Explore AI agents' capacity to leverage real-world weaknesses with a benchmark assessing them against 40 significant Common Vulnerabilities and Exposures (CVEs) from the National Vulnerability Database. A sandbox environment is employed to emulate actual conditions. For more details, visit: https://arxiv.org/abs/2503.17332.
#vulnerabilities
5 posts5 participants0 posts today
Latest issue of my curated #cybersecurity and #infosec list of resources for week #18/2025 is out!
It includes the following and much more:
France has linked Russian APT to 12 #cyberattacks on French Orgs.;
Cybersecurity experts demand the reinstatement of Chris Krebs' security clearances and the withdrawal of the investigation;
#Vulnerabilities in Apple's #AirPlay Protocol;
New York's Metropolitan Transportation Authority plans to use #AI and cameras to detect potential subway crimes before they happen;
@SentinelOne Targeted by Chinese #PurpleHaze Group;
#Microsoft sets all new accounts #passwordless by default;
The #Trump administration plans to cut $491 million from #CISA's budget;
Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end 
https://infosec-mashup.santolaria.net/p/infosec-mashup-18-2025
X’s InfoSec Newsletter🕵🏻♂️ [InfoSec MASHUP] 18/2025France has linked Russian APT to 12 cyberattacks on French Orgs.; Cybersecurity experts demand the reinstatement of Chris Krebs' security clearances and the withdrawal of the investigation; Vulnerabilities in Apple's AirPlay Protocol; New York's Metropolitan Transportation Authority plans to use AI and cameras to detect potential subway crimes before they happen; SentinelOne Targeted by Chinse PurpleHaze Group; Microsoft sets all new Accounts passwordless by Default; The Trump administration plans to cut $491 million from CISA's budget;
A couple of days ago, I unearthed my first #computer, an #MSX straight from the ‘80s. It was lost in some box in the basement for who knows how long. Just feeling its power switch gave me the goosebumps…
This discovery came after sharing my hacker’s origin story with Nic Fillingham and Wendy Zenone in a new episode of Microsoft’s #BlueHat #Podcast.
Join us while we chat about my first-ever #CVE, overlooked #vulnerabilities that continue to pose significant risks today, #ActiveDirectory and #password security, my unexpected journey into #bugbounty hunting and my involvement in the #ZeroDayQuest, how to learn new things, mentorship and positive leadership, and of course pineapple pizza 
https://bird.makeup/users/msftbluehat/statuses/1917686112035954994
GitHub's latest #AI feature, DeepSeek-Prover-V2, promises to write better code with AI, find #vulnerabilities, and even automate workflows—all while you navigate a labyrinthine menu system likely designed by an M.C. Escher imitator 
. Meanwhile, coders everywhere are left wondering if the AI can also automate crying into their keyboards at 3 AM 
.
https://github.com/deepseek-ai/DeepSeek-Prover-V2 #GitHub #DeepSeek #Prover #automation #coding #3AM #HackerNews #ngated
GitHubGitHub - deepseek-ai/DeepSeek-Prover-V2Contribute to deepseek-ai/DeepSeek-Prover-V2 development by creating an account on GitHub.
Researchers have revealed that defenses against "juice jacking" on #iOS and #Android can be easily bypassed.
Malicious chargers exploit #USB #vulnerabilities to steal #data.
The new "ChoiceJacking" technique allows attackers to #spoof user consent and access sensitive files.
Avoid using public charging USB ports to #protect your data.
Ars Technica · iOS and Android juice jacking defenses have been trivial to bypass for years
#4chan has partially resumed operations after a significant #hack that exposed #vulnerabilities and led to a nearly two-week #shutdown.
The site attributes its struggles to financial constraints and pressure from advertisers, which have limited its ability to maintain #security.
4chan's team remains defiant, emphasizing the site's unique role in online culture.
https://techcrunch.com/2025/04/27/4chan-is-back-online-says-its-been-starved-of-money/
TechCrunch · 4chan is back online, says it's been ‘starved of money’ | TechCrunch4chan is partly back online after a hack took the infamous image-sharing site down for nearly two weeks. The site first went down on April 14, with the
Seven new GNAs have been registered on GCVE.EU !
We're glad to see the community grow and are open to new GNA applications
JSON https://gcve.eu/dist/gcve.json Why and How to become a GNA https://gcve.eu/about/#eligibility-and-process-to-obtain-a-gna-id
Latest issue of my curated #cybersecurity and #infosec list of resources for week #17/2025 is out!
It includes the following and much more:
Two top officials from #CISA resigned;
U.S. Defense Secretary Pete Hegseth caught in another information leak;
Yearly Threat Intelligence Reports Released;
U.S. lost record $16.6 billion to #cybercrime in 2024;
5.5 Million Patients Affected by #DataBreach at Yale New Haven Health;
VulnCheck spotted 159 actively exploited #vulnerabilities in first few months of 2025;
FBI is seeking public help to identify Chinese hackers known as #SaltTyphoon and offers $10 million reward;
Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end
https://infosec-mashup.santolaria.net/p/infosec-mashup-17-2025
X’s InfoSec Newsletter🕵🏻♂️ [InfoSec MASHUP] 16/2025Two top officials from CISA resigned; U.S. Defense Secretary Pete Hegseth caught in another information leak; Yearly Threat Intelligence Reports Released; U.S. lost record $16.6 billion to cybercrime in 2024; 5.5 Million Patients Affected by Data Breach at Yale New Haven Health; VulnCheck spotted 159 actively exploited vulnerabilities in first few months of 2025; FBI is seeking public help to identify Chinese hackers known as Salt Typhoon and offers $10 million reward;
A Python client for the Global CVE Allocation System has been released.
by @cedric
GitHubGitHub - gcve-eu/gcve: A Python client for the Global CVE Allocation System.A Python client for the Global CVE Allocation System. - gcve-eu/gcve
Threat Actors Don’t Care About Your Compliance Score
https://youtu.be/mYsSUR6z6BA . #cybersecurity #GRC #audits #documentation #threatactors #vulnerabilities #threathunting #riskmanagent #compliance #NIST #CMMC
Cybercriminals switch up their top initial access vectors of choice – Source: www.csoonline.com https://ciso2ciso.com/cybercriminals-switch-up-their-top-initial-access-vectors-of-choice-source-www-csoonline-com/ #ThreatandVulnerabilityManagement #IdentityandAccessManagement #rssfeedpostgeneratorecho #CyberSecurityNews #IncidentResponse #vulnerabilities #cyberattacks #Cybercrime #CSOonline #CSOOnline #Phishing
CISO2CISO.COM & CYBER SECURITY GROUP · Cybercriminals switch up their top initial access vectors of choice – Source: www.csoonline.comSource: www.csoonline.com - Author: News AnalysisApr 25, 20256 minsCyberattacksIncident ResponsePhishing
The first publication of the GCVE-BCP-01 - Signature Verification of the Directory File
More information about BCP https://gcve.eu/bcp/ GCVE-BCP-01 https://gcve.eu/bcp/gcve-bcp-01/
gcve.euGCVE.eu - Best Current Practice (BCP)
We talk a lot about technical vulnerabilities in cybersecurity — but what about emotional vulnerabilities? What happens when users don’t feel smart enough, tech-savvy enough, or confident enough to even try? Welcome to the overlooked world of digital impostor syndrome. It’s not just a...
# #technical #vulnerabilities #cybersecurity #emotional #happens
Medium · Digital Impostor Syndrome: When Users Feel Too Insecure to Be Secure
The digital signature of the directory file was added in response to requests from various open-source developers and GNAs.
#cve #gcve #vulnerabilities #opensource
FAQ https://gcve.eu/faq/#q13-is-the-json-file-distributed-by-gcve-signed-and-how-can-the-signature-be-verified Directory file https://gcve.eu/dist/
gcve.euFAQGCVE Frequently Asked Questions (FAQ)Q1: What is GCVE?
A: GCVE (Global CVE Allocation System) is a new, decentralized system for identifying and numbering security vulnerabilities. It aims to increase flexibility, scalability, and autonomy for organizations involved in vulnerability management, while remaining compatible with the traditional CVE® system.
Q2: How is GCVE different from the traditional CVE system?
A: The main difference is decentralization. GCVE introduces GCVE Numbering Authorities (GNAs), which are independent entities that can allocate GCVE identifiers without needing blocks pre-allocated from a central authority or adhering strictly to centrally enforced policies. The traditional CVE system typically relies on a more centralized structure for ID allocation and policy.
New Research Alert: Attackers are exploiting a dangerous class of cyber flaws—resurgent vulnerabilities. Learn how they work, why they matter, and what defenders can do. Full analysis
#Cybersecurity #GreyNoise #Vulnerabilities
www.greynoise.ioGreyNoise Uncovers Unique Risks From Resurgent Cybersecurity VulnerabilitiesAttackers from every corner of the internet are exploiting a uniquely dangerous class of cyber flaws: resurgent vulnerabilities.
While digging into some #Fortinet vulnerabilities, I discovered a set of CVEs that were rejected for being unused.
I'm wondering how this is actually helping vulnerability management. Does this mean those will be never used? or something else?
How Blind Obedience Breeds Vulnerabilities in Modern Security Systems Cybersecurity depends on individual awareness, accountability, and decision-making. But in many organizations, people are trained to defer judgment in the name of compliance. The result? A dangerous mindset: ‘I was just...
https://medium.com/readers-club/why-just-following-orders-undermines-security-92553b02380a
Readers Club · Why ‘Just Following Orders’ Undermines Security - Readers Club - Medium
Security Audit Says Perplexity's Android App is Unsafe, Cites Critical Flaws
#AI #PerplexityAI #AndroidSecurity #AppSecurity #Cybersecurity #Vulnerabilities #DataPrivacy #Appknox #MobileSecurity #Infosec #SecurityAudit
How Blind Obedience Breeds Vulnerabilities in Modern Security Systems Cybersecurity depends on individual awareness, accountability, and decision-making. But in many organizations, people are trained to defer judgment in the name of compliance. The result? A dangerous mindset: ‘I was just...
https://medium.com/readers-club/why-just-following-orders-undermines-security-92553b02380a
Readers Club · Why ‘Just Following Orders’ Undermines Security - Readers Club - Medium