Un cabinet d'avocats du Kansas a intenté un procès contre son assureur cybernétique, Palomar Excess & Surplus Insurance Co., après qu'une attaque par ransomware ait paralysé ses opérations pendant cinq jours ouvrables. Le cabinet, DeVaughn James LLC, réclamait plus de 75 000 $ en dommages et intérêt...
Today we cover ChatGPT Codex as part of the Month of AI Bugs series.
ChatGPT Codex is a cloud-based software engineering agent that answers codebase questions, executes code, and drafts pull requests.
In particular, this post will demonstrate how Codex is vulnerable to prompt injection, and how the...
In this post we demonstrate how a bypass in OpenAI’s “safe URL” rendering feature allows ChatGPT to send personal information to a third-party server. This can be exploited by an adversary via a prompt injection via untrusted data.
If you process untrusted content, like summarizing a website, or ana...
Here's what you need to know about the inner workings of modern spyware and how to stay away from apps that know too much
Trail of Bits founder Dan Guido establishes a $2,500 scholarship at his alma mater, Mineola High School, to recognize students who demonstrate the hacker spirit through self-driven learning, creative problem-solving, and unconventional technological exploration. The scholarship celebrates tomorrow’s...
Microsoft has observed Russian state actor Secret Blizzard using an AiTM position to gain initial access, assisted by official domestic intercept systems
Spikes in attacker activity precede the disclosure of vulnerabilities 80% of the time, according to a new GreyNoise report
Restricting end-to-end encryption on a single-country basis would not only be absurdly difficult to enforce, but it would also fail to deter criminal activity
Flashpoint data reveals an 800% increase in credentials stolen via infostealers in just six months
The UK’s AI Security Institute has announced a new AI misalignment research program
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Skype. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following C...
HSIP experienced unauthorized access to its network, resulting in potential data exposure. The breach affected 13 Maine residents and 106 Rhode Island residents. HSIP provided notification and offered identity monitoring services.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following C...
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 7.4. The following CVEs...
Central Boiler, Inc. experienced a sophisticated cyber-attack on August 1, 2025, which may have involved unauthorized access to customer data. The company is notifying potentially affected parties in an abundance of caution. The breach may have exposed customer names in combination with other impact...
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.0. The following CVEs are assigned: CVE-2025-8480.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2025-8476.
Harbor suffered a data breach between July 25, 2025, and August 1, 2025, resulting in unauthorized access to sensitive information. The breach may have involved personal data such as names, addresses, dates of birth, Social Security numbers, and medical information. Harbor is providing credit monito...
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 7.4. T...