Security News
CISA and the FBI urged software companies on Wednesday to review their products and eliminate path OS command injection vulnerabilities before shipping. "OS command injection vulnerabilities arise when manufacturers fail to properly validate and sanitize user input when constructing commands to execute on the underlying OS," today's joint advisory explains.
After first announcing onboard AI in January, Samsung expanded what it's calling the Galaxy AI ecosystem on July 10 at the Galaxy Unpacked event in Paris. Samsung's two newest phones are the Galaxy Z Fold6 and Galaxy Z Flip6, both of which use Google's Gemini AI for translation, creative features and cosmetic changes.
In particular, contextual grounding for Guardrails for Amazon Bedrock provides customizable content filters for organizations deploying their own generative AI. AWS Responsible AI Lead Diya Wynn spoke with TechRepublic in a virtual prebriefing about the new announcements and how companies balance generative AI's wide-ranging knowledge with privacy and inclusion. Guardrails is expanding into the independent ApplyGuardrail API, with which Amazon businesses and AWS customers can apply safeguards to generative AI applications even if those models are hosted outside of AWS infrastructure.
Japan's Computer Emergency Response Team Coordination Center is warning that Japanese organizations are being targeted in attacks by the North Korean 'Kimsuky' threat actors. The US government has attributed Kimsuky as a North Korean advanced persistent threat group that conducts attacks against targets worldwide to gather intelligence on topics of interest to the North Korean government.
A month after incident response giant Mandiant suggested the litany of data thefts linked to Snowflake account intrusions had the common component of lacking multi-factor authentication controls, the cloud storage and data analytics company is offering a mandatory MFA option to admins. The general availability of Snowflake Trust Center was also announced concurrently - a framework for customers to monitor compliance with the MFA policies Snowflake hopes will be applied more broadly.
Haifei Li discovered that threat actors have been distributing Windows Internet Shortcut Files to spoof legitimate-looking files, such as PDFs, but that download and launch HTA files to install password-stealing malware. An Internet Shortcut File is simply a text file that contains various configuration settings, such as what icon to show, what link to open when double-clicked, and other information.
The EU General Data Protection Regulation is a comprehensive set of rules designed to keep the personal data of all EU citizens collected by any organization, enterprise or business safe from unauthorized access or use. The GDPR went into effect on May 25, 2018, and the provisions in the law greatly affected the manner in which every business transaction involving EU citizens is conducted.
Microsoft has fixed a known issue causing restart loops and taskbar problems on Windows 11 systems after installing the June KB5039302 preview update. [...]
The US Justice Department has seized two US-based domains used by Russian threat actors to create fake profiles on X that would spread disinformation in the United States and abroad. This bot farm was created and operated via Meliorator, an AI-enhanced software package. "Development of the social media bot farm was organized by an individual identified in Russia. In early 2022, Individual A worked as the deputy editor-in-chief at RT, a state-run Russian news organization based in Moscow," the DoJ claims.
The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could give the attacker access to network devices and services without the attacker guessing or brute forcing passwords or shared secrets.