'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets

A PNG hiding a prompt injection could steal your repo's secrets, researchers demonstrate. The technique, dubbed 'Ghostcommit, ...

‘GitLost’ vulnerability let GitHub’s AI workflows leak private repositories

GitHub Inc.’s new Agentic Workflows feature that allowed an unauthenticated attacker to siphon data from private code ...
GitHub

proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21. - https://www.zerodayinitiative.com/blog/2023/4 ...
SecurityWeek

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Zscaler found attackers using SEO poisoning and hidden prompts in malicious websites to manipulate AI agents into making cryptocurrency payments.
latesthackingnews.com

Programming Languages for Cyber Security: What the Tools Actually Use

Security tooling is not written in a single language. Python powers most automation. C sits at the exploit layer. PowerShell ...
IEEE

PROGESI: A PROxy Grammar to Enhance Web Application Firewall for SQL Injection Prevention

Abstract: A web application is prone to security threats due to its open nature. The security of these platforms is imperative for organizations of all sizes because they store sensitive information.
IEEE

CID4IoT: IoT-Oriented Command Injection Vulnerability Detection Based on Critical Code Extraction and LLM Analysis

Abstract: The Internet of Things (IoT) devices have brought invaluable convenience to our daily lives. However, they also introduce significant security challenges. Common vulnerabilities in numerous ...