A naukri.com initiative
Cyber Security News
Cheapsslshop
1d
329
Image Credit: Cheapsslshop
SSL Certificate for Subdomains: Which Certificate Does Your Website Need?
- Choosing the right SSL Certificate for Subdomains is crucial to ensure overall security and trust for your website.
- Businesses are now opting for Wildcard SSL Certificates to secure the primary domain and all its first-level subdomains with a single solution.
- SSL (Secure Socket Layer) or TLS (Transport Layer Security) encrypts data transmission between an internet server and a web browser, ensuring secure communication.
- Having SSL protection is important as it signifies a secure connection with websites starting with HTTPS, prioritized by modern browsers and search engines.
Read Full Article
18 Likes
Securityaffairs
1d
34
Image Credit: Securityaffairs
Apple released security updates to fix multiple flaws in iOS and macOS
- Apple released urgent security updates for iOS and macOS to fix critical vulnerabilities that could be exploited by attackers.
- The updates address flaws in AppleJPEG, CoreMedia, ImageIO, and WebKit components that could lead to memory corruption or unexpected crashes.
- iOS 18.5 update resolved multiple critical flaws, including file-parsing issues in CoreAudio, CoreGraphics, and ImageIO.
- Updates for macOS and other Apple devices were also released to address vulnerabilities in various components like mDNSResponder, Notes, FrontBoard, iCloud Document Sharing, and Mail Addressing.
Read Full Article
2 Likes
Cybersecurity-Insiders
1d
264
Image Credit: Cybersecurity-Insiders
Why Traditional Vulnerability Management Fails in the Cloud
- Traditional vulnerability and application security tools are struggling in cloud-native environments due to their inability to adapt to the dynamic nature of cloud environments.
- Scanning tools relying on static snapshots make it hard to track ephemeral assets, leading to noise, lack of risk prioritization, and ownership visibility for security teams.
- Recommended key considerations for effective vulnerability management in cloud environments include continuous asset discovery, integration of VM into DevOps, contextual prioritization, compliance management, and scalability.
- To address the challenges, it's advised to implement automated VM solutions for continuous discovery, prioritize based on context, ensure compliance, and focus on scalability, rather than relying solely on traditional scanning tools.
Read Full Article
15 Likes
Cybersecurity-Insiders
1d
272
Image Credit: Cybersecurity-Insiders
The CVE Crisis: Why Reactive Patching is Obsolete
- The escalation of CVEs poses a significant challenge, with over 140 identified daily.
- Challenges include expanded attack surfaces, stretched security teams, impaired prioritization, increased expenditures, and compromised regulatory compliance.
- Unpatched vulnerabilities increase the likelihood of successful data breaches by cybercriminals.
- The volume of CVEs can distort actual risk perceptions, making prioritization difficult.
- Failure to patch vulnerabilities can lead to legal repercussions and loss of trust, affecting compliance efforts.
- Current tools like DAST, SAST, and WAFs struggle with false positives and lack context in live environments.
- Complex patching environments with numerous applications present challenges in effective remediation.
- A proactive defense strategy is essential for prioritizing response based on actual risk and gaining control.
- Addressing the CVE crisis requires enriched CVE data, threat intelligence platforms, automation, and continuous monitoring.
- A layered defense approach is crucial to navigate the increasing vulnerability landscape and maintain regulatory compliance.
Read Full Article
16 Likes
Medium
2d
292
Image Credit: Medium
Why User Consent in Data Collection Matters for Privacy
- Data collection involves gathering user information to enhance services, tailor experiences, and serve ads, impacting privacy.
- Consent is crucial in data collection, requiring clear permission before using individual information and should be transparent.
- Bad consent practices include instances like smart glasses capturing data without explicit consent, raising privacy concerns.
- Governments are implementing laws to regulate data harvesting, but companies still find ways to bypass them, emphasizing the need for user awareness and responsible practices.
Read Full Article
17 Likes
Siliconangle
2d
234
Image Credit: Siliconangle
Rapid7 delivers solid first quarter but second quarter outlook falls short
- Rapid7 reported beats in its fiscal 2025 first quarter with diluted adjusted earnings per share of 49 cents and revenue of $210.3 million, up 3% year-over-year.
- Annual recurring revenue for Rapid7 was $837.2 million, up 4% year-over-year with 11,685 customers, up 2%.
- Rapid7 expanded exposure management capabilities by introducing sensitive data discovery across multi-cloud environments and an AI-powered vulnerability scoring system.
- For the second quarter, Rapid7 expects adjusted earnings per share of 43-46 cents on revenue of $211-213 million, falling short of analyst expectations.
Read Full Article
14 Likes
Siliconangle
2d
351
Image Credit: Siliconangle
Rapid7 delivers solid first quarter but outlook falls short
- Rapid7 reported beats in its fiscal 2025 first quarter with diluted adjusted earnings per share of 49 cents and revenue of $210.3 million, exceeding analyst expectations.
- The company ended the quarter with $837.2 million in annual recurring revenue and 11,685 customers, showing steady growth in its financial metrics.
- Rapid7 introduced enhancements like sensitive data discovery across multicloud environments and an AI-powered vulnerability scoring system to improve security capabilities.
- However, Rapid7's second-quarter revenue outlook of $211 million to $213 million fell short of analyst expectations, leading to a slight disappointment in the market.
Read Full Article
21 Likes
Hackernoon
2d
7
Image Credit: Hackernoon
Code Smell 300 - Package Hallucination
- Avoid hallucinated or fake packages that can compromise security and stability.
- Unsupervised coding with AI generators can lead to security risks, dependency confusion, and injection attacks.
- Solutions include validating package names, using trusted repositories, and monitoring for typos to prevent package poisoning.
- Package hallucination exposes applications to serious threats, but it can be mitigated by strict version control and thorough validation of dependencies.
Read Full Article
Like
VentureBeat
2d
54
Image Credit: VentureBeat
OpenAI just fixed ChatGPT’s most annoying business problem: meet the PDF export that changes everything
- OpenAI has introduced a new PDF export feature for its Deep Research tool, catering to enterprise customers and emphasizing on packaging capabilities for specific business problems.
- The PDF export enables users to download research reports with preserved formatting, tables, images, and clickable citations, targeting professional users who need to share polished research.
- This strategic move showcases OpenAI's shift towards enterprise markets and recognition of the importance of practical features over raw technical performance.
- Competitors like Perplexity and You.com have also entered the AI research assistant market with features focusing on speed, comprehensiveness, and workflow integration.
- The rapid evolution in AI product development is emphasizing user experience and integration for enterprise tools, rather than just technical capabilities.
- PDF export addresses critical enterprise adoption requirements by bridging the gap between AI and traditional business communication, verifiability, and shareability.
- OpenAI's focus on seamless integration into existing workflows with practical features signifies a mature phase in AI tool evolution towards practical business applications.
- The significance lies in how AI tools can be effectively leveraged within organizations by addressing specific workflow problems with minimal disruption.
- In enterprise markets, the balance between innovation and practicality is crucial for AI vendors to drive widespread adoption within organizations.
- The introduction of PDF export for Deep Research reflects OpenAI's strategic positioning to cater to enterprise needs by focusing on usability and integration into existing processes.
- As AI tools advance, features that ease integration into daily work processes become key drivers for adoption, highlighting the importance of packaging AI capabilities effectively.
Read Full Article
3 Likes
Medium
2d
152
Image Credit: Medium
Why I Couldn’t Stay Silent Any Longer
- The author expresses regret for staying silent amidst a world tilting towards rights being rolled back and dissent being subdued.
- The absence and retreat from Radiant Vigilance are recognized as a costly silence that can no longer be afforded.
- The author highlights the escalating erosion of rights, families being adversely affected, and laws being bent, warning that crucial lines may have already been crossed.
- Emphasizing the importance of shining light through the cracks in the system, the author vows to no longer stay silent and commits to documenting the truth.
Read Full Article
9 Likes
Idownloadblog
2d
164
Image Credit: Idownloadblog
iOS 18.5 patches 30+ security vulnerabilities in Mail, Notes, FaceTime, iCloud document sharing and more
- Install iOS 18.5 on your Apple devices to patch over 30 security vulnerabilities in various applications like Mail, Notes, FaceTime, and iCloud document sharing.
- Updates include new features like Mail changes, new wallpapers, and a Screen Time password notification along with essential security patches.
- iOS 18.5 addresses vulnerabilities in AppleJPEG, Baseband, Call History, Core Bluetooth, FaceTime, iCloud Document Sharing, and more to enhance user security.
- Apple recommends updating to iOS 18.5, iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, and other patches to protect against potential security risks across various Apple devices.
Read Full Article
9 Likes
The Register
2d
109
Image Credit: The Register
Why aggregating your asset inventory leads to better security
- Aggregating IT assets leads to better security by providing a comprehensive view of an organization's ecosystem and identifying critical gaps that may leave them vulnerable to breaches.
- Disparate security tools in enterprises can create fragmented reports, leading to incomplete visibility and integration.
- By aggregating data from various systems, security leaders can uncover discrepancies in asset figures and control inventory.
- Analyzing aggregated data can reveal missing security tool protections on devices, outdated vulnerability assessments, and unmanaged users with access to sensitive data.
- Gaps in security tools' coverage are often not visible when evaluated in isolation, emphasizing the importance of aggregating asset inventory for a more accurate security posture.
- Unclear pictures of what needs to be secured due to unmanaged devices and missing security tools pose a significant challenge in cybersecurity.
- Aggregating asset inventory provides a single source of truth for IT inventory, exposing blind spots in control environment and enhancing operational efficiency.
- By ensuring critical controls are consistently applied across all assets, organizations can proactively mitigate risks and address vulnerabilities in real time.
- Organizations can justify control investments by establishing a full inventory of assets, enabling a better defense with tools already in use.
- Better security starts with better inventory management, providing enhanced visibility, tool integration, and actionable insights to strengthen the security posture.
- Pete Constantine, with expertise in endpoint security products, leads product development at Prelude Security, focusing on empowering teams to evaluate security tool coverage, configuration, and efficacy.
Read Full Article
6 Likes
Pymnts
2d
243
Image Credit: Pymnts
EU Member States Face Funding Shortages to Enforce AI Act
- EU member states are facing funding shortages to enforce the EU AI Act, as many countries are financially strained and losing AI talent to private companies offering higher salaries.
- Enforcement of the AI Act is challenging due to the lack of capital and expertise in member nations which are required to understand and regulate AI technologies effectively.
- The EU AI Act, passed in July 2024, aims to protect people's safety and rights, prevent discrimination, and build trust in AI technology, with enforcement starting this year.
- The Act categorizes AI systems based on risk levels, banning unacceptable systems, imposing strict rules on high-risk applications, and requiring transparency for limited-risk systems like chatbots.
Read Full Article
14 Likes
Securityaffairs
2d
62
Image Credit: Securityaffairs
Researchers found one-click RCE in ASUS’s pre-installed software DriverHub
- Two vulnerabilities were found in DriverHub, pre-installed on Asus motherboards, allowing remote code execution via crafted HTTP requests.
- The vulnerabilities, CVE-2025-3462 and CVE-2025-3463, were discovered by security researcher 'MrBruh' and could be exploited by a remote attacker to gain arbitrary code execution.
- The flaws in DriverHub stem from insufficient validation, enabling misuse of features such as accepting requests from unauthorized domains.
- Asus released security updates on May 9 in response to MrBruh's report, as the researcher highlighted the potential for remote code execution through the flawed DriverHub.
Read Full Article
3 Likes
Pymnts
2d
90
Image Credit: Pymnts
NY State Budget Provides New BNPL Oversight
- New York state introduced legislation to provide oversight to the pay later sector as part of Gov. Kathy Hochul’s new budget.
- The legislation aims to bolster consumer protection by establishing a licensing and supervision framework for BNPL providers, including disclosure requirements and data privacy protections.
- The state budget also includes measures requiring businesses to make it easier for consumers to cancel subscriptions and online retailers to provide easily accessible return and refund policies.
- While New York implements new BNPL regulations, federal BNPL regulation is being rolled back as the Consumer Financial Protection Bureau rescinds its proposal to treat pay later providers like credit card companies.
Read Full Article
5 Likes
For uninterrupted reading, download the app