A vulnerability in OpenAI’s advanced video generation model, Sora 2, that enables the extraction of its hidden system prompt through audio transcripts, raising concerns about the security of multimodal AI systems. This vulnerability, detailed in a blog post by AI…
CISA Warns WatchGuard Firebox Out-of-Bounds Write Vulnerability Exploited Attacks
The Cybersecurity and Infrastructure Security Agency (CISA) has released a warning about a serious vulnerability affecting WatchGuard Firebox security appliances. This flaw, tracked as CVE-2025-9242, potentially allows remote attackers to take control of affected systems. The security issue involves an…
How Attackers Turn SVG Files Into Phishing Lures
Businesses today are dealing with faster, stealthier email threats that look routine yet unleash aggressively malicious scripts the moment a user engages. This is especially true when the lure arrives as an attachment that resembles a harmless image file. The…
Critical Dell Data Lakehouse Vulnerability Let Remote Attacker Escalate Privileges
Dell Technologies has disclosed a critical security vulnerability in its Data Lakehouse platform that could allow remote attackers to escalate privileges and compromise system integrity. The flaw, tracked as CVE-2025-46608, affects all versions before 1.6.0.0 and has been assigned a CVSS…
New ClickFix Attack Tricks Users with ‘Fake OS Update’ to Execute Malicious Commands
A new ClickFix campaign is tricking users with a fake Windows update that runs in their browser. Called “Fake OS Update,” this scam takes advantage of people’s trust in the familiar blue screen of death (BSOD) from Microsoft. It delivers…
Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon
Amazon has seen a threat actor exploiting CVE-2025-20337 and CVE-2025-5777, two critical Cisco and Citrix vulnerabilities, as zero-days. The post Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon appeared first on SecurityWeek. This article has been indexed from SecurityWeek…
Mobile blackout for Russian travelers, Windows 11 supports 3rd party passkeys, Synology patches BeeStation flaw
Mobile internet blackout for Russian travelers Windows 11 supports 3rd-party passkey apps Synology patches BeeStation flaw Huge thanks to our sponsor, Vanta What’s your 2 AM security worry? Is it “Do I have the right controls in place?” …
Ireland Investigates X Over Content Moderation
Ireland’s media regulator opens formal probe into compliance of X’s content-moderation systems with EU’s Digital Services Act This article has been indexed from Silicon UK Read the original article: Ireland Investigates X Over Content Moderation
Portuguese Telcos To Invest €4.2bn In 5G, Fibre
Telecoms companies in Portugal to invest in 5G, satellites, fibre-optic networks to support boom in data centres, AI This article has been indexed from Silicon UK Read the original article: Portuguese Telcos To Invest €4.2bn In 5G, Fibre
GitLab Vulnerabilities Expose Users to Prompt Injection Attacks and Data Theft
GitLab has released critical security patches addressing nine vulnerabilities across Community Edition (CE) and Enterprise Edition (EE), including a concerning prompt injection flaw in GitLab Duo that could expose sensitive information from confidential issues. The company is urging all self-managed installations to…
Malicious Chrome Extension Grants Full Control Over Ethereum Wallet
Security researchers have uncovered a sophisticated supply chain attack disguised as a legitimate cryptocurrency wallet. Socket’s Threat Research Team discovered a malicious Chrome extension called “Safery: Ethereum Wallet,” published on the Chrome Web Store on November 12, 2024, that employs…
Amazon alerts: advanced threat actor exploits Cisco ISE & Citrix NetScaler zero-days
Amazon warns that an advanced threat actor exploited zero-days in Cisco ISE and Citrix NetScaler to deploy custom malware. Amazon’s threat intelligence researchers spotted an advanced threat actor exploiting two previously undisclosed zero-day flaws in Cisco Identity Service Engine (ISE)…
Synnovis Finally Issues Breach Notification After 2024 Ransomware Attack
NHS provider Synnovis is notifying clients about the extent of a data breach 17 months after it suffered a ransomware attack This article has been indexed from www.infosecurity-magazine.com Read the original article: Synnovis Finally Issues Breach Notification After 2024 Ransomware…
Formbook Delivered Through Multiple Scripts, (Thu, Nov 13th)
When I'm teachning FOR610[1], I always say to my students that reverse engineering does not only apply to “executable files†(read: PE or ELF files). Most of the time, the infection path involves many stages to defeat the Security Analyst…
Anthropic To Spend $50bn On US Data Centres
Amazon and Google-backed AI start-up Anthropic to spend $50bn on data centres in US, beginning with sites in Texas, New York This article has been indexed from Silicon UK Read the original article: Anthropic To Spend $50bn On US Data…
New ClickFix Attack Targeting Windows and macOS Users to Deploy Infostealer Malware
Security researchers have uncovered a sophisticated malware campaign that leverages the ClickFix social engineering technique to distribute information-stealing malware across Windows and macOS platforms. The campaign demonstrates how threat actors are exploiting legitimate search queries for cracked software to deliver…
CISA Warns of Federal Agencies Not Fully Patching Actively Exploited Cisco ASA or Firepower Devices
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding federal agencies. Failing to properly patch Cisco Adaptive Security Appliances (ASA) and Firepower Threat Defense (FTD) devices against actively exploited vulnerabilities. Under Emergency Directive 25-03, CISA has…
Microsoft SQL Server Vulnerability Let Attackers Escalate Privileges
Microsoft has released security updates to fix a serious vulnerability in SQL Server that allows attackers to gain higher system privileges. The flaw, tracked as CVE-2025-59499, was disclosed on November 11, 2025, and affects multiple versions including SQL Server 2016,…
Nokod Security launches Adaptive Agent Security to protect AI agents across the entire ADLC
Nokod Security announced the launch of Adaptive Agent Security, a solution that delivers real-time visibility, governance, and protection from threats across the Agent Development Lifecycle (ADLC). Citizen developers and business users are building and deploying AI agents that connect to…
OpenAI Challenges Discovery Order In Times Case
OpenAI asks judge to reconsider order to produce 20 million anonymised chat logs, as $500bn start-up fights New York Times copyright claims This article has been indexed from Silicon UK Read the original article: OpenAI Challenges Discovery Order In Times…
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical security flaw impacting WatchGuard Fireware to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-9242 (CVSS score: 9.3),…
IT Security News Hourly Summary 2025-11-13 09h : 4 posts
4 posts were published in the last hour 7:42 : Critical Dell Data Lakehouse Flaw Allows Remote Attackers to Escalate Privileges 7:13 : New Phishing Attack Targeting iPhone Owners Who’ve Lost Their Devices 7:12 : Healthcare security is broken because…
Critical Dell Data Lakehouse Flaw Allows Remote Attackers to Escalate Privileges
Dell Technologies has disclosed a critical security vulnerability affecting its Data Lakehouse platform that could allow attackers with high-level privileges to escalate their access and compromise system integrity. The flaw, tracked as CVE-2025-46608, carries a maximum CVSS severity score of…
New Phishing Attack Targeting iPhone Owners Who’ve Lost Their Devices
A new phishing campaign is targeting iPhone owners who have lost their devices, exploiting their hope of recovery to steal Apple ID credentials. The National Cyber Security Centre (NCSC) has received multiple reports of cases where victims received text messages…