ADMIN.FOUNDATION

  • OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data

    ·

    , ,

    Security researchers have successfully extracted the system prompt from OpenAI’s Sora 2 video generation model by exploiting cross-modal vulnerabilities, with audio transcription proving to be the most effective extraction method. Sora 2, OpenAI’s state-of-the-art multimodal model for generating short video content, was thought to keep its system prompt secure. However, researchers discovered that by chaining […]

    The post OpenAI Sora 2 Vulnerability Allows Exposure of Hidden System Prompts from Audio Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Multiple GitLab Vulnerabilities Let Attackers Inject Malicious Prompts to Steal Sensitive Data

    ·

    , ,

    GitLab has released urgent security patches addressing multiple vulnerabilities affecting both the Community Edition and the Enterprise Edition.

    The company released versions 18.5.2, 18.4.4, and 18.3.6 to fix critical security issues that could allow attackers to compromise sensitive information and bypass access controls.

    The most concerning vulnerability involves prompt injection attacks in GitLab Duo’s review feature. Attackers can inject hidden malicious prompts directly into merge request comments.

    These hidden instructions trick the AI system into leaking sensitive information from confidential issues. This vulnerability affects GitLab Enterprise Edition versions 17.9 and later, potentially exposing classified project data to unauthorized users.

    Beyond prompt injection, GitLab patched nine additional vulnerabilities ranging from high to low severity.

    CVE IDVulnerability TitleTypeSeverityCVSS Score
    CVE-2025-11224Cross-site scripting issue in k8s proxyXSSHigh7.7
    CVE-2025-11865Incorrect Authorization issue in workflowsAuthorization BypassMedium6.5
    CVE-2025-2615Information Disclosure issue in GraphQL subscriptionsInformation DisclosureMedium4.3
    CVE-2025-7000Information Disclosure issue in access controlInformation DisclosureMedium4.3
    CVE-2025-6945Prompt Injection issue in GitLab Duo reviewPrompt InjectionLow3.5
    CVE-2025-6171Information Disclosure issue in packages API endpointInformation DisclosureLow3.1
    CVE-2025-11990Client Side Path Traversal issue in branch namesPath TraversalLow3.1
    CVE-2025-7736Improper Access Control issue in GitLab PagesAccess ControlLow3.1
    CVE-2025-12983Denial of service issue in markdownDenial of ServiceLow3.1

    A cross-site scripting (XSS) vulnerability in the Kubernetes proxy allows authenticated users to execute malicious scripts, affecting versions 15.10 and later.

    An authorization bypass in workflows lets users remove AI flows belonging to other users, compromising workflow integrity. Information disclosure vulnerabilities also pose serious risks.

    Attackers can access sensitive data through multiple vectors: blocked users establishing GraphQL subscriptions, unauthorized viewing of branch names through access control weaknesses, and information leakage via the packages API endpoint, even when repository access is disabled.

    Additional vulnerabilities include path-traversal issues affecting branch names, improper access control in GitLab Pages that allows OAuth authentication bypasses, and denial-of-service attacks via specially crafted Markdown content.

    GitLab strongly recommends upgrading to the patched versions immediately. The company has already updated GitLab.com, and GitLab Dedicated customers require no action.

    Self-managed installations must prioritize immediate upgrades, as these vulnerabilities directly affect customer data security. The patches include database migrations that may affect upgrade processes.

    Single-node instances will experience downtime during updates, while multi-node installations can implement zero-downtime upgrades using proper procedures.

    GitLab researchers discovered most vulnerabilities through the HackerOne bug bounty program. The company commits to releasing security details 30 days after each patch on its public issue tracker.

    All affected organizations should review their current GitLab versions and deploy patches without delay to protect against these escalating security threats.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple GitLab Vulnerabilities Let Attackers Inject Malicious Prompts to Steal Sensitive Data appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fake Chrome Extension “Safery” Steals Ethereum Wallet Seed Phrases Using Sui Blockchain

    ·

    Cybersecurity researchers have uncovered a malicious Chrome extension that poses as a legitimate Ethereum wallet but harbors functionality to exfiltrate users’ seed phrases. The name of the extension is “Safery: Ethereum Wallet,” with the threat actor describing it as a “secure wallet for managing Ethereum cryptocurrency with flexible settings.” It was uploaded to the Chrome Web Store on

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Multiple Kibana Vulnerabilities Enables SSRF and XSS Attacks

    ·

    , , ,

    Elastic Security has disclosed critical vulnerabilities affecting Kibana that could enable attackers to execute Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks against vulnerable deployments.

    The vulnerabilities stem from inadequate origin validation in the Observability AI Assistant component.

    The primary vulnerability, tracked as CVE-2025-37734 under Elastic Security Advisory ESA-2025-24, involves an origin validation error in Kibana.

    This flaw allows attackers to forge Origin HTTP headers, bypassing security controls designed to prevent unauthorized requests from external sources.

    By exploiting this weakness, malicious actors can craft requests that trick Kibana into sending requests to unintended destinations or executing unintended actions.

    FieldDetails
    CVE IDCVE-2025-37734
    Vulnerability TypeOrigin Validation Error (SSRF)
    CVSS Score4.3 (Medium)
    Attack VectorNetwork
    Affected Versions8.12.0-8.19.6, 9.1.0-9.1.6, 9.2.0
    Patch Versions8.19.7, 9.1.7, 9.2.1

    The SSRF vulnerability enables attackers to access internal network resources or services that should remain isolated from external access.

    This can lead to information disclosure, lateral movement within networks, or further exploitation of backend systems.

    The vulnerability affects multiple Kibana versions, making it a widespread concern for organizations running affected deployments.

    Require Immediate Patching

    Elastic researchers report that the vulnerability only affects deployments actively using the Observability AI Assistant feature. The vulnerability impacts: Kibana 8.12.0 through 8.19.6, Kibana 9.1.0 through 9.1.6, and Kibana 9.2.0.

    Organizations without this component enabled are not affected by this flaw, which has a medium severity rating (CVSS v3.1 score of 4.3).

    While this may seem moderate, the impact should not be underestimated given the potential for unauthorized internal network access and data manipulation.

    Elastic has released patched versions addressing this vulnerability. Organizations should immediately upgrade to: Kibana 8.19.7, Kibana 9.1.7, and Kibana 9.2.1.

    Elastic Cloud Serverless customers are already protected, as continuous deployment and patching models remediated this vulnerability before public disclosure.

    Organizations unable to upgrade immediately should consider turning off the Observability AI Assistant feature until patches can be applied.

    Additionally, implementing network segmentation and access controls can help limit the potential impact of SSRF exploitation.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple Kibana Vulnerabilities Enables SSRF and XSS Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Defender for O365 New Feature Allows Security Teams to Trigger Automated Investigations

    ·

    , , ,

    Microsoft has rolled out enhanced remediation capabilities in Defender for Office 365 (O365), enabling security teams to initiate automated investigations and other actions directly from the Advanced Hunting interface.

    This feature, launched on November 10, 2025, empowers admins and analysts to respond to email threats more swiftly without requiring policy modifications.​

    The new actions Submit to Microsoft, add entries to the Tenant Allow/Block List, and Initiate Automated Investigation—were previously limited to the Threat Explorer tool but are now integrated into Advanced Hunting.

    This allows for programmatic threat hunting using custom Kusto Query Language (KQL) queries, streamlining workflows for security operations centers (SOCs).

    By bringing these tools together, Microsoft addresses customer feedback, reducing the time needed to triage and remediate malicious emails.​

    Microsoft Defender for O365

    Advanced Hunting, part of Microsoft Defender XDR, already provides deep visibility into cross-domain threats across email, endpoints, and identities. With this update, users can select query results and trigger responses contextually based on message delivery status, such as purging from inboxes or quarantines.

    For bulk selections exceeding 100 messages, options like email purge and proposed remediations remain available, ensuring scalability for large-scale incidents. Threat Explorer continues to operate independently, providing complementary views of real-time detections.​

    Microsoft Defender for O365
    Microsoft Defender for O365

    This rollout affects admins and security analysts leveraging Microsoft Defender XDR, with actions enabled by default across worldwide tenants.

    No user interface removal is possible, but existing administrative policies, including role-based access control (RBAC), are fully respected to maintain compliance. Organizations can scope access via the Microsoft 365 Defender portal under Settings > Permissions > Roles, preventing unauthorized use.​

    To prepare, teams should audit current hunting queries and integrate the new actions into playbooks for automated responses. Communicating these changes to SOC stakeholders and providing targeted training will minimize disruptions.

    For instance, updating documentation on initiating automated investigations can accelerate adoption, especially in environments handling high volumes of phishing or malware-laden emails.​

    The enhancement aligns with broader trends in automated investigation and response (AIR) in Defender for O365 Plan 2, where remediation clusters around malicious files or URLs for faster threat neutralization.

    By default, AIR actions require approval, but configurations for auto-remediation on message clusters can further reduce manual overhead, though clusters over 10,000 items prompt reviews. In Advanced Hunting schemas like EmailPostDeliveryEvents, auto-remediated items appear with ActionType “Automated Remediation” and ActionTrigger “Automation,” aiding forensic analysis.​

    This update maintains proactive defense in an era of sophisticated email-based attacks, such as ransomware and business email compromise.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Defender for O365 New Feature Allows Security Teams to Trigger Automated Investigations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Active Exploitation of Windows Kernel 0-Day Enabling Privilege Escalation

    ·

    , , ,

    The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about the active exploitation of a new zero-day vulnerability in Microsoft Windows. This security flaw, tracked as CVE-2025-62215, affects the Windows Kernel and could allow attackers to escalate their privileges if successfully exploited. Overview of the Vulnerability CVE-2025-62215 is a race condition vulnerability […]

    The post CISA Warns of Active Exploitation of Windows Kernel 0-Day Enabling Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration

    ·

    New York, New York, November 13th, 2025, CyberNewsWire BreachLock, a global leader in offensive security, just announced a powerful new integration with Vanta, the leading AI-powered trust management platform, enabling organizations to push security validation evidence directly into compliance workflows with a single click.  This integration bridges the gap between continuous security testing and compliance […]

    The post BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration

    ·

    New York, New York, November 13th, 2025, CyberNewsWire

    BreachLock, a global leader in offensive security, just announced a powerful new integration with Vanta, the leading AI-powered trust management platform, enabling organizations to push security validation evidence directly into compliance workflows with a single click. 

    This integration bridges the gap between continuous security testing and compliance by allowing mutual customers to connect the BreachLock Unified Platform to their Vanta environment.

    Users can automatically send security evidence from the BreachLock Unified Platform, including penetration testing reports, adversarial exposure validation (AEV) results, attack surface management (ASM) results, and more, into the appropriate Vanta control folders, eliminating manual uploads and user errors while significantly reducing audit preparation time. 

    Commenting on the addition of this integration, BreachLock Founder & CEO expressed, “Our clients shouldn’t have to waste time manually transferring evidence between BreachLock and Vanta,” adding, “This integration ensures that our mutual customers’ security findings are always audit-ready and aligned with frameworks like SOC 2 and ISO 27001 within their Vanta environments, effortlessly.” 

    “At Vanta, our mission is to support companies regardless of their tech stack,” said Chris Morris, Staff Product Manager at Vanta. “We’re excited for BreachLock’s integration and to support our mutual customers!” 

    The BreachLock Unified Platform supports modern Continuous Threat Exposure Management (CTEM) programs by unifying all CTEM-aligned tools and solutions modern security teams need, including both autonomous and human-led Penetration Testing as a Service (PTaaS), Adversarial Exposure Validation (AEV) for autonomous red teaming, and Attack Surface Management (ASM).

    This unified approach enables organizations to continuously discover, validate, and remediate exposures across their entire internal and external environments, including web, API, network, mobile, cloud assets, and more. 

    With the new BreachLock x Vanta integration, organizations can maintain always-current compliance evidence across all attack surfaces, supporting continuous security and compliance alignment. 

    Key Benefits of the Integration Include 

    • One-click evidence transfers from BreachLock to Vanta. 
    • Automatic alignment with SOC 2, ISO 27001, and other controls. 
    • Reduced manual effort and fewer errors during audit preparation. 
    • Continuous compliance support through CTEM and automated testing. 

    Setting up the integration is simple; users connect to Vanta directly from the BreachLock Platform and authorize BreachLock within Vanta, following a quick step-by-step setup process outlined in a recent blog post on the integration. 

    This collaboration between BreachLock and Vanta marks a significant step forward in unifying offensive security and compliance workflows, helping organizations stay not only secure but audit-ready year-round. 

    About BreachLock

    BreachLock is a global leader in offensive security, delivering scalable and continuous security testing.

    Trusted by global enterprises, BreachLock provides human-led and AI-powered Attack Surface Management, Penetration Testing as a Service (PTaaS), Red Teaming, and Adversarial Exposure Validation (AEV) solutions that help security teams stay ahead of adversaries. 

    With a mission to make proactive security the new standard, BreachLock is shaping the future of cybersecurity through automation, data-driven intelligence, and expert-driven execution.

    Contact

    Senior Marketing Executive

    Megan Charrois

    BreachLock

    megan.c@breachlock.com

    The post BreachLock and Vanta Bridge the Gap Between Continuous Security Testing and Compliance with New Integration appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Palo Alto PAN-OS Firewall Vulnerability Let Attackers Reboot Firewall by Sending Malicious Packet

    ·

    , , ,

    Palo Alto Networks has disclosed a critical denial-of-service vulnerability in its PAN-OS firewall software that allows unauthenticated attackers to remotely reboot firewalls by sending specially crafted packets.

    Tracked as CVE-2025-4619, the vulnerability poses significant risks to organizations relying on Palo Alto firewalls for network security.

    The flaw, identified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), exists in the PAN-OS software dataplane.

    Attackers can exploit this vulnerability without authentication, credentials, or user interaction. When successful, the malicious packet triggers an unexpected reboot of the firewall.

    More concerning, repeated exploitation attempts can force the firewall into maintenance mode. Severely interrupting network operations and potentially leaving organizations exposed to threats during downtime.

    AttributeValue
    CVE IDCVE-2025-4619
    ReferencePAN-247099
    Vulnerability TypeDenial of Service (DoS)
    WeaknessCWE-754: Improper Check for Unusual or Exceptional Conditions
    CVSS v4.0 Score6.6 (MEDIUM)
    CVSS-B Score8.7

    Palo Alto Networks assigned the vulnerability a CVSS 4.0 score of 6.6, rating it as MEDIUM severity with MODERATE urgency.

    However, the CVSS-B score reaches 8.7, reflecting the potential business impact. The attack vector is network-based and low-complexity.

    The vulnerability directly affects product availability, highlighting its potential to interrupt critical network infrastructure.

    PA-Series, VM-Series, and Prisma Access Deployments

    The vulnerability impacts PA-Series firewalls, VM-Series firewalls, and Prisma Access deployments running vulnerable PAN-OS versions. Cloud NGFW is not affected.

    Vulnerable versions include PAN-OS 10.2 (through 10.2.13), 11.1 (through 11.1.6), and 11.2 (through 11.2.4). PAN-OS 12.1 and 10.1 are unaffected.

    Importantly, exploitation requires a specific configuration: the firewall must have a URL proxy or a decrypt policy enabled; even with explicit no-decrypt policies, the vulnerability may be exploitable.

    Palo Alto Networks recommends upgrading to patched versions. For PAN-OS 11.2. Organizations should update to 11.2.5 or later.

    For 11.1, upgrade to 11.1.7. PAN-OS 10.2 users should patch to 10.2.14 or apply the appropriate urgency, depending on their current version. The company reports that no known workarounds currently exist.

    Currently, Palo Alto Networks has not identified any active malicious exploitation of this vulnerability. Administrators should prioritize patching given the ease of exploitation and potential operational impact.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Palo Alto PAN-OS Firewall Vulnerability Let Attackers Reboot Firewall by Sending Malicious Packet appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security

    ·

    The Race for Every New CVE Based on multiple 2025 industry reports: roughly 50 to 61 percent of newly disclosed vulnerabilities saw exploit code weaponized within 48 hours. Using the CISA Known Exploited Vulnerabilities Catalog as a reference, hundreds of software flaws are now confirmed as actively targeted within days of public disclosure. Each new announcement now triggers a global race

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶