Experimental News Clipping Site

Tag: responsible disclosure

  • Hacker News: Next.js and the corrupt middleware: the authorizing artifact

    —

    by

    Kurt Seifried
    in

    Source URL: https://zhero-web-sec.github.io/research-and-things/nextjs-and-the-corrupt-middleware Source: Hacker News Title: Next.js and the corrupt middleware: the authorizing artifact Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses a critical security vulnerability discovered in Next.js, a widely used JavaScript framework, specifically regarding its middleware functionality. The vulnerability allows unauthorized access by manipulating request headers, which could…

  • Hacker News: ‘Uber for nurses’ exposes 86K+ medical records, PII via open S3 bucket

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.websiteplanet.com/news/eshyft-report-breach/ Source: Hacker News Title: ‘Uber for nurses’ exposes 86K+ medical records, PII via open S3 bucket Feedly Summary: Comments AI Summary and Description: Yes Summary: The text discusses a significant cybersecurity incident involving the exposure of a non-password-protected database belonging to ESHYFT, a healthtech company. The incident raises critical issues about privacy…

  • Hacker News: ESP32 Undocumented Bluetooth Commands: Clearing the Air

    —

    by

    Kurt Seifried
    in

    Source URL: https://developer.espressif.com/blog/2025/03/esp32-bluetooth-clearing-the-air/ Source: Hacker News Title: ESP32 Undocumented Bluetooth Commands: Clearing the Air Feedly Summary: Comments AI Summary and Description: Yes Summary: The text addresses security concerns related to undocumented HCI commands in the ESP32 Bluetooth controller, dismissing claims of a backdoor while outlining the nature of these commands and their implications for security.…

  • Embrace The Red: Hacking Gemini’s Memory with Prompt Injection and Delayed Tool Invocation

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/ Source: Embrace The Red Title: Hacking Gemini’s Memory with Prompt Injection and Delayed Tool Invocation Feedly Summary: Imagine your AI rewriting your personal history… A while ago Google added memories to Gemini. Memories allow Gemini to store user-related data across sessions, storing information in long-term memory. The feature is only available to…

  • Hacker News: Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak Source: Hacker News Title: Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History Feedly Summary: Comments AI Summary and Description: Yes **Summary:** The text discusses a critical security vulnerability identified in DeepSeek’s publicly accessible ClickHouse database, which exposed sensitive information related to AI operations. Wiz Research’s responsible disclosure of an unprotected database…

  • Hacker News: Mastercard DNS Error Went Unnoticed for Years

    —

    by

    Kurt Seifried
    in

    Source URL: https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/ Source: Hacker News Title: Mastercard DNS Error Went Unnoticed for Years Feedly Summary: Comments AI Summary and Description: Yes Summary: The incident involving MasterCard’s DNS misconfiguration underscores the critical importance of accurate DNS management as a security measure in the financial sector. The flaw, which existed for nearly five years, highlights potential…

  • METR updates – METR: AI models can be dangerous before public deployment

    —

    by

    Kurt Seifried
    in

    Source URL: https://metr.org/blog/2025-01-17-ai-models-dangerous-before-public-deployment/ Source: METR updates – METR Title: AI models can be dangerous before public deployment Feedly Summary: AI Summary and Description: Yes **Short Summary with Insight:** This text provides a critical perspective on the safety measures surrounding the deployment of powerful AI systems, emphasizing that traditional pre-deployment testing is insufficient due to the…

  • Embrace The Red: AI Domination: Remote Controlling ChatGPT ZombAI Instances

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/spaiware-and-chatgpt-command-and-control-via-prompt-injection-zombai/ Source: Embrace The Red Title: AI Domination: Remote Controlling ChatGPT ZombAI Instances Feedly Summary: At Black Hat Europe I did a fun presentation titled SpAIware and More: Advanced Prompt Injection Exploits. Without diving into the details of the entire talk, the key point I was making is that prompt injection can impact…