Author: HackWatchit
Developers are turning to AI coding assistants to save time and speed up their work. But these tools can also introduce security risks if they suggest flawed or unsafe code. To help address that, Secure Code Warrior has released a new set of free AI Security Rules on GitHub. These rulesets offer practical guidance to help developers write more secure code when using tools like GitHub Copilot, Cursor, Cline, Roo, Aider, and Windsurf. Designed specifically for real-world AI-assisted coding, the rules aim to close the gap between fast development and secure software. “These guardrails add a meaningful layer of defense,…
Cyolo, provider of secure remote privileged access for operational technology (OT) and cyber-physical systems (CPS), has announced the launch of several major new capabilities, headlined by Cyolo Third-Party VPN Control (patent pending). The capability within the company’s Cyolo PRO (Privileged Remote Operations) solution delivers visibility and access control for enforced third-party VPN and direct connections without requiring changes to production infrastructure or vendor workflows. In today’s increasingly connected industrial environments, even organizations with mature security programs face a critical blind spot: third-party connections they cannot govern or even see. Some vendors insist on using their legacy VPNs, site-to-site tunnels, or…
Beau Bullock // I’ve added in a few modules to MailSniper that will assist in remote attacks against organizations that are hosting an externally facing Exchange server (OWA or EWS). Specifically, the modules are Get-GlobalAddressList, Invoke-PasswordSprayOWA, and Invoke-PasswordSprayEWS. Get-GlobalAddressList Very often on external penetration tests we perform a reconnaissance phase that might yield us some email addresses or usernames of an organization. If we can successfully find valid credentials for any one of them, and the organization has an Outlook Web Access or Exchange Web Services portal it is possible to download the entire Global Address List from the Exchange server.…
India-based car-sharing company Zoomcar suffered a data breach impacting 8.4M users Pierluigi Paganini June 17, 2025 Zoomcar disclosed a data breach impacting 8.4M users after attackers compromised its systems and contacted the company staff. Zoomcar is an India-based car-sharing and self-drive car rental company. Zoomcar discovered a data breach impacting 8.4M users after threat actors contacted the internal personnel claiming the compromise of internal systems. The company is investigating the security breach and has determined that the exposed information included names, contacts, and addresses. No financial data or passwords were compromised. “On June 9, 2025, Zoomcar Holdings, Inc. (the “Company”)…
A hacker group known for high-profile attacks on retail giants is now turning its attention to the insurance sector, according to a new warning from Google’s Threat Intelligence Group. The group, known as Scattered Spider, has been linked to a series of recent cyber attacks that disrupted access for insurance customers across the United States. The alert follows a series of data breaches at major UK retailers earlier this year. After that wave of attacks, Google analysts noted that Scattered Spider had begun targeting US-based retailers. Now, researchers say the group is showing a clear interest in insurance firms and…
In cyber security, external attack surface management (ASM) is like tending a garden, helping you keep track of plants (your assets) as they grow. It enables you to monitor your assets and quickly identify risks to them—like pests attacking the plant or a plant needing water. The faster and more efficiently you can do this, the faster you can address vulnerabilities and exposures. In the context of gardening, there’s no automated, highly efficient way of keeping track of what’s supposed to be growing. But in cyber security, you can take advantage of automated continuous attack surface management tools and cyber…
U.S. President Donald Trump, who has referred to himself as America’s first “crypto president,” wanted stablecoin legislation to reach his desk prior to the Congressional recess in August. On Tuesday (June 17), that wish got one step closer to reality with the Senate passing the GENIUS Act, an acronym for Guiding and Establishing National Innovation for U.S. Stablecoins of 2025 Act, in a 68-30 vote. “Today is a bold step forward – not just for financial innovation, but for American leadership, consumer protection, and economic opportunity. With the GENIUS Act, we’re bringing clarity to a sector that’s been clouded by uncertainty and proving…
you should read this article If you are planning to go into data science, be it a graduate or a professional looking for a career change, or a manager in charge of establishing best practices, this article is for you. Data science attracts a variety of different backgrounds. From my professional experience, I’ve worked with colleagues who were once: Nuclear physicists Post-docs researching gravitational waves PhDs in computational biology Linguists just to name a few. It is wonderful to be able to meet such a diverse set of backgrounds and I have seen such a variety of minds lead to…
I got my start in InfoSec through a few competitions during my time in high school. My team and I were fortunate to have a supportive school and many mentors who helped teach us what we needed to know. However, when I would look around, I would see teams posting online hoping to get a little bit of help. I think it is a shame that these students are interested in InfoSec, but lack the quality mentors that I was grateful to have. I do what I can to give back to the main competition that got me into InfoSec, CyberPatriot, by mentoring…