Aggregator

智能船舶的网络安全风险已从潜在隐患演变为现实威胁。

Leaked Executive Order Would Strip States of Power to Regulate AI Tech Firms
A leaked draft executive order would empower federal agencies to override state AI laws, threatening federal funds for noncompliance and creating a litigation task force - drawing sharp backlash over executive overreach and potential harm to consumers.

Class Action Litigation and Criminal Case Focus on Actions of an Ex-Tech Worker
A federal court has granted preliminary approval of a $5 million settlement in class action litigation filed against Pennsylvania-based Geisinger Health and Nuance Communications - now part of Microsoft - involving a 2023 insider data breach affecting more than 1 million Geisinger patients.

European Cybersecurity Agency Can Assign CVE IDs and Publish CVE Records
The European Union Agency for Cybersecurity is poised to take on a greater role in coordinating vulnerability disclosures across the trading bloc with its elevation as a "Root"-level participant in the Common Vulnerabilities and Exposures program.

Salesforce Revoked Gainsight Authentication Tokens
Customer relationship management giant Salesforce is again notifying customers that hackers may be stealing their data through a third-party app. The San Francisco company late Wednesday disclosed that apps published by Gainsight connected to Salesforce instances may have "enabled unauthorized access."

Google has unexpectedly done what many had already given up hoping for: Android and AirDrop can now, at

The post Google Cracks AirDrop: Pixel 10 Enables Seamless File Sharing with iPhone appeared first on Penetration Testing Tools.

Microsoft has introduced a practical new feature in Windows 11 designed specifically for public-facing monitors and signage. This new mode ensures that the dreaded Blue Screen of Death (BSOD) and other disruptive error dialogs are hidden from view on non-interactive displays. Whether the machine is powering a digital restaurant menu, an airport flight schedule, or […]

The post Windows 11 to Hide BSOD Crash Errors on Public Displays appeared first on Cyber Security News.

Первые ласточки Next-Gen?

Even mature engineering teams often treat threat modeling as an optional exercise, relying instead on VAPT or other post-development assessments with the assumption that “we’ll fix issues later.” But this approach is risky and reactive. Threat modeling is fundamentally proactive: it compels teams to analyze data flows, trust boundaries, attack surfaces, and potential adversary actions […]

The post Skipping Threat Modeling? You’re Risking a Breach You Can’t Recover From appeared first on Kratikal Blogs.

The post Skipping Threat Modeling? You’re Risking a Breach You Can’t Recover From appeared first on Security Boulevard.

Вирус записывает касания, читает интерфейс, управляет экраном и создает идеальный профиль устройства для точечных атак.

New StorybyRenal KhabibulinbyRenal Khabibulin@renalkSoftware engineer, ex-Airbnb, ex-ThumbtackNovem

Onapsis introduced a series of new updates to its Onapsis Control product line, advancing security capabilities across SAP and cloud ERP application development environments. These enhancements include integration with SAP Continuous Integration and Delivery (CI/CD), expanded Git repository support to secure more code at rest, and strengthened workflow integration with SAP Transport Management System (TMS). Onapsis also expanded support for SAP Web Dispatcher and SAP Cloud Connector within the Onapsis Assess and Onapsis Defend product … More →

The post New Onapsis platform updates enhance visibility and protection across SAP landscapes appeared first on Help Net Security.

A vulnerability was found in Revive Adserver 5.5.2/6.0.1. It has been rated as critical. This vulnerability affects unknown code of the component Email Address Handler. Performing manipulation results in improper access controls. This vulnerability is cataloged as CVE-2025-48986. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability was found in Ilevia EVE X1 Server up to 6.00 2025_07_21. It has been declared as critical. Impacted is an unknown function of the file ping.php. Executing manipulation can lead to command injection. This vulnerability is tracked as CVE-2025-60738. The attack can be launched remotely. No exploit exists.

A vulnerability identified as problematic has been detected in SOPlanning up to 1.53. Affected by this vulnerability is an unknown functionality of the file /status endpoint. Performing manipulation results in missing authorization. This vulnerability is cataloged as CVE-2025-62293. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability marked as critical has been reported in ThinkPHP 5.0.24. Impacted is the function read of the file thinkphp\library\think\template\driver\File.php. This manipulation causes command injection. This vulnerability is registered as CVE-2025-63888. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability described as problematic has been identified in Lite XL up to 2.1.8. This issue affects some unknown processing of the component Project File Handler. Executing manipulation can lead to privilege escalation. This vulnerability is registered as CVE-2025-12120. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

A vulnerability classified as critical has been found in Lite XL up to 2.1.8. Impacted is the function system.exec of the file core.lua. The manipulation leads to os command injection. This vulnerability is documented as CVE-2025-12121. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in Google zx 8.8.4. It has been declared as problematic. Affected by this vulnerability is the function linkNodeModules of the file src/cli.ts of the component Working Directory Handler. Such manipulation leads to incorrectly-resolved name. This vulnerability is referenced as CVE-2025-13437. The attack can only be performed from a local environment. No exploit is available.

A vulnerability categorized as problematic has been discovered in Google OSV-SCALIBR up to 0.3.3. Affected is the function Next of the file fs/diriterate/diriterate.go. Such manipulation leads to null pointer dereference. This vulnerability is listed as CVE-2025-13425. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.