Experimental News Clipping Site

Tag: injection

  • Simon Willison’s Weblog: Grok 3 is highly vulnerable to indirect prompt injection

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Feb/23/grok-3-indirect-prompt-injection/#atom-everything Source: Simon Willison’s Weblog Title: Grok 3 is highly vulnerable to indirect prompt injection Feedly Summary: Grok 3 is highly vulnerable to indirect prompt injection xAI’s new Grok 3 is so far exclusively deployed on Twitter (aka “X"), and apparently uses its ability to search for relevant tweets as part of every…

  • Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/02/20/cisa-adds-two-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-23209 Craft CMS Code Injection Vulnerability CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability These types of vulnerabilities are frequent attack vectors for malicious…

  • The Register: Critical flaws in Mongoose library expose MongoDB to data thieves, code execution

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/02/20/mongoose_flaws_mongodb/ Source: The Register Title: Critical flaws in Mongoose library expose MongoDB to data thieves, code execution Feedly Summary: Bugs fixed, updating to the latest version is advisable Security sleuths found two critical vulnerabilities in a third-party library that MongoDB relies on, which means bad guys can potentially steal data and run code.……

  • The Register: Critical PostgreSQL bug tied to zero-day attack on US Treasury

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/02/14/postgresql_bug_treasury/ Source: The Register Title: Critical PostgreSQL bug tied to zero-day attack on US Treasury Feedly Summary: High-complexity bug unearthed by infoseccers, as Rapid7 probes exploit further A high-severity SQL injection bug in the PostgreSQL interactive tool was exploited alongside the zero-day used to break into the US Treasury in December, researchers say.……

  • Microsoft Security Blog: Securing DeepSeek and other AI systems with Microsoft Security

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/02/13/securing-deepseek-and-other-ai-systems-with-microsoft-security/ Source: Microsoft Security Blog Title: Securing DeepSeek and other AI systems with Microsoft Security Feedly Summary: Microsoft Security provides cyberthreat protection, posture management, data security, compliance and governance, and AI safety, to secure AI applications that you build and use. These capabilities can also be used to secure and govern AI apps…

  • Alerts: CISA Adds Two Known Exploited Vulnerabilities to Catalog

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.cisa.gov/news-events/alerts/2025/02/12/cisa-adds-two-known-exploited-vulnerabilities-catalog Source: Alerts Title: CISA Adds Two Known Exploited Vulnerabilities to Catalog Feedly Summary: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability These types of vulnerabilities are frequent attack vectors for…

  • Hacker News: Syd: An Introduction to Secure Application Sandboxing for Linux [video]

    —

    by

    Kurt Seifried
    in

    Source URL: https://fosdem.org/2025/schedule/event/fosdem-2025-4176-syd-an-introduction-to-secure-application-sandboxing-for-linux/ Source: Hacker News Title: Syd: An Introduction to Secure Application Sandboxing for Linux Feedly Summary: Comments AI Summary and Description: Yes Summary: The text introduces Syd, a GPL-3 licensed application kernel for Linux, designed for securing applications through advanced sandboxing techniques. Its modern architecture and features address critical vulnerabilities and enhance security…

  • Slashdot: New Hack Uses Prompt Injection To Corrupt Gemini’s Long-Term Memory

    —

    by

    Kurt Seifried
    in

    Source URL: https://it.slashdot.org/story/25/02/12/0011205/new-hack-uses-prompt-injection-to-corrupt-geminis-long-term-memory?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: New Hack Uses Prompt Injection To Corrupt Gemini’s Long-Term Memory Feedly Summary: AI Summary and Description: Yes Summary: The text discusses a newly demonstrated attack by researcher Johann Rehberger that compromises Google’s Gemini chatbot by manipulating its long-term memory functionality through untrusted document summarization. The attack bypasses existing prompt…