Author: HackWatchit

House Homeland Security committee looks to reform the Cybersecurity Sharing Act The bill is advancing in the House, but its path forward in the Senate remains unclear as the law’s expiration nears. Michele Sandiford September 4, 2025 5:11 pm < a min read The House Homeland Security Committee wants to reauthorize and reform the Cybersecurity Information Sharing Act of 2015, which expires at the end of this month. On Wednesday, the committee passed a bill that would extend the law for another 10 years. It would also update the law to account for advances in artificial intelligence and require the…

The adage “content is king” holds particularly true for the entertainment industry. Millions of people across the globe pursue film, video streaming and musical content, making these digital assets incredibly valuable — and this immense value has not gone unnoticed by cybercriminals. A stark example of the industry’s vulnerability emerged as early as 2017 when a hacker group successfully exfiltrated files containing the first ten episodes of a highly anticipated Netflix show and demanded a ransom, threatening to release the material on the internet if their demands weren’t met. This is just one of numerous examples that demonstrate how a single cybersecurity breach…

Imagine walking into a kitchen where you can shout out recipes and a robot instantly cooks up a meal. You ask for pasta, and within minutes you have a steaming plate in front of you.  The speed and convenience are impressive, but if you never stop to check what ingredients went into the dish, you might be eating something unsafe. That is what vibe coding feels like. Instead of carefully writing lines of code, developers describe what they want in plain English and let AI assistants generate it. Tools like Copilot, ChatGPT, VSCode, and other AI-powered code helpers have made…

U.S. CISA adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini September 05, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Sitecore, Android, and Linux flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Sitecore, Android, and Linux to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-38352 Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability CVE-2025-48543 Android Runtime Unspecified Vulnerability CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability This week, Google released security updates to address 120 Android vulnerabilities as part of Android Security Bulletin…

Graham Cluley is an award-winning cybersecurity public speaker, podcaster, blogger, and analyst. He has been a well-known figure in the cybersecurity industry since the early 1990s when he worked as a programmer, writing the first ever version of Dr Solomon’s Anti-Virus Toolkit for Windows. Since then he has been employed in senior roles by computer security companies such as Sophos and McAfee. Graham Cluley has given talks about cybersecurity for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and regularly appears on TV and radio explaining computer security threats. Graham Cluley was…

A critical vulnerability (CVE-2025-42957) in SAP S/4HANA enterprise resource planning software is being exploited by attackers “to a limited extent”, the Dutch National Cyber Security Center (NCSC NL) has warned on Friday. Their alert seems to be based on a report by SecurityBridge’s Threat Research Labs, who professedly verified that the exploit for the flaw is being used in the wild. About CVE-2025-42957 CVE-2025-42957 is a code injection vulnerability affecting SAP S/4HANA’s function module exposed via RFC. “This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor,…

Researchers at Guardio Labs have uncovered a new “Grokking” scam where attackers trick Grok AI into spreading malicious links on X. Learn how it works and what experts are saying. A new, ingenious cybersecurity scam has been discovered that is abusing the popular AI assistant Grok on the social media platform X (formerly Twitter) to bypass security controls and spread malicious links. This scam was uncovered by researcher Nati Tal, the Head of Cyber Security Research at Guardio Labs, who has named this new technique “Grokking.” In a series of X posts, Tal explained how this scam works. It starts…

Unless you’ve been living on a desert island or in a cave for the past several years, you’ve surely heard and read about the transformative power of Artificial Intelligence (AI). From education to entertainment and marketing to medical research (and everything in between), AI’s ability to process tremendous amounts of data, learn patterns, and automate complex and burdensome tasks is radically changing not only how companies conduct business, but how people carry out their jobs. For those of us in the cybersecurity space, AI — particularly Large Language Models (LLMs) and LLM-powered AI agents — promises to revolutionize the way we work.…

Two academic researchers from Nanjing University and the University of Sydney have created a framework that relies on AI for the discovery and validation of vulnerabilities in Android applications. Called A2, the system mirrors human experts’ analysis and validation activities by first reasoning about an application’s security and then validating each potential flaw through exploitation attempts. During the Agentic Vulnerability Discovery phase, semantic code understanding is mixed with traditional security tools to create vulnerability hypotheses. The next phase, the Agentic Vulnerability Validation, involves the planning, execution, and verification of exploitation operations to validate each hypothesis. As part of their research,…