Tag: unauthorized access
-
The Register: Microsoft, CISA warn yet another Exchange server bug can lead to ‘total domain compromise’
Source URL: https://www.theregister.com/2025/08/07/microsoft_cisa_warn_yet_another/ Source: The Register Title: Microsoft, CISA warn yet another Exchange server bug can lead to ‘total domain compromise’ Feedly Summary: No reported in-the-wild exploits…yet Microsoft and the feds late Wednesday sounded the alarm on another high-severity bug in Exchange Server hybrid deployments that could allow attackers to escalate privileges from on-premises Exchange…
-
Unit 42: When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory
Source URL: https://unit42.paloaltonetworks.com/badsuccessor-attack-vector/ Source: Unit 42 Title: When Good Accounts Go Bad: Exploiting Delegated Managed Service Accounts in Active Directory Feedly Summary: BadSuccessor is an attack vector in Windows Server 2025. Under certain conditions it allows privilege elevation via dMSAs. We analyze its mechanics. The post When Good Accounts Go Bad: Exploiting Delegated Managed Service…
-
The Register: Patch now: Millions of Dell PCs with Broadcom chips vulnerable to attack
Source URL: https://www.theregister.com/2025/08/05/millions_of_dell_pc_with/ Source: The Register Title: Patch now: Millions of Dell PCs with Broadcom chips vulnerable to attack Feedly Summary: Psst, wanna steal someone’s biometrics? black hat Critical security flaws in Broadcom chips used in more than 100 models of Dell computers could allow attackers to take over tens of millions of users’ devices,…
-
Simon Willison’s Weblog: Quoting @himbodhisattva
Source URL: https://simonwillison.net/2025/Aug/4/himbodhisattva/#atom-everything Source: Simon Willison’s Weblog Title: Quoting @himbodhisattva Feedly Summary: for services that wrap GPT-3, is it possible to do the equivalent of sql injection? like, a prompt-injection attack? make it think it’s completed the task and then get access to the generation, and ask it to repeat the original instruction? — @himbodhisattva,…
-
The Register: Mozilla flags phishing wave aimed at hijacking trusted Firefox add-ons
Source URL: https://www.theregister.com/2025/08/04/mozilla_add_on_phishing/ Source: The Register Title: Mozilla flags phishing wave aimed at hijacking trusted Firefox add-ons Feedly Summary: Devs told to exercise ‘extreme caution’ with emails disguised as account update prompts Mozilla is warning of an ongoing phishing campaign targeting developers of Firefox add-ons.… AI Summary and Description: Yes Summary: Mozilla has issued a…
-
The Register: CISA roasts unnamed critical national infrastructure body for shoddy security hygiene
Source URL: https://www.theregister.com/2025/08/02/cisa_coast_guard_cni/ Source: The Register Title: CISA roasts unnamed critical national infrastructure body for shoddy security hygiene Feedly Summary: Plaintext passwords, shared admin accounts, and insufficient logging rampant at mystery org CISA is using the findings from a recent probe of an unidentified critical infrastructure organization to warn about the dangers of getting cybersecurity…
-
The Register: China says US spies exploited Microsoft Exchange zero-day to steal military info
Source URL: https://www.theregister.com/2025/08/01/china_us_intel_attacks/ Source: The Register Title: China says US spies exploited Microsoft Exchange zero-day to steal military info Feedly Summary: Spy vs. spy China has accused US intelligence agencies of exploiting a Microsoft Exchange zero-day exploit to steal defense-related data and take over more than 50 devices belonging to a “major Chinese military enterprise"…
-
The Cloudflare Blog: Vulnerability disclosure on SSL for SaaS v1 (Managed CNAME)
Source URL: https://blog.cloudflare.com/vulnerability-disclosure-on-ssl-for-saas-v1-managed-cname/ Source: The Cloudflare Blog Title: Vulnerability disclosure on SSL for SaaS v1 (Managed CNAME) Feedly Summary: An upcoming vulnerability disclosure in Cloudflare’s SSL for SaaSv1 is detailed, explaining the steps we’ve taken towards deprecation. AI Summary and Description: Yes Summary: The text discusses a vulnerability discovered in Cloudflare’s SSL for SaaS v1…
-
Scott Logic: Automated permissions testing with AWS IAM Policy Simulator
Source URL: https://blog.scottlogic.com/2025/08/01/automated-iam-policy-simulator-testing.html Source: Scott Logic Title: Automated permissions testing with AWS IAM Policy Simulator Feedly Summary: A quick guide to implementing a test framework for IAM permissions using the AWS IAM Policy Simulator API and a tiny hack. AI Summary and Description: Yes Summary: The provided text extensively discusses a workaround for using AWS…
-
Slashdot: In Search of Riches, Hackers Plant 4G-Enabled Raspberry Pi In Bank Network
Source URL: https://it.slashdot.org/story/25/07/31/2241259/in-search-of-riches-hackers-plant-4g-enabled-raspberry-pi-in-bank-network?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: In Search of Riches, Hackers Plant 4G-Enabled Raspberry Pi In Bank Network Feedly Summary: AI Summary and Description: Yes Summary: The text highlights a sophisticated cyber-physical attack by the group UNC2891, which involved planting a 4G-enabled Raspberry Pi within a bank’s ATM network. Utilizing advanced malware and techniques for…