Qilin
You must login to view this content
Aggregator
Webinar | A CISO’s Guide to Building a Stronger Security Culture
9 months 3 weeks ago
Senator Urges FTC to Investigate Microsoft Product Security
9 months 3 weeks ago
Lawmaker Says Microsoft Lapses Led to Ascension Health's Major 2024 Hack
Sen. Ron Wyden, D-Oregon, is urging the Federal Trade Commission to investigate Microsoft over the software giant's alleged "negligent cybersecurity," which he says contributed to ransomware attacks on critical infrastructure sector organizations, including last year's attack on Ascension Health.
Sen. Ron Wyden, D-Oregon, is urging the Federal Trade Commission to investigate Microsoft over the software giant's alleged "negligent cybersecurity," which he says contributed to ransomware attacks on critical infrastructure sector organizations, including last year's attack on Ascension Health.
Capture the Flag Competitions Build Cybersecurity Talent
9 months 3 weeks ago
Enoflag's Nicolas Werner on How Hands-on Challenges Expand Offensive Security Skills
Capture the Flag, or CTF, competitions have become a global training ground for cybersecurity professionals. These events test offensive security skills across software vulnerabilities, reversing and even physical security, said Nicolas Werner, representative at Enoflag.
Capture the Flag, or CTF, competitions have become a global training ground for cybersecurity professionals. These events test offensive security skills across software vulnerabilities, reversing and even physical security, said Nicolas Werner, representative at Enoflag.
F5 Targets AI Model Misuse With Proposed CalypsoAI Purchase
9 months 3 weeks ago
Calypso’s Red-Teaming and Agentic Threat Tools Boost F5’s Application Security Edge
F5’s latest acquisition brings Dublin, Ireland-based CalypsoAI’s unique AI security stack into its platform to secure application traffic against LLM misuse, data leakage and shadow AI, enhancing protection for hybrid and multi-cloud environments and helping secure apps and APIs.
F5’s latest acquisition brings Dublin, Ireland-based CalypsoAI’s unique AI security stack into its platform to secure application traffic against LLM misuse, data leakage and shadow AI, enhancing protection for hybrid and multi-cloud environments and helping secure apps and APIs.
CISA Unveiled a New Vision for the CVE Program. Can It Work?
9 months 3 weeks ago
Updated CVE Roadmap Follows Threats to Funding
The Cybersecurity and Infrastructure Security Agency is unveiling a new vision for its globally-adopted vulnerability tracking system but security analysts warn that funding threats and turmoil inside the federal agency could derail any reforms before they take hold.
The Cybersecurity and Infrastructure Security Agency is unveiling a new vision for its globally-adopted vulnerability tracking system but security analysts warn that funding threats and turmoil inside the federal agency could derail any reforms before they take hold.
如何兼顾大吞吐与低时延？防火墙核心算法详细拆解
9 months 3 weeks ago
匹配算法的效率直接决定了防火墙的性能和安全性。
CISA work not ‘degraded’ by Trump administration cuts, top agency official says
9 months 3 weeks ago
Nick Andersen rebutted criticisms from industry, state and local governments and the Hill about where CISA capabilities stand.
The post CISA work not ‘degraded’ by Trump administration cuts, top agency official says appeared first on CyberScoop.
Tim Starks
Top 10 Best Mobile Application Penetration Testing Services in 2025
9 months 3 weeks ago
Mobile Application Penetration Testing is a critical cybersecurity service in 2025, focusing on a unique and rapidly evolving attack surface. These tests go beyond static code analysis to assess an app’s runtime behavior, server-side interactions, and how it handles sensitive data. The top companies in this field offer a blend of automated platforms for continuous […]
The post Top 10 Best Mobile Application Penetration Testing Services in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Varshini
SDL 92/100问：在测试代码审计类产品能力时，有没有好一点的开源项目推荐？
9 months 3 weeks ago
从所提的问题来看，提问者肯定是比较懂安全测试工具的能力测试，比如乙方公司会用市面上开源或知名的漏洞靶场来做测试。相比较真实的项目，这些靶场明显代码量更少、漏洞更容易被发现，所以检测能力都很强。
但到真实业务代码的环境后，表现肯定会打折扣。所以可以反过来思考这个问题，先参考厂商的检出率、客户案例等，然后同时安排多个进行POC测试，无论是检出率、易用性都能得到真实的体验。
此外，一定要明确SAST工具的作用范围，绝不是所有漏洞都应该被检出，其次还要进行人工运营。所以，在测试时应该加入误报率之类的反向指标。
------------更多内容，请访问-------------
1、SDL 100问
SDL100问：我与SDL的故事
SAST误报太高，如何解决？
SDL需要哪些人参与？
大家都有哪些SDL运营指标？
业务系统是否可以带漏洞上线？
日常的漏洞运营，也应该是SDL团队来做吗？
关于开发安全BP，对开展SDL有哪些帮助？
SDL 87/100问：哪个厂商做SDL咨询服务和建设比较强？
SDL 88/100问：源代码扫描，是做仓库的全量扫描还是增量扫？
SDL 89/100问：如何推动业务方修复开源组件漏洞？
SDL 90/100问：开发安全左移和右移，哪一个更好？
SDL 91/100问：什么是ASTRIDE？
2、SDL创新实践
首发！“ 研发安全运营 ” 架构研究与实践
DevSecOps实施关键：研发安全团队
DevSecOps实施关键：研发安全流程
DevSecOps实施关键：研发安全规范
DevSecOps实施关键：研发安全工具
从安全视角，看研发安全
数字化转型下研发安全痛点
一个思考：安全测试驱动产品安全？
3、SDL最初实践
【SDL最初实践】开篇
【SDL最初实践】安全培训
【SDL最初实践】安全需求
【SDL最初实践】安全设计
【SDL最初实践】安全开发
【SDL最初实践】安全测试
【SDL最初实践】安全审核
【SDL最初实践】安全响应
4、安全运营实践
基于实践的安全事件简述
安全事件运营SOP：钓鱼邮件
安全事件运营SOP：网络攻击
安全事件运营SOP：蜜罐告警
安全事件运营SOP：webshell事件
安全事件运营SOP：接收漏洞事件
应急能力提升：实战应急困境与突破
应急能力提升：挖矿权限维持攻击模拟
WatCTF F25
9 months 3 weeks ago
Name: WatCTF F25 (an WATCTF event.)
Date: Sept. 9, 2025, 7 p.m. — 11 Sept. 2025, 19:00 UTC [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://watctf.org/
Rating weight: 23.04
Event organizers: WATCTF
Date: Sept. 9, 2025, 7 p.m. — 11 Sept. 2025, 19:00 UTC [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://watctf.org/
Rating weight: 23.04
Event organizers: WATCTF
Medusa Blog
9 months 3 weeks ago
You must login to view this content
cohenido
California legislature passes bill forcing web browsers to let consumers automatically opt out of data sharing
9 months 3 weeks ago
Gov. Gavin Newsom vetoed an earlier version of the bill which would also have applied to mobile operating systems last year.
Vyro AI Leak Reveals Poor Cyber Hygiene
9 months 3 weeks ago
The data leak underscores the larger issue of proprietary or sensitive data being shared with GenAI by users who should know better.
Kristina Beek
Boost Your Confidence With Robust NHI Management
9 months 3 weeks ago
Does Your Organization Understand the Strategic Importance of NHI Management? With corporations increasingly shift operations to the cloud, they face the daunting task of managing a vast array of Non-Human Identities (NHIs) – machine identities used in cybersecurity. With the rise of AI, machine learning, and automation, NHIs are becoming more essential to businesses across […]
The post Boost Your Confidence With Robust NHI Management appeared first on Entro.
The post Boost Your Confidence With Robust NHI Management appeared first on Security Boulevard.
Alison Mack
How Protected Are Your NHIs in Dynamic Networks?
9 months 3 weeks ago
Unraveling the Core Structure: What are NHIs? Are you really protecting your Non-Human Identities (NHIs) to the best of your ability? NHIs are an often misunderstood but vitally important component. They are machine identities created by combining a “Secret” and the permissions granted to that Secret by a destination server. A Secret can be an […]
The post How Protected Are Your NHIs in Dynamic Networks? appeared first on Entro.
The post How Protected Are Your NHIs in Dynamic Networks? appeared first on Security Boulevard.
Alison Mack
Skynet или C-3PO в правительстве? Албания сделала шаг, который изменит наше представление о власти навсегда
9 months 3 weeks ago
Власти обещают стопроцентную неподкупность.
'Gentlemen' Ransomware Abuses Vulnerable Driver to Kill Security Gear
9 months 3 weeks ago
By weaponizing the ThrottleStop.sys driver, attackers are disrupting antivirus and endpoint detection and response (EDR) systems.
Rob Wright
CVE-2025-55444 | Online Artwork and Fine Arts MCA Project 1.0 cancel_booking.php id2 sql injection (EUVD-2025-25347)
9 months 3 weeks ago
A vulnerability labeled as critical has been found in Online Artwork and Fine Arts MCA Project 1.0. Affected by this vulnerability is an unknown functionality of the file cancel_booking.php. Executing manipulation of the argument id2 can lead to sql injection.
This vulnerability appears as CVE-2025-55444. The attack may be performed from remote. There is no available exploit.
vuldb.com
CVE-2025-50904 | WinterChenS my-site up to 2025-06-11 API /admin/ improper authentication (Issue 95 / EUVD-2025-25340)
9 months 3 weeks ago
A vulnerability marked as critical has been reported in WinterChenS my-site up to 2025-06-11. Affected by this issue is some unknown functionality of the file /admin/ of the component API. The manipulation leads to improper authentication.
This vulnerability is traded as CVE-2025-50904. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com