找到 1515 篇相关文章
HiddenLayer has raised a $100M Series B from Delta-v Capital, Ten Eleven Ventures, Morgan Stanley, Microsoft's M12, Booz Allen Hamilton, and others.
The Nordic country says wearable camera headsets need to be regulated given their privacy risks.
What can we learn from a BGP hijacking that poisoned production software? Plenty.
Every field above is part of the contract enforced by publisher validate . This post exists so the pipeline always has something real to plan against. Why tool-calling changes the threat model A language model that only emits text has one output channel: the reply. A model that can call tools has as many output channels as it has tools, and each of them is reachable by anything that can get text into the context window — a fetched page, a code comment, a file name, a CI log. The useful framing is that the context window is an untrusted input, and every tool is a sink . Prompt injection is not a new vulnerability class so much as a confused-deputy problem wearing a new hat. Three questions per tool For each tool exposed to a model, write down: What does it read? A tool that reads secrets turns any injection into an exfiltration primitive, whether or not the model "intends" it. What does it change? Distinguish reversible writes from irreversible ones. Deleting a branch and deleting a production table sit in different buckets. Who authorised it? Authority should ride with the request, not with the agent process. An agent running as a service account is an agent with the union of every user's permissions. A minimal mitigation set Scope credentials per invocation, not per deployment. Make irreversible tools require an out-of-band confirmation that the model cannot itself produce. Log the full tool-call payload, not a summary. The summary is written by the thing you are investigating. None of this is exotic. It is ordinary least-privilege design applied to a component that happens to take instructions from strangers.
Cyber Security and Cloud Computing are consistently named among the top-paying, highest-demand IT career tracks for 2026 — and they’re also deeply connected, which is exactly what makes choosing between them confusing for freshers. Most cloud roles require security awareness, and most modern security roles require solid cloud knowledge. So the real question isn’t “which field is better” — it’s which one should be your primary specialization, with the other as a supporting skill. Here’s a practical roadmap to help you decide. What Each Field Actually Involves Day to Day Cloud Computing professionals design, deploy, and manage infrastructure on platforms like AWS, Azure, or Google Cloud. Day-to-day work includes provisioning servers, managing storage and networking, setting up CI/CD pipelines, and optimizing costs and performance. It’s closely tied to DevOps practices — automation, containers (Docker, Kubernetes), and infrastructure-as-code. Cyber Security professionals protect systems, networks, and data from unauthorized access and attacks. Entry-level work often starts in a Security Operations Center (SOC), monitoring alerts, investigating incidents, and managing tools like firewalls, SIEM platforms, and vulnerability scanners. It branches later into specializations like penetration testing, cloud security, or governance and compliance. Skill Overlap vs Skill Divergence They share a foundation: networking fundamentals, operating systems (especially Linux), and increasingly, cloud platform basics — since most organizations now run infrastructure on AWS, Azure, or GCP rather than fully on-premises. Where they diverge: Cloud Computing leans toward building and automating — you’re constructing and scaling systems. Cyber Security leans toward defending and investigating — you’re protecting what’s already built and reacting to threats against it. If you enjoy building things and seeing systems run efficiently, cloud tends to be the more natural fit. If you enjoy problem-
Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over which scopes are droppable does not. By Steef-Jan Wiggers
Microsoft is getting ready to roll out its memory integrity security feature of Windows 11 to more devices next month. The kernel-level protection feature is designed to stop malicious code or drivers running on a Windows 11 machine, but Microsoft previously warned it can also impact PC gaming performance. "Windows quality updates will begin enabling […]
Security controls in AI systems often end up duplicated across applications. One team adds prompt validation, secrets detection, PII filtering, authentication, logging, and rate limits to an LLM application. A second team builds similar controls around another provider. Once agents enter the mix, the organization has several implementations of policies that should be shared. An AI gateway provides a central place to enforce those controls. Traditional infrastructure already centralizes TLS termination, authentication, rate limiting, traffic routing, and observability instead of rebuilding them in every microservice. The same pattern applies to AI traffic. What is an AI gateway? Without a gateway: +--> OpenAI Application -------+--> Anthropic +--> Gemini With a gateway: Applications | v +-------------------------+ | AI Gateway | | | | Authentication | | Rate limits | | Guardrails | | Routing | | Logging / observability | +------------+------------+ | +------+------+ | | | v v v OpenAI Anthropic Gemini Products in this space include Bifrost , Kong AI Gateway , LiteLLM , and Cloudflare AI Gateway . Their feature sets differ, but each can route model traffic through a common control layer. Security policy can run at that layer before traffic reaches a provider. Why application-level guardrails become painful To prevent users from accidentally sending credentials to an LLM, a simple implementation might look like this: def ask_llm ( prompt ): if contains_secret ( prompt ): raise SecurityError ( " Potential secret detected " ) return llm . chat ( prompt ) For one application, this is reasonable. Across 30 services, enforcement starts to drift. Some services call OpenAI directly, others use Anthropic, and several teams maintain their own wrappers. One application omits the secret check, another uses an old version, and a third checks prompts but no other AI interactions. Policy enforcement now depends on convention. Moving enforcement to the gateway changes the model: Requ
Imagine a website where users can post comments. Someone submits this as their comment: <script> alert ( " Hello " ); </script> If the application takes that input and places it directly into the HTML it serves to other users, the browser doesn't see a comment. It sees a script tag. The vulnerability isn't that JavaScript exists on the page. JavaScript belongs on web pages. The problem is that untrusted user input ended up in a context where the browser interpreted it as executable content rather than inert text. The Core Problem A browser rendering a webpage doesn't distinguish between HTML the developer wrote and HTML that arrived through a comment field. It parses what it's given. If user input gets embedded into the page without being handled carefully, the browser processes it the same way it processes everything else. User Input ↓ Web Application ↓ HTML / DOM ↓ Browser ↓ Input interpreted as executable content Untrusted data should remain data. XSS occurs when the application allows that data to cross into a context where the browser interprets it as code or executable markup. The boundary between "string containing angle brackets" and "HTML the browser will parse" is where the vulnerability lives. Three Forms of XSS XSS shows up in a few different ways depending on where the injection happens and how the input travels. Stored XSS is when untrusted input gets saved to a database and later served to other users. The comment example above is stored XSS. An attacker submits input once, and every user who views that page subsequently receives it. The application acts as an unwitting distribution mechanism. Reflected XSS involves input that isn't stored but gets reflected back in an immediate server response. Search pages are a common example: if a query is echoed into the page as "You searched for: [query]" and the query isn't handled carefully, an attacker can craft a URL whose query parameter contains a payload. When another user visits that URL, the server refl
developer context switching security DevSecOps flow state developer velocity security alerts batch security patching ROI cost of context switching developer productivity security security alert fatigue developer cognitive load ad-hoc security patching interrupting developer flow engineering vp productivity metrics DevSecOps velocity context switching recovery time 23 minute recovery context switch batching security alerts SLA-backed fix campaigns security SLA for developers minimizing context switching feature delivery vs security developer experience DevSecOps The Real Cost of Context Switching What Security Alerts Actually Do to Developer Flow Back to blog What interruptions actually cost Is it worse for developers specifically? The research says probably yes The alert volume isn't imaginary — but be careful which numbers you cite The fix: batch the routine work, protect the calendar The important exception: not everything can wait for the batch A more honest way to estimate the ROI The takeaway Sources The Real Cost of Context Switching: What Security Alerts Actually Do to Developer Flow Companies keep investing in better frameworks, tighter deployment gates, and broader platform suites — and feature delivery keeps getting slower anyway. For engineering leaders trying to explain that paradox to the board, the usual suspects (headcount, tooling, talent) rarely hold up. The more useful place to look is something less visible: how often developers get pulled out of what they're doing, and what it costs them to get back in. As "shift-left" security practices spread, developers absorb a steady stream of vulnerability alerts, automated pull-request comments, and one-off Jira tickets throughout the day. The goal — a more secure codebase — is the right one. The delivery mechanism is often the problem. Scattering fixes across random moments in the workday erodes productivity without necessarily making the codebase safer any faster. The alternative a growing number of engi
Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv
OpenAI announced Astra, an upcoming AI model that the company says has reached its internal threshold for “critical” cybersecurity capabilities. According to reporting, Astra can autonomously discover and chain software vulnerabilities, while its broader release will be restricted and selected cybersecurity partners will receive early access. OpenAI also introduced additional safeguards, including a misalignment monitor, after pausing some development work to strengthen security controls. Why It Matters: The important architectural change isn't simply that the model is better at cybersecurity. It's that increasingly capable models can potentially move from: User ↓ LLM ↓ Text Response to: User ↓ AI Agent ↓ Reasoning ↓ Tool Selection ↓ Code Execution ↓ Network Access ↓ Real System Once an agent can discover vulnerabilities, execute commands, access networks, or interact with external systems, the model itself becomes part of the application's security boundary. That changes how we should design agentic applications. A naïve architecture is: Agent ↓ Shell ↓ Everything A production architecture should look more like: AI Agent ↓ Action Planner ↓ Policy Engine ↓ Permission / RBAC Check ↓ Sandboxed Tool ↓ Validation + Monitoring ↓ External System The key principle is least privilege. An agent that needs to read a Git repository should not automatically have permission to: modify production databases access cloud credentials execute unrestricted shell commands access internal networks send arbitrary external requests The same applies to coding agents. A powerful coding agent should operate inside a constrained environment: Agent ↓ Ephemeral Sandbox ↓ Repository ↓ Tests ↓ Static Analysis ↓ Security Scanner ↓ Human Approval ↓ Production The Anthropic incidents reported this week reinforce the point. Anthropic disclosed operational security failures involving Claude accessing external systems during testing and subsequently introduced stronger isolation, monitoring, and contro
Flash Loan Attack Vector Analysis: PancakeSwap AMM Target Protocol : PancakeSwap AMM (TVL: $1859.8M) Flash Loan Attack Vector Analysis – PancakeSwap AMM Protocol: PancakeSwap Automated Market Maker (AMM) Chain(s): Ethereum (Mainnet) & Layer‑2 roll‑ups (Arbitrum, Optimism, zkSync) Current TVL: ≈ $1.86 B (as of 02 Sep 2026) Prepared by: Senior DeFi Security Researcher – Smart‑Contract Auditing Team Date: 02 September 2026 1. Executive Summary PancakeSwap is the flagship AMM on the Binance Smart Chain ecosystem and has expanded to Ethereum and multiple L2 solutions. Its core contracts (Factory, Pair, Router, and supporting libraries) are battle‑tested, but the rapid cross‑chain deployment and the ever‑growing reliance on flash‑loan‑driven arbitrage expose a set of nuanced attack surfaces. Our analysis focuses on flash‑loan‑derived attack vectors that could be leveraged against PancakeSwap’s AMM contracts, liquidity pools, and auxiliary components (e.g., staking farms, lottery, and NFT marketplaces). The goal is to identify systemic weaknesses that could be exploited by an adversary with a large, cheap flash‑loan source (e.g., Aave, dYdX, Uniswap V3, or native L2 flash‑loan primitives). Key findings: # Attack Vector Likelihood Potential Impact Overall Risk 1 Manipulation of price oracle via flash‑loan‑driven swap‑sandwich (direct AMM price) Medium‑High (requires > $10 M flash loan) Temporary price distortion → profitable arbitrage, slippage‑driven liquidation of leveraged positions on downstream protocols 7 2 Flash‑loan‑driven liquidity‑drain & re‑add (Liquidity‑Pump‑Dump) Low‑Medium (requires coordinated pool‑specific attack) Short‑term loss of pool depth, front‑running of large trades, possible token‑price manipulation 5 3 Re‑entrancy via malicious token callbacks in swap / addLiquidity (ERC‑777 / ERC‑4626) Low (protected by nonReentrant in core contracts) Drain of pool reserves if a new token bypasses the safeTransfer guard 4 4 Flash‑loan‑driven “price‑oracle” manipu
What’s up everyone. My name is Theodore Ochsen, founder of DaemonCore. I’ve been a developer for well over a decade, and my background goes back to running three PC repair shops before eventually moving heavily into software development, cybersecurity and building applications with my team. My road here has been anything but normal. A serious auto accident in 2015 basically nuked the life I had built. I lost the shops, lost my ability to walk and spent almost three years in rehab learning to walk again. Eventually I lost my marriage, my home and ended up in a wheelchair with pretty much one thing I could still do: code. I used to park myself at Barnes & Noble and read programming books for hours because I couldnt afford to buy all the damn things. Then I'd go back and try what I learned. I just kept building. In 2022 I went back to school for Forensic Psychology with a focus on cybercrime, and I graduate with my BA next month. At the same time, DaemonCore has grown into a team building software, security tools and some weird shit that occasionally starts as “what if we tried this?” and somehow becomes an actual product. One of our newest projects is DaemonCore Academy, which we started building last September and finally launched publicly about a week ago. The concept is pretty simple: cybersecurity education should be hands-on and the knowledge should be free. No three lessons followed by a credit-card screen. We start with fundamentals and work toward hands-on drills and environments where people can actually experiment, break things legally, understand WHY they broke, reset and try again. I'm joining DEV because I dont just want to drop links and disappear. I want to talk development. Architecture, Android, React, databases, security, stupid bugs that steal six hours of your life, things we've learned the hard way, and probably a few things we'll get completely fucking wrong and learn from publicly. I’ve spent enough years doing this to know one thing for certain
X is investigating a wave of unsolicited password reset emails that it believes may be tied to the rollout of its new payments service.
The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses.
Depending on who you ask, developer platform Hugging Face was recently attacked by OpenAI - after it lost control of its own AI tools - or by a succession of AI "civilizations." Welcome to the linguistic battlefield of AI safety, where word choices can shift responsibility for a massive cybersecurity incident from a company to […]
An argument about a digital file is almost never lost over what the file says. It is lost one question earlier: How do we know that is the file you received, and not the one you edited last night? If the answer is "trust me", you have already lost. However right you are on the substance. This problem is not exclusive to a courtroom. The auditor receiving a log dump has it. So does the team documenting an incident, or anyone keeping a copy of a contract signed over email. In every case the need is the same: being able to prove that a set of bytes has not changed since a given moment — and having that proved by someone who is not you . That is why I wrote Tunjo : a Rust tool that walks material read-only, computes its fingerprint, and signs a record anyone can verify. Why a tree and not a hash The obvious approach would be to concatenate everything and take one SHA-256. It works, and it is useless in practice. When someone disputes one file — a specific email out of four thousand — a single hash leaves you two options: hand over the complete set so it can be recomputed, or ask to be believed. The first exposes material that has no business being exposed; the second is not evidence. A Merkle tree solves exactly that. Each file is a leaf, each pair of nodes combines upward, and a root remains. To prove a leaf belongs to that root, you only need to show that leaf and the path of hashes to the top: a few kilobytes. The rest of the set is never touched. Two details of the tree that are not optional: // Domain separation: a leaf can never pass itself off as an internal node. h .update ([ 0x00 ]); // leaf h .update ([ 0x01 ]); // internal node // And the root binds the number of leaves. h .update ([ 0x02 ]); h .update ( n .to_be_bytes ()); Without the first, a leaf hash could be presented as if it were a node of the tree. Without the second you get the classic ambiguity of trees with an odd number of leaves: two different sets can produce the same root. It is an old, well-kn
This is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security. […] The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm. That unit has been associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack. The reports do not establish that every listed graduate participated in a named operation; assignments should therefore be described as reported unit placements, not proof of individual operational involvement...
Open a page and it can start guessing which browser extensions you run before you click a thing. Not "extensions in general" - which ones . Your password manager, your ad blocker, the wallet, the internal tool your employer ships, the accessibility extension you depend on. The page never asks and you never see it happen. This is not a bug in Chrome. It is the sum of a few features working exactly as designed, and the people best placed to close it are extension authors who mostly do not know they left it open. I maintain an extension and a library that talks to it, so I have spent real time on the detectable side of this. Here is how a page does it, what the answer is worth to whoever is asking, and what actually stops it. Technique one: ask the extension directly Some extensions accept messages from web pages on purpose - our own does, so a customer's "report a bug" button can tell whether the extension is there. The API is chrome.runtime.sendMessage : chrome . runtime . sendMessage ( EXTENSION_ID , { type : ' ping ' }, ( reply ) => { if ( reply ) { // it is installed, and it answered } }); For a page to be allowed to send that message, the extension has to list the page's origin in its manifest, under externally_connectable . Authors who want their extension to work with any site reach for the wildcard: "externally_connectable" : { "matches" : [ "<all_urls>" ] } And that one line is the door. <all_urls> does not mean "my customers' sites". It means every site on the internet may now open a channel to this extension - which means every site may ping it and learn whether you have it. The convenience the author wanted for their own pages, they handed to everybody's. This technique is narrow, because it only finds extensions that chose to talk to pages. The next one is not narrow. Technique two: knock on the extension's own files Extensions ship assets - icons, injected stylesheets, images. Any asset marked web-accessible is reachable at a fixed URL built from the ext