Vulnerabilities (5)
CISA has mandated that US federal agencies urgently patch two critical Microsoft SharePoint vulnerabilities (CVE-2025-49706 and CVE-2025-49704) by July 23, following attacks by Chinese hackers. These flaws allow unauthorized access and remote code execution on SharePoint servers. Microsoft has released updates, urging all users to patch immediately.
Security experts warn of risks like data theft and persistent access. The directive underscores the persistent threat from APT groups, stressing the importance of swift patch management to protect government and critical infrastructure from cyber threats.
Source: The Hacker News
CISA has mandated that US federal agencies urgently patch two critical Microsoft SharePoint vulnerabilities (CVE-2025-49706 and CVE-2025-49704) by July 23, following attacks by Chinese hackers. These flaws allow unauthorized access and remote code execution on SharePoint servers. Microsoft has released updates, urging all users to patch immediately.
Security experts warn of risks like data theft and persistent access. The directive underscores the persistent threat from APT groups, stressing the importance of swift patch management to protect government and critical infrastructure from cyber threats.
Source: The Hacker News
Researchers from three US universities discovered that AI coding assistants frequently recommend fake software packages that don't exist - a problem they've dubbed "slopsquatting." Hackers can exploit this by creating malicious packages with these hallucinated names, tricking developers into downloading compromised code.
The study tested 16 popular AI models and found none were immune. Commercial models hallucinated packages 5.2% of the time, while open-source models hit 21.7%. Out of 2.23 million generated packages, nearly 20% were fake.
This creates a dangerous supply chain attack where malicious code could infect entire software projects. The researchers suggest better prompt engineering and model training to address the issue.
Source: Security Week
Researchers from three US universities discovered that AI coding assistants frequently recommend fake software packages that don't exist - a problem they've dubbed "slopsquatting." Hackers can exploit this by creating malicious packages with these hallucinated names, tricking developers into downloading compromised code.
The study tested 16 popular AI models and found none were immune. Commercial models hallucinated packages 5.2% of the time, while open-source models hit 21.7%. Out of 2.23 million generated packages, nearly 20% were fake.
This creates a dangerous supply chain attack where malicious code could infect entire software projects. The researchers suggest better prompt engineering and model training to address the issue.
Source: Security Week
