Aggregator

HHS Shifts 42 CFR Enforcement Duties to Office of Civil Rights Amid Massive Reorg
The U.S. Department of Health and Human Services has put its Office for Civil Rights in charge of investigating and penalizing organizations that breach the confidentiality of substance abuse disorder records. Some fear the agency doesn't have the bandwidth to enforce both HIPAA and 42 CFR Part 2.

Class Action Litigation Accused Mt. Sinai of Sending Patient Info to Facebook
A New York City healthcare system has agreed to pay nearly $5.3 million to settle a proposed class action lawsuit alleging that the hospital's use of online tracking tools in its patient portal and website sent patient information to Facebook without their knowledge or consent for years.

Deal Ends Suit Alleging Microsoft's Message Encryption Tool Violated Virtru Patents
After three years of litigation, Virtru and Microsoft have settled a patent infringement case involving the tech giant’s email encryption product. The suit claimed Microsoft's technology infringed Virtru’s patented identity-driven encryption method for seamless, credential-free data access.

XML-Based Messaging Tech Extends Fraud Detection Into Wider Bank Use Cases
ACI's signals network intelligence harnesses neural networks and federated machine learning to spot fraud in real time without banks sharing data. Beyond fraud detection, its insights can drive business growth from other business units, and ACI aims to accelerate adoption by making it open source.

静默之控：主动与被动双模后门MystRodX的隐匿渗透 by ourren

探索深度学习模型中的固有后门 by ourren

Jeddak AgentArmor 智能体安全框架（为 AI Agent 行为立规矩） by ourren

内存马原理分析与检测技术 by ourren

AiPy 结合 IDA Pro 尝试软件破解 by ourren

我对“AI赋能科学发现”的一些看法 by ourren

智能算法安全的内涵、实践与思考 by ourren

2025中国网络安全十大创新方向 by ourren

SecWiki周刊（第599期) by ourren

更多最新文章，请访问SecWiki

Researchers from the Counter Threat Unit (CTU) at Sophos uncovered a sophisticated intrusion where threat actors repurposed the legitimate open-source Velociraptor digital forensics and incident response (DFIR) tool to establish unauthorized remote access within targeted networks. Velociraptor, designed for endpoint visibility and forensic analysis, was deployed maliciously to download and execute Visual Studio Code, facilitating […]

The post Threat Actors Exploit Velociraptor Incident Response Tool for Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

While ransomware gangs traditionally rely on deploying malware to encrypt files, a threat actor’s recent tactics show they no longer need to do that during attacks.

MathWorks, Inc., the developer of the popular MATLAB and Simulink software, confirmed today that it was the target of a significant cyberattack, resulting in the theft of sensitive personal information belonging to an undisclosed number of users. In a notice sent to affected individuals, the company disclosed that it discovered a security incident on May […]

The post MathWorks Confirms Cyberattack, User Personal Information Stolen appeared first on Cyber Security News.

A vulnerability described as critical has been identified in spimsimulator spim up to 9.1.24. Impacted is the function READ_SYSCALL/WRITE_SYSCALL of the component System Call Handler. Such manipulation leads to buffer overflow. This vulnerability is listed as CVE-2025-29364. The attack must be carried out from within the local network. There is no available exploit.

A vulnerability marked as critical has been reported in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. This vulnerability is tracked as CVE-2025-9610. The attack is possible to be carried out remotely. Moreover, an exploit is present. Other parameters might be affected as well.

A vulnerability labeled as critical has been found in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /educacenso/consulta. The manipulation results in improper authorization. This vulnerability is identified as CVE-2025-9609. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability identified as critical has been detected in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/FormulaMedia/view of the component Formula de Cálculo de Média Page. The manipulation of the argument ID leads to sql injection. This vulnerability is referenced as CVE-2025-9608. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability categorized as critical has been discovered in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/TabelaArredondamento/view of the component Tabelas de Arredondamento Page. Executing manipulation of the argument ID can lead to sql injection. The identification of this vulnerability is CVE-2025-9607. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Portabilis i-Educar up to 2.10. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing manipulation of the argument cod_agenda results in sql injection. This vulnerability was named CVE-2025-9606. The attack may be initiated remotely. In addition, an exploit is available.

Submit #636622 / VDB-321788

A supply chain attack called “s1ngularity” on Nx versions 20.9.0-21.8.0 stole thousands of developer credentials. The attack targeted…

Submit #636580 / VDB-321787

Submit #636579 / VDB-321786

Submit #636578 / VDB-321785

Submit #636577 / VDB-321784