Aggregator

RSAC 2025 创新沙盒 TOP10

AI 写文案、深度伪造语音、锁定你最熟悉的品牌与同事——2025 年的网络钓鱼，比你想象得更“懂人性”。IBM 报告显示，钓鱼已成全球第二大数据泄露元凶，人均损失 476 万美元。问题不在技术，而在于人的注意力与情绪，被黑客精准利用。

根据正在进行中的 Google 反垄断诉讼披露的内部数据，截至今年 3 月 Google 的 AI 聊天机器人 Gemini 全球有 3.5 亿月活跃用户。Gemini 去年 10 月的日活用户仅为 900 万，但今年 3 月已经增加到了 3500 万。根据法庭文件，Google 估计 ChatGPT 的月活用户为 6 亿。ChatGPT 是目前最受欢迎的 AI 聊天机器人。

Our excessive reliance on technology has disabled us from crossing the barriers to experience, sense, and relate with others the way we used to. 

The post The Human Advantage in the Age of Technological Uncertainties appeared first on Security Boulevard.

在玩家中非常受欢迎的社交服务 Discord 准备 IPO，但尚未宣布，它现在任命了一位新 CEO，表明它正朝着上市的目标继续推进。CEO 兼联合创始人 Jason Citron 辞职，但仍然会留在董事会，新 CEO 为前动视暴雪和 King 的高管 Humam Sakhnini。Citron 去年透露 Discord 有 870 名员工和逾 2 亿月活用户。Discord 的另一位联合创始人 Stanislav Vishnevskiy 将继续担 CTO。

A vulnerability classified as critical was found in B&R Industrial Automation Scene Viewer, Automation Runtime, mapp Vision, mapp View, mapp Cockpit, mapp Safety and VC4. Affected by this vulnerability is an unknown functionality of the component Files Handler. The manipulation leads to uncontrolled search path. This vulnerability is known as CVE-2024-2637. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Ivanti EPM up to 2022 SU5/2024. This vulnerability affects unknown code. The manipulation leads to sql injection. This vulnerability was named CVE-2024-32839. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Ivanti EPM up to 2022 SU5/2024. This issue affects some unknown processing. The manipulation leads to sql injection. The identification of this vulnerability is CVE-2024-32841. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Ivanti EPM up to 2022 SU5/2024. Affected is an unknown function. The manipulation leads to sql injection. This vulnerability is traded as CVE-2024-32844. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Moodle and classified as problematic. Affected by this issue is some unknown functionality of the component H5P Error Message Handler. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-43439. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/admin/saveroutine.php. The manipulation of the argument rname leads to sql injection. This vulnerability is traded as CVE-2025-0881. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Ivanti Endpoint Manager up to 2022 SU5/2024 and classified as very critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identification of this vulnerability is CVE-2024-50330. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

Blue Shield of California has disclosed a significant data breach affecting 4.7 million members, representing the majority of its nearly 6 million customers.  The health insurance provider revealed that protected health information (PHI) was inadvertently shared with Google’s advertising platforms over a nearly three-year period due to a misconfiguration of Google Analytics on the company’s […]

The post Blue Shield Leaked Health Info of 4.7M patients with Google Ads appeared first on Cyber Security News.

SonicWall has issued an urgent advisory (SNWLID-2025-0009) warning of a high-severity vulnerability in its SSLVPN Virtual Office interface that enables unauthenticated attackers to remotely crash firewalls, causing widespread network disruptions. Tracked as CVE-2025-32818, this flaw carries a CVSS v3 score of 7.5 and affects dozens of firewall models across its Gen7 and TZ80 product lines. The […]

The post SonicWall SSLVPN Flaw Allows Hackers to Crash Firewalls Remotely appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Edgescan 2025 Vulnerability Statistics Report offers a data-rich snapshot of the global cybersecurity landscape, drawing from thousands of assessments and penetration tests conducted in 2024. Now in its 10th year, the report analyzes full-stack security trends across industries, highlighting common vulnerabilities, patching delays, and risk hotspots. With insights into exploit availability, attack surface exposure, and remediation timelines, it equips organizations with the data they need to make smarter, risk-based decisions. The report highlights a … More →

The post Exposed and unaware: The state of enterprise security in 2025 appeared first on Help Net Security.

在新冠疫情爆发五年后，Google 开始强迫部分远程工作员工必须回办公室工作否则他们将面临被解雇。根据内部文件，Google 多个部门通知远程工作的员工必须前往最近的办公室，要求每周必须去办公室至少三天，否则他们的职位可能面临裁减风险。截至去年底 Google 有 18.3 万员工，而两年前这一数字是 19 万。Google 联合创始人 Sergey Brin 此前在内部备忘录中表示，从事 AI 工作的员工每周必须都去办公室工作，每周工作 60 小时最佳。Google 发言人 Courtenay Mencini 表示由公司各个团队决定远程办公员工回办公室工作的要求，这不是整个公司的政策。他表示面对面的协作有助于创新和解决复杂问题。

In a previous article of JPCERT/CC Eyes, we reported on SPAWNCHIMERA malware, which infects the target after exploiting the vulnerability in Ivanti Connect Secure. However, this is not the only malware observed in recent attacks. This time, we focus on...