#VulnerabilityDiscovery

In Other News: Cloudflare Abuse, UK and EU Cybersecurity Reports, FBI Gen-AI Alert

by

December 6, 2024 at 08:36AM SecurityWeek’s summary highlights key cybersecurity stories, including a major US organization hacked by Chinese actors, FBI warnings about generative AI fraud, Stoli USA’s bankruptcy post-ransomware attack, UK and EU cybersecurity reports, Cloudflare service abuse, WAF configuration issues, new CISA resources, and spyware on a Russian programmer’s phone. ### Meeting Takeaways … Read more

Virtual Event Today: Cyber AI & Automation Summit

by

December 4, 2024 at 07:55AM The Cyber AI & Automation Summit, hosted by SecurityWeek today, December 4th, from 11AM – 4PM ET, focuses on AI’s transformative role in cybersecurity. Key topics include practical AI applications, risk reduction, and automation challenges, featuring expert speakers and product demos in an interactive online format. **Takeaways from SecurityWeek’s Cyber … Read more

AI & LLMs Show Promise in Squashing Software Bugs

by

November 10, 2024 at 11:48PM AI models are increasingly used for discovering software vulnerabilities, potentially increasing the number of disclosures initially but leading to reduced flaws over time. Recent experiments show promising results, though challenges remain in integrating these tools into development processes and addressing companies’ prioritization of efficiency over security. ### Meeting Takeaways 1. … Read more

Google’s AI Tool Big Sleep Finds Zero-Day Vulnerability in SQLite Database Engine

by

November 4, 2024 at 06:21AM Google identified a zero-day vulnerability in SQLite using its AI framework, Big Sleep. This marks the first real-world vulnerability discovered by an AI agent. The flaw, a stack buffer underflow, has been addressed. Google emphasizes the potential of AI in finding vulnerabilities pre-release, but notes results are still experimental. ### … Read more

Google’s Shift to Rust Programming Cuts Android Memory Vulnerabilities by 52%

by

September 25, 2024 at 01:18PM Google’s shift to memory-safe languages like Rust has reduced memory-safe vulnerabilities in Android from 76% to 24% in six years. Prioritizing secure coding for new features makes codebases safer and cost-effective. The decrease in vulnerabilities is due to the decay of new code’s vulnerabilities and advancements in vulnerability combat. Google … Read more

In Other News: Possible Adobe Reader Zero-Day, Hijacking Mobi TLD, WhatsApp View Once Exploit

by

September 13, 2024 at 09:33AM Summary: SecurityWeek’s cybersecurity news roundup compiles noteworthy stories each week, including an Adobe Reader zero-day vulnerability, .mobi TLD TLS undermining, Scattered Spider ransomware targeting the insurance and financial sectors, macOS HZ RAT malware, WhatsApp View Once feature bypass, dismantling of card-cloning gangs, Google’s actions against influence operations, Windows MSI installer … Read more

Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities

by

September 12, 2024 at 05:49AM Trend Micro researchers discovered remote code execution attacks on WhatsUp Gold leveraging the Active Monitor PowerShell Script since August 30. Exploiting vulnerabilities CVE-2024-6670 and CVE-2024-6671, the attacks persisted despite available patches, emphasizing the need for prompt patch application and proactive monitoring to prevent similar incidents. Mitigation steps include access control, … Read more

Google Introduces Project Naptime for AI-Powered Vulnerability Research

by

June 24, 2024 at 11:24AM Google has unveiled Project Naptime, a framework allowing AI to conduct vulnerability research, mimicking human security researchers. It comprises tools like Code Browser, Python tool, Debugger, and Reporter. Naptime is model-agnostic and better at flagging security flaws, achieving higher scores than OpenAI GPT-4 Turbo in vulnerability tests. It enables LLM … Read more

In Other News: Apple WPS Surveillance, Canadian Gov Wants Backdoors, NIST AI Program

by

May 31, 2024 at 09:36AM SecurityWeek compiles important cybersecurity news, highlighting impactful stories. Recent articles cover threats like abusing BitLocker for ransomware, critical data exposure in India, AI-as-a-service vulnerability, and surveillance using Wi-Fi-based positioning systems. Additionally, a memorandum of understanding aims to boost electric sector cybersecurity, while cyberspying targets political entities in multiple regions. Based … Read more

Critical Flaw in Replicate AI Platform Exposes Proprietary Data

by

May 23, 2024 at 10:08AM A critical vulnerability in the Replicate AI platform allowed attackers to execute a malicious AI model for a cross-tenant attack, potentially compromising private AI models and sensitive data. Researchers at Wiz emphasize the difficulty of tenant separation in AI-as-a-service solutions and recommend new forms of mitigation to prevent future exploitation. … Read more