Author: HackWatchit
Remember the good ‘ol days of Zip drives, Winamp, the advent of “Office 365,” and copy machines that didn’t understand email authentication? Okay, maybe they weren’t so good! For a while there, as we migrated from on-prem Exchange to “Office 365” Exchange Online, we still needed to scan and email files from our multi-function devices, which had limited mail-delivery and authentication options. Microsoft’s solution was “Direct Send,” an automatically created, unauthenticated SMTP endpoint accepting mail for all of a tenant’s accepted domains. What could go wrong? Check out this blog post for details: https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/ Although Direct Send is not new,…
Generative artificial intelligence (AI) continues to be a hot topic as pundits, media outlets and entrepreneurs consider the opportunities presented in industries ranging from health care to finance. Although there are many potential applications of generative AI, these opportunities also pose legal and ethical concerns that must be carefully managed. For early-stage companies utilizing and offering generative AI tools, navigating these waters is critical to their long-term success. Training Data: Licensing and Privacy Concerns Generative AI models are trained on large amounts of data, which can include personal data, confidential information, data protected by copyright and/or information regulated by various…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday issued two new advisories and updated two others, flagging active vulnerabilities and exploits that continue to threaten ICS (industrial control systems) environments. The updates, which include flaws affecting Siemens, Tigo Energy, and EG4 products, put critical sectors such as energy, utilities, and manufacturing at heightened risk. CISA said the disclosures are intended to help asset owners and operators quickly assess exposure and apply mitigations before attackers can exploit these weaknesses. In an advisory, CISA warned that Siemens’ Desigo CC Product Family and SENTRON Powermanager contained a ‘least privilege violation’ vulnerability…
Sikorski Interviews Michael Daniel 10s 10s 10s 10s Seek Slider The cybersecurity industry faces a peculiar paradox: companies that compete fiercely for customers must collaborate intimately to defend against shared threats. This delicate dance between competition and cooperation creates what Michael Sikorski, CTO and vice president of Engineering at Unit 42, aptly calls a world of “frenemies with benefits.” In a recent Threat Vector podcast conversation, Sikorski explored this dynamic with Michael Daniel, president and CEO of the…
Google fixed Chrome flaw found by Big Sleep AI Pierluigi Paganini August 20, 2025 Google Chrome 139 addressed a high-severity V8 flaw, tracked as CVE-2025-9132, found by Big Sleep AI Google Chrome 139 addressed a high-severity vulnerability, tracked as CVE-2025-9132, in its open source high-performance JavaScript and WebAssembly engine V8. The vulnerability is an out-of-bounds write issue in the V8 JavaScript engine that was discovered by Big Sleep AI. Big Sleep is an AI agent developed by Google DeepMind and Project Zero to automate the discovery of real-world software vulnerabilities. Chrome 139 updates (Windows/macOS: 139.0.7258.138/.139, Linux: 139.0.7258.138) patch the V8…
House Homeland plans CISA 2015 markup with expiration looming The House Homeland Security Committee will mark up a reauthorization bill for CISA 2015, a key information sharing law that expires at the end of September. Justin Doubleday@jdoubledayWFED August 19, 2025 4:48 pm 3 min read The House Homeland Security Committee plans to convene in early September to mark up a reauthorization bill for a soon-to-expire cybersecurity law that’s viewed as critical to cyber collaboration across government and industry. In a statement, House Homeland Security Committee Chairman Andrew Garbarino (R-N.Y.) confirmed the committee will mark up a reauthorization bill for the…
A working exploit concatenating two critical SAP Netweaver vulnerabilities (CVE-2025-31324, CVE-2025-42999) that have been previously exploited in the wild has been made public by VX Underground, Onapsis security researchers have warned. The exploit has allegedly been released on a Telegram channel that claimed to represent a collective of three established cybercrime groups: Scattered Spider, ShinyHunters, and LAPSUS$. Historical exploitation of CVE-2025-31324 Earlier this year, a suspected initial access broker group abused CVE-2025-31324 – a missing authentication bug that lets attackers upload files without authentication – in zero-day attacks to upload webshells and prepare the way for ransomware attacks. Those were…
Phishing is no longer about badly written emails asking you to “click here.” Today’s attacks are business-grade, powered by AI and packaged in ready-to-use phishing kits. That means cybercriminals can now launch believable spearphishing campaigns in hours. For companies, this raises the stakes. A single successful phishing email can expose confidential data, disrupt operations, and damage reputation. The question for managers is no longer whether phishing will target your organization, but how fast your team can detect and stop it. Why Modern Phishing is Harder to Catch Attackers have leveled up, and traditional filters struggle to keep up. AI-driven precision:…
The federal government is at a pivotal moment in understanding how to effectively bring the transformative power of AI to bear on mission assurance. Modernizing the software pipelines of government agencies and the contractors serving them is necessary to create better experiences for people accessing vital services like housing assistance, student aid, or medical benefits. Just as importantly, responsible AI adoption in the service of our national defense is foundational to our ability to innovate quickly while maintaining a strong cybersecurity posture. The post Securing the AI Stack for Federal Missions appeared first on Security Boulevard.