    Source URL: https://feedpress.me/link/23535/17025967/ai-agent-for-color-red Source: Cisco Security Blog Title: AI Agent for Color Red Feedly Summary: AI can automate the analysis, generation, testing, and reporting of exploits. It’s particularly relevant in penetration testing and ethical hacking scenarios. AI Summary and Description: Yes Summary: The text highlights the role of AI in automating various processes related to…

  • Cisco Talos Blog: Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

    —

    by

    Kurt Seifried
    in

    Source URL: https://blog.talosintelligence.com/spam-campaign-targeting-brazil-abuses-rmm-tools/ Source: Cisco Talos Blog Title: Spam campaign targeting Brazil abuses Remote Monitoring and Management tools Feedly Summary: A new spam campaign is targeting Brazilian users with a clever twist — abusing the free trial period of trusted remote monitoring tools and the country’s electronic invoice system to spread malicious agents. AI Summary…

  • Embrace The Red: Model Context Protocol – New Sneaky Exploit, Risks and Mitigations

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/model-context-protocol-security-risks-and-exploits/ Source: Embrace The Red Title: Model Context Protocol – New Sneaky Exploit, Risks and Mitigations Feedly Summary: The Model Context Protocol (MCP) is a protocol definition for how LLM apps/agents can leverage external tools. I have been calling it Model Control Protocol at times, because due to prompt injection, MCP tool servers…

  • Microsoft Security Blog: Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/05/01/analyzing-cve-2025-31191-a-macos-security-scoped-bookmarks-based-sandbox-escape/ Source: Microsoft Security Blog Title: Analyzing CVE-2025-31191: A macOS security-scoped bookmarks-based sandbox escape Feedly Summary: Microsoft uncovered a vulnerability in macOS that could allow specially crafted codes to escape the App Sandbox and run unrestricted on the system. We shared our findings with Apple and a fix was released for this vulnerability,…

  • The Register: Ex-NSA cyber-boss: AI will soon be a great exploit coder

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/04/30/exnsa_cyber_boss_ai_expoit_dev/ Source: The Register Title: Ex-NSA cyber-boss: AI will soon be a great exploit coder Feedly Summary: For now it’s a potential bug-finder and friend to defenders RSAC Former NSA cyber-boss Rob Joyce thinks today’s artificial intelligence is dangerously close to becoming a top-tier vulnerability exploit developer.… AI Summary and Description: Yes Summary:…

  • Slashdot: AI-Generated Code Creates Major Security Risk Through ‘Package Hallucinations’

    —

    by

    Kurt Seifried
    in

    Source URL: https://developers.slashdot.org/story/25/04/29/1837239/ai-generated-code-creates-major-security-risk-through-package-hallucinations?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: AI-Generated Code Creates Major Security Risk Through ‘Package Hallucinations’ Feedly Summary: AI Summary and Description: Yes Summary: The study highlights a critical vulnerability in AI-generated code, where a significant percentage of generated packages reference non-existent libraries, posing substantial risks for supply-chain attacks. This phenomenon is more prevalent in open…