Monday hit like a cron job with anger issues.
A busted auth path here, a repo-side faceplant there, some “patched-ish” thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI lowering the bar for people who already thought ‘curl | sh’ had a personality.
The vibe is simple: old
via The Hacker News https://ift.tt/fakAgvS
Here is the link to our review for the GL.iNet router and others: https://cloudseclabs.com/most-insecure-soho-routers-and-what-to-upgrade-to-in-2026/
As cloud infrastructure becomes increasingly integral to business operations, organizations face a rapidly evolving threat landscape dominated by AI-powered attacks and sophisticated supply chain vulnerabilities. The shift toward hybrid and multi-cloud environments has created new security gaps, forcing enterprises to rethink traditional perimeter-based defenses in favor of zero-trust architectures and continuous verification protocols. Identity and access management has emerged as the critical battleground, with stolen credentials and compromised credentials remaining the leading vectors for unauthorized cloud access. While advancements in encryption, behavioral analytics, and automated threat response have strengthened defenses, the shortage of skilled security professionals continues to leave many organizations under-resourced and reactive rather than proactive. Looking ahead, success in cloud security will require a combination of emerging technologies, cultural shifts toward security-first mindsets, and strategic investment in both tools and talent.
As more organizations integrate vibe coding and AI-assisted coding into their application development processes, it’s important to remember to put security first.
from darkreading https://ift.tt/7Q6y8jg
via IFTTT
Why every company needs a clear, enforceable AI policy — now.
from darkreading https://ift.tt/g4ln5jX
via IFTTT
Organizations increasingly use agents to automate mundane tasks and address an overwhelming amount of sensitive data. However, adoption requires strict security strategies that keep humans in the loop for now.
from darkreading https://ift.tt/6v2ODL8
via IFTTT
Securing AI systems represents cybersecurity’s next frontier, creating specialized career paths as organizations grapple with novel vulnerabilities, regulatory requirements, and cross-functional demands.
from darkreading https://ift.tt/jM8lZiJ
via IFTTT
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
from SANS Internet Storm Center, InfoCON: green https://ift.tt/wtOWN8H
via IFTTT
In recent media events, Tesla has demoed progressively more sophisticated versions of its Optimus robots. The sales pitch is pretty simple: "Current AI" is fun, but what we really need is not something to create more funny kitten pictures. We need AI to load and empty dishwashers, fold laundry, and mow lawns. But the robot has not been for sale yet, and there is no firm release date.
In the past, Tesla has accepted preorders for future products, asking for a deposit, which in some cases was even refundable. But aside from an April Fool's posting announcing such a presale, as far as I can tell, no presale has been offered by Tesla.
However, if you search for "Optimus Tesla preorder" and other similar terms, sites claiming to offer Optimus preorders will be advertised.
These are sponsored listings. The official Tesla site (without the preorder option) shows below these fake links.
We have often seen sponsored listings like this used to advertise malware. But in this case, I suspect, the goal is simply to steal money from people willing to pay for preorders. The interesting twist is that the theft may remain unnoticed until the customer expects delivery, which may be months or years from now.
So far, I have seen these ads lead to three different websites:
Other suspect domains:
The sites display a complete copy of a slightly older design of the Tesla.com website. As far as I can tell, the design does not include a login page. Standard phishing does not appear to be the goal here. Not having a login page may make it easier to hide that no orders are being placed. Customers will not be able to use the fake site to check their order status.
It asks for a $250 non-refundable deposit, which aligns with what Tesla asked for in prior preorder events.
I tried to place an order with a test credit card number, and it was accepted, showing that the credit card was not charged (yet?). Next, I was directed to auth.cp-tesla.com to set up an account. I never received the e-mail confirmation, so I am not sure if my spam filters dropped it or if it is supposed to fail. The original Tesla site uses "auth.tesla.com" for authentication.
Setting up credit card processing for a fake site is likely too complicated, and I assume the site just collects the payment card data to later use the cards on other sites for fraudulent orders or just to resell the payment card data (are there still "Carder" forums? Have not looked at that in a while). So far, the fake sites have only been available for a few days before being shut down. I assume that Tesla monitors these sites and sends takedown requests as they find them.
Preorders are accepted not only for Optimus robots but also for other Tesla products. Interestingly, the data is sent to different sites, not just to the original site. One URL used is https://ift.tt/L5wjOts. There are a few open directory listings on offers-tesla.com (for example,/api and /js). File dates are from March and May 2025, which is likely around the time the Tesla site was copied. The fake site is hosted behind Cloudflare.
—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Social Media Links: https://jbu.me
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
from SANS Internet Storm Center, InfoCON: green https://ift.tt/uaWwJbs
via IFTTT
Cybersecurity researchers have uncovered a jailbreak technique to bypass ethical guardrails erected by OpenAI in its latest large language model (LLM) GPT-5 and produce illicit instructions.
Generative artificial intelligence (AI) security platform NeuralTrust said it combined a known technique called Echo Chamber with narrative-driven steering to trick the model into producing undesirable
from The Hacker News https://ift.tt/7NqE6r9
via IFTTT