اخبار امنیتی

Help Net Security ۵۳ دقیقه پیش

Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw

The rsync project released version 3.5.2, and it closes a flaw that let a connecting client tie up a server’s CPU with checksum math that leads nowhere. The new version also lets you push a transfer to the back of the queue for CPU and disk, so a big sync stops elbowing everything else on the machine. rsync is an open-source utility that copies files locally and across a network, and it is widely…

Help Net Security ۱ ساعت پیش

What AI-generated malware looks like under the microscope

In this Help Net Security interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, talks about what AI-generated malware looks like on the bench. She points to tidy comments, uniform logging messages, and emojis as signs a script came from a model, and notes that decompiled code strips much of that away. Kaye also covers how AI is squeezing the time teams have to patch, where it…

Help Net Security ۲ ساعت پیش

Ghostunnel: Open-source TLS proxy with mutual authentication

Ghostunnel is an open-source proxy that handles TLS for programs that cannot handle it themselves. It works in two directions. In server mode it sits in front of a backend, accepts TLS connections, checks the client’s certificate, then passes traffic to the service behind it over TCP or a UNIX socket. In client mode it does the reverse, listening for plain local connections, wrapping them in TLS…

Help Net Security ۲ ساعت پیش

Secure your containers without breaking what works

Container security has a familiar problem. Teams identify vulnerabilities, but turning those findings into lower risk is much harder. A standard container image may include operating-system packages, development tools, debugging utilities and libraries that an application never uses. Each unnecessary component can expand the attack surface and add vulnerabilities to investigate, patch or explain…

Help Net Security ۳ ساعت پیش

Companies going all in on AI could see their strategy backfire

Four of the five highest-ranked enterprise risks in Gartner’s Quarterly Emerging Risk Report were AI-related. AI strategy miscalculation and AI-driven competitive displacement debuted at No. 3 and No. 4, respectively. The AI workforce preparedness gap held fifth place. AI discovery of cyber vulnerabilities and geopolitical energy supply shocks held the top two spots for the second consecutive…

Help Net Security ۳ ساعت پیش

NIST publishes cybersecurity guide for businesses too small to have IT staff

The National Institute of Standards and Technology (NIST) released cybersecurity guidance for small businesses with no paid employees other than their owners. These businesses include freelancers, sole proprietors, and independent contractors. About 82% of the 34.8 million small businesses in the United States fall into this category, according to the U.S. Small Business Administration’s Office…

Help Net Security ۴ ساعت پیش

Anthropic open-sources FlashProve, its provable inference prototype for MoE models

Anthropic’s Frontier Red Team, with collaborators at EPFL, MIT and StarkWare, built FlashProve, a prototype that produces a cryptographic proof that one specific language model generated one specific reply. The prover, two verifiers, the formal proofs behind them and a protocol specification are on GitHub under the Apache 2.0 license. Source: Anthropic When you send a prompt to a hosted API, you…

Help Net Security ۱۸ ساعت پیش

Police seize over 100 servers linked to investment fraud with more than €4 million in losses

Seven people have been arrested and more than 100 servers seized in a coordinated law enforcement action against an investment fraud network that started unravelling after a complaint from a German couple. Seized servers (Source: Europol) The couple went to the police in 2022 after putting their savings into an online trading platform and discovering they could not withdraw their profits. The…

Help Net Security ۱۸ ساعت پیش

Novee puts forgotten internet-facing assets through penetration testing

Novee’s External Surface Testing is a new capability in its AI penetration testing platform that helps security teams discover internet-facing assets and validate exploitable vulnerabilities. It tests newly disclosed CVEs and findings imported from third-party external attack surface management (EASM) tools. “Attackers don’t limit themselves to the applications you’re already testing. They look…

Help Net Security ۱۸ ساعت پیش

Assured helps recovery teams find clean backups after ransomware attacks

Assured Data Protection has announced CleanRoom SCAN, a new managed service designed to strengthen cyber recovery by independently scanning isolated backup data using multiple leading security engines to identify hidden threats before restoration. The service helps organizations identify malware and other indicators of compromise earlier, reducing the risk of reinfecting production environments…