Aggregator

c0c0n CTF 2025 Writeup

不安全
4 months 2 weeks ago
团队在C0C0N CTF中后期加入，在24小时内迅速应对API漏洞、DNS隧道等挑战，最终获得第20名。通过分析日志和流量捕获，发现攻击者利用路径遍历获取数据库凭证，并通过DNS隧道传输加密数据。最终提取出解密密钥并成功破解。

Delinea releases free open-source MCP server to secure AI agents

Help Net Security
4 months 2 weeks ago

AI agents are becoming more common in the workplace, but giving them access to sensitive systems can be risky. Credentials often get stored in plain text, added to prompts, or passed around without proper oversight. Delinea wants to fix that problem with its new open source Model Context Protocol (MCP) Server. How the Delinea MCP Server works The MCP Server connects AI agents to the Delinea Platform, allowing them to securely retrieve and use credentials. … More →

The post Delinea releases free open-source MCP server to secure AI agents appeared first on Help Net Security.

Sinisa Markovic

ZDI-CAN-27394: IceWarp

ZDI: Upcoming Advisories
4 months 2 weeks ago
A CVSS score 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Oscar Bataille' was reported to the affected vendor on: 2025-09-26, 75 days ago. The vendor is given until 2026-01-24 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

New Phishing Attack Targeting PyPI Maintainers to Steal Login Credentials

Cyber Security News
4 months 2 weeks ago

A sophisticated phishing campaign has emerged targeting maintainers of packages on the Python Package Index (PyPI), employing domain confusion tactics to steal authentication credentials from unsuspecting developers. The attack leverages fraudulent emails designed to mimic official PyPI communications, directing recipients to malicious domains that closely resemble the legitimate PyPI infrastructure. The phishing operation utilizes carefully […]

The post New Phishing Attack Targeting PyPI Maintainers to Steal Login Credentials appeared first on Cyber Security News.

Tushar Subhra Dutta

How agentic AI is changing the SOC

Help Net Security
4 months 2 weeks ago

In this Help Net Security video, David Norlin, CTO of Lumifi, explores the role of agentic AI in the security operations center (SOC). He explains what agentic AI is, how it can enhance cybersecurity workflows by automating repetitive tasks, and why accountability and careful implementation are critical. Norlin also discusses the importance of context, guardrails, and human oversight to ensure these powerful tools are used safely. Learn more: AI agents are here, now comes the … More →

The post How agentic AI is changing the SOC appeared first on Help Net Security.

Help Net Security

CHAOS

Dark Feed IO
4 months 2 weeks ago

You must login to view this content

cohenido

CVE-2025-10136 | TweetThis Shortcode Plugin up to 1.8.0 on WordPress tweetthis cross site scripting

VulDB Recent Entries
4 months 2 weeks ago
A vulnerability has been found in TweetThis Shortcode Plugin up to 1.8.0 on WordPress and classified as problematic. Affected is the function tweetthis of the component Shortcode Handler. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2025-10136. The attack can be initiated remotely. There is not any exploit available.
vuldb.com

CVE-2025-10180 | Markdown Shortcode Plugin up to 0.2.1 on WordPress markdown cross site scripting

VulDB Recent Entries
4 months 2 weeks ago
A vulnerability, which was classified as problematic, was found in Markdown Shortcode Plugin up to 0.2.1 on WordPress. This impacts the function markdown of the component Shortcode Handler. The manipulation results in cross site scripting. This vulnerability is known as CVE-2025-10180. It is possible to launch the attack remotely. No exploit is available.
vuldb.com

CVE-2025-10490 | Dylan James Zephyr Project Manager Plugin up to 3.3.202 on WordPress cross site scripting

VulDB Recent Entries
4 months 2 weeks ago
A vulnerability, which was classified as problematic, has been found in Dylan James Zephyr Project Manager Plugin up to 3.3.202 on WordPress. This affects an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2025-10490. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com

Managed ad