Aggregator

科技爱好者周刊（第 365 期）：流量变现正在崩塌

不安全
9 months 3 weeks ago
这是一份科技周刊，记录每周值得分享的科技资讯与观点。文章涵盖AI对互联网商业模式的影响、广告牌谜题解析、AI动画制作进展等内容，并推荐了多种工具与资源链接。此外还探讨了类型系统并非复杂性解决方案的观点，并分享了有趣言论与往年回顾内容。

Qilin

Dark Feed IO
9 months 3 weeks ago

You must login to view this content

cohenido

Senator Urges FTC to Investigate Microsoft Product Security

DataBreachToday.com
9 months 3 weeks ago
Lawmaker Says Microsoft Lapses Led to Ascension Health's Major 2024 Hack
Sen. Ron Wyden, D-Oregon, is urging the Federal Trade Commission to investigate Microsoft over the software giant's alleged "negligent cybersecurity," which he says contributed to ransomware attacks on critical infrastructure sector organizations, including last year's attack on Ascension Health.

Capture the Flag Competitions Build Cybersecurity Talent

DataBreachToday.com
9 months 3 weeks ago
Enoflag's Nicolas Werner on How Hands-on Challenges Expand Offensive Security Skills
Capture the Flag, or CTF, competitions have become a global training ground for cybersecurity professionals. These events test offensive security skills across software vulnerabilities, reversing and even physical security, said Nicolas Werner, representative at Enoflag.

F5 Targets AI Model Misuse With Proposed CalypsoAI Purchase

DataBreachToday.com
9 months 3 weeks ago
Calypso’s Red-Teaming and Agentic Threat Tools Boost F5’s Application Security Edge
F5’s latest acquisition brings Dublin, Ireland-based CalypsoAI’s unique AI security stack into its platform to secure application traffic against LLM misuse, data leakage and shadow AI, enhancing protection for hybrid and multi-cloud environments and helping secure apps and APIs.

CISA Unveiled a New Vision for the CVE Program. Can It Work?

DataBreachToday.com
9 months 3 weeks ago
Updated CVE Roadmap Follows Threats to Funding
The Cybersecurity and Infrastructure Security Agency is unveiling a new vision for its globally-adopted vulnerability tracking system but security analysts warn that funding threats and turmoil inside the federal agency could derail any reforms before they take hold.

Top 10 Best Mobile Application Penetration Testing Services in 2025

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
9 months 3 weeks ago

Mobile Application Penetration Testing is a critical cybersecurity service in 2025, focusing on a unique and rapidly evolving attack surface. These tests go beyond static code analysis to assess an app’s runtime behavior, server-side interactions, and how it handles sensitive data. The top companies in this field offer a blend of automated platforms for continuous […]

The post Top 10 Best Mobile Application Penetration Testing Services in 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Varshini

SDL 92/100问：在测试代码审计类产品能力时，有没有好一点的开源项目推荐？

我的安全视界观
9 months 3 weeks ago
从所提的问题来看，提问者肯定是比较懂安全测试工具的能力测试，比如乙方公司会用市面上开源或知名的漏洞靶场来做测试。相比较真实的项目，这些靶场明显代码量更少、漏洞更容易被发现，所以检测能力都很强。 但到真实业务代码的环境后，表现肯定会打折扣。所以可以反过来思考这个问题，先参考厂商的检出率、客户案例等，然后同时安排多个进行POC测试，无论是检出率、易用性都能得到真实的体验。 此外，一定要明确SAST工具的作用范围，绝不是所有漏洞都应该被检出，其次还要进行人工运营。所以，在测试时应该加入误报率之类的反向指标。 ------------更多内容，请访问------------- 1、SDL 100问 SDL100问：我与SDL的故事 SAST误报太高，如何解决？ SDL需要哪些人参与？ 大家都有哪些SDL运营指标？ 业务系统是否可以带漏洞上线？ 日常的漏洞运营，也应该是SDL团队来做吗？ 关于开发安全BP，对开展SDL有哪些帮助？ SDL 87/100问：哪个厂商做SDL咨询服务和建设比较强？ SDL 88/100问：源代码扫描，是做仓库的全量扫描还是增量扫？ SDL 89/100问：如何推动业务方修复开源组件漏洞？ SDL 90/100问：开发安全左移和右移，哪一个更好？ SDL 91/100问：什么是ASTRIDE？ 2、SDL创新实践 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 DevSecOps实施关键：研发安全工具 从安全视角，看研发安全 数字化转型下研发安全痛点 一个思考：安全测试驱动产品安全？ 3、SDL最初实践 【SDL最初实践】开篇 【SDL最初实践】安全培训 【SDL最初实践】安全需求 【SDL最初实践】安全设计 【SDL最初实践】安全开发 【SDL最初实践】安全测试 【SDL最初实践】安全审核 【SDL最初实践】安全响应 4、安全运营实践 基于实践的安全事件简述 安全事件运营SOP：钓鱼邮件 安全事件运营SOP：网络攻击 安全事件运营SOP：蜜罐告警 安全事件运营SOP：webshell事件 安全事件运营SOP：接收漏洞事件 应急能力提升：实战应急困境与突破 应急能力提升：挖矿权限维持攻击模拟

Managed ad