Geek-Guy.com

Month: January 2025

Lightning AI Studio Vulnerability Allowed RCE via Hidden URL Parameter

Cybersecurity researchers have disclosed a critical security flaw in the Lightning AI Studio development platform that, if successfully exploited, could allow for remote code execution. The vulnerability, rated a CVSS score of 9.4, enables “attackers to potentially execute arbitrary commands with root privileges” by exploiting a hidden URL parameter, application security firm Noma said in…

FBI takes down Cracked.to and Nulled.to in a global law enforcement operation

FBI has taken down Cracked.to, Nulled.to, and a few other hack sites cybercriminals use for dropping stolen credentials, software cracks, and remote desktop hacks in a coordinated law enforcement operation. In Operation Talent, several domains suspected of facilitating hacking activities have been busted with a law-enforcement “seizure” notice now showing up on their landing. “This…

Major AI Security Breach: DeepSeek’s Database Exposed Sensitive Data

DeepSeek is a Chinese artificial intelligence startup that has recently garnered significant attention for its AI chatbot, which rivals leading models like OpenAI’s ChatGPT. DeepSeek has encountered several issues recently. The U.S. Navy has banned its members from using the DeepSeek app due to concerns over potential security and ethical issues, fearing that sensitive user…

DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked

Buzzy Chinese artificial intelligence (AI) startup DeepSeek, which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data. The ClickHouse database “allows full control over database operations, including the ability to access internal data,”…

India lauds Chinese AI lab DeepSeek, plans to host its models on local servers

India’s IT minister on Thursday praised DeepSeek‘s progress and said the country will host the Chinese AI lab’s large language models on domestic servers, in a rare opening for Chinese technology in India. “You have seen what DeepSeek has done — $5.5 million and a very very powerful model,” IT Minister Ashwini Vaishnaw said on…

Cybersecurity Responsibilities Across the C-Suite: A Breakdown for Every Executive

Cybersecurity is no longer just an IT issue—it’s a business imperative that affects every department within an organization. Organizations must direct the responsibility for security beyond the Chief Information Security Officer (CISO) to all leaders throughout the C-Suite because cyber threats evolve and regulations grow strict. Each executive within the company contributes to enhancing security…

Unpatched PHP Voyager Flaws Leave Servers Open to One-Click RCE Exploits

Three security flaws have been disclosed in the open-source PHP package Voyager that could be exploited by an attacker to achieve one-click remote code execution on affected instances. “When an authenticated Voyager user clicks on a malicious link, attackers can execute arbitrary code on the server,” Sonar researcher Yaniv Nizry said in a write-up published…

What is Magecart? How this hacker group steals payment card data

Magecart definition Magecart is a consortium of malicious hacker groups who target online shopping cart systems, usually the Magento system, to steal customer payment card information. This is known as a supply chain attack. The idea behind these attacks is to compromise a third-party piece of software from a VAR or systems integrator or infect…

New Aquabot Botnet Exploits CVE-2024-41710 in Mitel Phones for DDoS Attacks

A Mirai botnet variant dubbed Aquabot has been observed actively attempting to exploit a medium-severity security flaw impacting Mitel phones in order to ensnare them into a network capable of mounting distributed denial-of-service (DDoS) attacks. The vulnerability in question is CVE-2024-41710 (CVSS score: 6.8), a case of command injection in the boot process that could…

European embedded banking startup Swan adds another $44 million to its Series B

French startup Swan has raised another €42 million (around $44 million at current exchange rates). The company considers this round as the second part of the Series B round that was originally announced in September 2024. Swan helps other companies offer financial products at scale. The company can generate both virtual and physical cards that…

American CISOs should prepare now for the coming connected-vehicle tech bans

In a groundbreaking shift in automotive supply chain regulation, the White House announced a new rule issued by the Commerce Department’s Bureau of Industry and Security (BIS) a week before the end of the Biden administration that will ban in-vehicle connectivity system (VCS) hardware and software from China (including Hong Kong) or Russia from US…

5 teure Threat-Intelligence-Fehler

Fehlgeleitete Threat-Intelligence-Programme lassen (nicht nur) Ihr Security-Budget schmelzen. Vitalii Stock | shutterstock.com Ausgeprägte Fähigkeiten im Bereich Threat Intelligence (TI) können dazu beitragen, Ihre Cybersecurity-Initiative auf die nächste Stufe zu heben. Das kann nicht nur dabei helfen, Bedrohungen schneller zu erkennen – Sicherheitsentscheider können so außerdem ihre Risikoexposition besser verstehen und künftige Investitionen priorisieren. Kein Wunder…

SoftBank in talks to invest as much as $25B in OpenAI, report says

SoftBank is in talks to invest up to $25 billion in OpenAI as part of a broader partnership that could see the Japanese conglomerate spend more than $40 billion on AI initiatives with the Microsoft-backed startup, according to Financial Times. The potential investment would make SoftBank OpenAI’s largest single backer, the report said, surpassing Microsoft…

New Mirai botnet fires off DDoS attacks via compromised Mitel phones, notifies command & control when detected

A third variant of the Mirai-based Aquabot malware is apparently taking over Mitel phones to create a remote-controlled botnet that can fire off distributed denial of service (DDoS) attacks.  Dubbed Aquabotv3, the malware is actively exploiting a known vulnerability in the devices to  access their session initiation protocol (SIP) function, according to Akamai’s Security Intelligence…

Meta says end of fact-checking hasn’t impacted ad spend

Meta says its controversial decision to put an end to its fact-checking program hasn’t impacted advertiser spend. On its Q4 2024 call, Meta CFO Susan Li assured investors that advertiser demand remains strong and the company’s commitment to brand safety remains unchanged, despite the new measures. Meanwhile, CEO Mark Zuckerberg noted that the community notes…

Smashing Security podcast #402: Hackers get hacked, the British Museum IT shutdown, and social media kidnaps

What happens when eager computer enthusiasts unknowingly download a trojanized hacking tool and find themselves on the wrong side of cybersecurity? A former employee’s actions led to chaos and raise urgent questions about the security of cultural treasures. And join us as we explore the alarming trend of social media influencers staging fake kidnappings. All…

LinkedIn passes $2B in premium revenues in 12 months, with overall revenues up 9% on the year

LinkedIn, the social platform where people look for and talk about work, may be less visible in Microsoft’s earnings compared to the years when it was an independent company. But around earnings time, LinkedIn often reveals some figures that point to how it continues to grow.  On Wednesday, as Microsoft reported its Q2 numbers, the…

Threads adds another 20M monthly users since December, reaching 320M

Threads, Meta’s microblogging service, is growing at a fast pace as users gravitate to the app over rivals like X. During the company’s fourth-quarter earnings presentation on Wednesday, CEO Mark Zuckerberg revealed that Threads now has 320 million monthly active users (MAUs), up from 300 million last month. The app had 275 million monthly active…

Ensuring Compliance with Secure Secrets Vaulting

Why is Secure Secrets Vaulting a Critical Factor? The requirement to manage Non-Human Identifiers (NHIs) and their secrets with utmost precision is more vital than ever. With the surge of massive amounts of data traversing through numerous channels, wouldn’t you agree that the need to secure these volumes is of paramount importance? One of the…

Empower Your Security with Advanced NHI Detection

Why is NHI Detection Crucial in Today’s Cybersecurity Landscape? Imagine being able to mitigate security risks, meet regulatory compliance, save on operational costs, and increase efficiency, all by refining one aspect of your cybersecurity strategy. Sounds promising, doesn’t it? This is precisely what effective Non-Human Identities (NHIs) detection and management can accomplish for your organization.…

Scalable Solutions for Global Secrets Management

Are Your Secrets Secure in a Cloud World? Where robust digital identities govern access to resources, the effective management of Non-Human Identities (NHIs) becomes paramount. But how significantly does the approach to secure these identities and their secrets impact global cloud security? As a result, is it possible that scalable solutions for global secrets management…

Staying Ahead with Enhanced IAM Protocols

Staying Ahead in a Fraught Landscape? Is it possible to stay ahead with cybersecurity threats? With the increased digitization of systems, our reliance on machines has skyrocketed, necessitating the need for an enhanced Identity Access Management (IAM) strategy. Addressing this need, Non-Human Identity (NHI) and Secrets Security Management emerges as a critical component of a…

Alibaba’s Qwen 2.5-Max: The AI Marathoner Outpacing DeepSeek and Catching OpenAI’s Shadow

Discover how Alibaba’s Qwen 2.5-Max AI model with Mixture-of-Experts architecture outperforms DeepSeek V3 in key benchmarks, challenges OpenAI, and revolutionizes healthcare, finance, and content creation. Explore technical breakthroughs and industry implications. The post Alibaba’s Qwen 2.5-Max: The AI Marathoner Outpacing DeepSeek and Catching OpenAI’s Shadow appeared first on Security Boulevard.

Threat actors using Google Gemini to amplify attacks: Report

Government-backed threat actors are currently using Google’s Gemini AI service to expand their capabilities, part of an effort by hackers of all skill levels to leverage publicly-available generative artificial intelligence (genAI) models for crime and espionage, That’s the conclusion of a report issued today by Google’s Threat Intelligence Group, which shows how threat actors are…

ServiceNow Launches New Agentic AI Offerings, Google Cloud, Oracle & Visa Partnerships

ServiceNow has continued its commitment to deploying and leveraging agentic AI with new offerings announced in conjunction with its earnings call in late January. The company also unveiled new partnerships following recent changes to its partner program. Agentic AI ‘control tower’ built to centralize a slew of custom and pre-built agents The key piece of…

Microsoft brings a DeepSeek model to its cloud

Microsoft’s close partner and collaborator, OpenAI, might be suggesting that DeepSeek stole its IP and violated its terms of service. But Microsoft still wants DeepSeek’s shiny new models on its cloud platform. Microsoft today announced that R1, DeepSeek’s so-called reasoning model, is available on Azure AI Foundry service, Microsoft’s platform that brings together a number…

Joe Lonsdale’s 8VC seeking $1B for new fund

8VC, a venture firm led by Palantir founder Joe Lonsdale, is seeking nearly $1 billion for its sixth fund, according to a regulatory filing. The Austin-based firm’s latest fund aims to raise nearly 14% more than its previous $880 million flagship vehicle, which closed in February 2023. TechCrunch has reached out to the firm for…

FBI seizes major cybercrime forums in coordinated domain takedown

The Federal Bureau of Investigation, along with several other international law enforcement departments, has seized control of several high-profile online platforms linked to cybercrime in a sweeping operation aimed at disrupting digital marketplaces for stolen credentials and hacking tools. The domains of forums Cracked[.]io and Nulled[.]to now redirect to FBI-controlled servers, signaling efforts to dismantle…

DeepSeek might have a trademark problem in the U.S.

Chinese AI company DeepSeek has been accused of IP theft, faced privacy inquiries in Europe, and has been the target of an enormous cyberattack. Now, it appears the company has a new headache on its hands: a U.S. trademark conflict. On Tuesday, DeepSeek filed an application with the U.S. Patent and Trademark Office (USPTO) seeking…

What DeepSeek, China, and Trump mean for Apple ahead of its Q1 earnings

These days, nothing is certain about the tech market or the world at large. Even NVIDIA’s seemingly bulletproof stock took a hammering on Monday, enduring a $589 billion market cap decline after China-based DeepSeek raised questions for investors about more efficient AI models. But Apple’s stock has remained steady ahead of its first quarter earnings…

DeepSeek Chatbot Beats OpenAI on App Store Leaderboard

The Chinese firm said training the model cost just $5.6 million. Alibaba Cloud followed with a new generative AI model, while Microsoft alleges DeepSeek ‘distilled’ OpenAI’s work.

MoviePass might pivot to crypto

After MoviePass’s historic implosion, subscribers to the “Netflix for movie theaters” were already cautious around the company’s 2023 relaunch. These moviegoers may grow even more skeptical after MoviePass sent out an email blast on Wednesday, which surveyed customers about their interest in web3. “Artificial Intelligence and Blockchain technologies are transforming the business landscape at an unprecedented…

Introducing WAF Rule Tester: Test with Confidence, Deploy without Fear | Impart Security

Security teams can now validate WAF rules before they hit production, thanks to Impart Security’s new WAF Rule Tester. No more crossing fingers and hoping for the best when deploying new rules. The Old Way: Hope-Driven Security ‍ Traditionally, testing WAF rules has been a nerve-wracking experience: – Push rules to production in monitor mode…

The OWASP NHI Top 10 and AI risk: What you need to know

Identity management has long been a pillar of any sound cybersecurity program, ensuring that only authorized persons and machines have access to specific data and systems. Today, the rapid adoption of artificial intelligence (AI) is making it much more complicated to manage the identities of machines, making the appearance of the OWASP Non-Human Identities Top…

Omega Systems CEO on PE Funding, Compliance Offerings & Channel Innovation

Omega Systems is a premier technology solutions provider and MSSP based across the northeastern U.S. After years of partnership with one private equity group, Omega announced in January it had received a new infusion from the firm Revelstoke. Channel Insider spoke with Omega Systems CEO Mike Fuhrman to learn more about how the continued equity…

Waymo reportedly testing robotaxis in 10 new cities in 2025

Waymo plans to start testing autonomous vehicles in 10 new cities this year, starting with Las Vegas and San Diego, according to The Verge. Although this doesn’t mean the company will launch commercial operations in any of these cities — or even test them in autonomous mode. Waymo told The Verge it will send less…

Instagram gives creators more insight into their reels’ performance

Meta continues to target creators in the days following the U.S. TikTok ban. In addition to paying TikTok creators big bonuses to publish reels, Instagram announced on Wednesday that it’s introducing new ways for creators to better understand how their short videos are performing. The platform is introducing additional metrics that allow creators to see…

Anthropic’s CEO says DeepSeek shows that U.S. export rules are working as intended

In an essay on Wednesday, Dario Amodei, the CEO of Anthropic, weighed in on the debate over whether Chinese AI company DeepSeek’s success implies that U.S. export controls on AI chips aren’t working. Amodei, who recently made the case for stronger export controls in an op-ed co-written with former U.S. deputy national security advisor Matt…

Report: Majority of U.S. teens have lost trust in Big Tech

American teens have lost their faith in Big Tech, according to a new report from Common Sense Media, a nonprofit offering reviews and ratings for media and technology, which more recently includes AI products. In the study released Wednesday, the organization surveyed over 1,000 teens on whether major technology companies like Google, Apple, Meta, TikTok,…

Netflix adds a convenient feature for iOS users to download an entire TV season at once

Netflix announced on Wednesday that it’s giving iOS users a new feature that allows them to download an entire season of their favorite TV show with one tap. The feature first became available to Android users.  The Season Download button is available in the Netflix app, located next to the Share button on a show’s…

Health insurance startup Alan keeps growing at a rapid pace

With its 700,000 customers, Alan could be considered as a mature company. But the health insurance company that wants to become a digital companion for your health is still growing like a startup. On Wednesday, the company shared some financial metrics. The most impressive one is its top-line revenue. In 2024, the company generated €505…

Resolution Games announces Battlemarked, an upcoming VR Dungeons & Dragons game

Last year, Wizards of the Coast and Resolution Games announced an exciting development: Dungeons & Dragons (D&D), the popular tabletop role-playing game (RPG), is being adapted for virtual reality.  Until now, specific details about the new game have been kept closely under wraps. However, on Wednesday, the companies finally unveiled the official title and more…

Lazarus Group Uses React-Based Admin Panel to Control Global Cyber Attacks

The North Korean threat actor known as the Lazarus Group has been observed leveraging a “web-based administrative platform” to oversee its command-and-control (C2) infrastructure, giving the adversary the ability to centrally supervise all aspects of their campaigns. “Each C2 server hosted a web-based administrative platform, built with a React application and a Node.js API,” SecurityScorecard’s

Ireland and Italy send data watchdog requests to DeepSeek: ‘The data of millions of Italians is at risk’

The jury is still out on whether the Chinese AI upstart DeepSeek is a game changer or part of an elaborate plan by its hedge fund parent company to short Nvidia and other tech stocks. Whichever it might be (maybe both?), DeepSeek and its large language model have made some major waves. And now, it’s…