Experimental News Clipping Site

Tag: threat vector

  • Unit 42: Threat Insights: Active Exploitation of Cisco ASA Zero Days

    —

    by

    Kurt Seifried
    in

    Source URL: https://unit42.paloaltonetworks.com/zero-day-vulnerabilities-affect-cisco-software/ Source: Unit 42 Title: Threat Insights: Active Exploitation of Cisco ASA Zero Days Feedly Summary: CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 affect multiple Cisco products, and are being exploited by a threat actor linked to the ArcaneDoor campaign. The post Threat Insights: Active Exploitation of Cisco ASA Zero Days appeared first on Unit 42.…

  • Unit 42: Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust

    —

    by

    Kurt Seifried
    in

    Source URL: https://unit42.paloaltonetworks.com/model-namespace-reuse/ Source: Unit 42 Title: Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust Feedly Summary: Model namespace reuse is a potential security risk in the AI supply chain. Attackers can misuse platforms like Hugging Face for remote code execution. The post Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model…

  • Slashdot: Coinbase Reverses Remote-First Policy After North Korean Infiltration Attempts

    —

    by

    Kurt Seifried
    in

    Source URL: https://slashdot.org/story/25/08/22/1515238/coinbase-reverses-remote-first-policy-after-north-korean-infiltration-attempts?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Coinbase Reverses Remote-First Policy After North Korean Infiltration Attempts Feedly Summary: AI Summary and Description: Yes Summary: The text highlights the increasing security vulnerabilities associated with remote work policies, particularly in sensitive roles within cryptocurrency firms. It emphasizes the proactive measures taken by Coinbase to mitigate these risks, including…

  • Docker: MCP Horror Stories: The GitHub Prompt Injection Data Heist

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.docker.com/blog/mcp-horror-stories-github-prompt-injection/ Source: Docker Title: MCP Horror Stories: The GitHub Prompt Injection Data Heist Feedly Summary: This is Part 3 of our MCP Horror Stories series, where we examine real-world security incidents that validate the critical vulnerabilities threatening AI infrastructure and demonstrate how Docker MCP Toolkit provides enterprise-grade protection. The Model Context Protocol (MCP)…

  • The Register: Hungry hyperscalers boosted Cisco’s AI sales by a cool billion bucks

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/14/cisco_q4_2025/ Source: The Register Title: Hungry hyperscalers boosted Cisco’s AI sales by a cool billion bucks Feedly Summary: Big Tech is spending vastly more on AI infrastructure but Switchzilla thinks its piece of the pie will be fat and juicy Cisco sold twice as much AI kit as it forecast during its 2025…

  • Embrace The Red: OpenHands and the Lethal Trifecta: Leaking Your Agent’s Secrets

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/openhands-the-lethal-trifecta-strikes-again/ Source: Embrace The Red Title: OpenHands and the Lethal Trifecta: Leaking Your Agent’s Secrets Feedly Summary: Another day, another AI data exfiltration exploit. Today we talk about OpenHands, formerly referred to as OpenDevin initially. It’s created by All-Hands AI. OpenHands renders images in chat, which enables zero-click data exfiltration during prompt injection…

  • Embrace The Red: How Devin AI Can Leak Your Secrets Via Multiple Means

    —

    by

    Kurt Seifried
    in

    Source URL: https://embracethered.com/blog/posts/2025/devin-can-leak-your-secrets/ Source: Embrace The Red Title: How Devin AI Can Leak Your Secrets Via Multiple Means Feedly Summary: In this post we show how an attacker can make Devin send sensitive information to third-party servers, via multiple means. This post assumes that you read the first post about Devin as well. But here…

  • Microsoft Security Blog: Transparency on Microsoft Defender for Office 365 email security effectiveness

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.microsoft.com/en-us/security/blog/2025/07/17/transparency-on-microsoft-defender-for-office-365-email-security-effectiveness/ Source: Microsoft Security Blog Title: Transparency on Microsoft Defender for Office 365 email security effectiveness Feedly Summary: Microsoft believes in transparently sharing performance data from Microsoft Defender for Office 365, and other ecosystem providers, to help customers evaluate email security solutions and make decisions to layer for defense in depth. The post…

  • Cisco Security Blog: Universal ZTNA from Cisco Earns Coveted SE Labs AAA Rating

    —

    by

    Kurt Seifried
    in

    Source URL: https://blogs.cisco.com/security/universal-ztna-from-cisco-earns-coveted-se-labs-aaa-rating Source: Cisco Security Blog Title: Universal ZTNA from Cisco Earns Coveted SE Labs AAA Rating Feedly Summary: Combining the power of Duo’s Identity Management and Cisco’s Secure Access and Identity Intelligence protects against stolen credentials and phishing attacks. AI Summary and Description: Yes Summary: The text highlights a collaboration between Duo’s Identity…