XM Cyber’s Post

SmartSearch WP <= 2.4.4 & Unauthenticated Stored XSSThe Chatbot with ChatGPT ...The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against adminsSmartSearch WP &lt;= 2.4.4 & Unauthenticated Stored XSSThe Chatbot with ChatGPT ...

At this point scammers have to be using LLMs to be way more convincing at scale, right? How do you fix that? Cloudflare talks about using a training set of 3.4 billion emails [1] to train their detection models but I suspect "scam email" could be indistinguishable to genuine ones without the right real world context now. Could it finally be time for PGP keys in email to get big or do we just teach people to ignore emails in favor of some other form of messaging? Wait a minute, I already ignore email. Am I a trendsetter?! Finally. [1] https://lnkd.in/d4PCvgdM

As cybersecurity professionals, it's hard to keep up with the latest security news. To make things easier, I automated it. 🚀 Check out my latest article on creating a Discord news bot that scrapes the latest cybersecurity news from BleepingComputer and posts it directly to your Discord channel. This setup keeps you updated with timely notifications right on your phone. 📱🔔 Get the code and read more about how you can set this up so that you too can stay ahead in the cybersecurity world: https://lnkd.in/gfbEgsRk

In light of recent findings on Microsoft 365 Copilot vulnerabilities, how can organizations effectively mitigate risks from prompt injection attacks, especially considering advanced techniques like ASCII smuggling? One thing is clear, Security Awareness Training needs to be a top priority.

Microsoft issues guidance on how best to hit back against Kerberoasting AD attacks Kerberoasting is growing more effective, forcing Microsoft to react.

The latest update for #Netacea includes "Calculating the ROI of Effective #BotManagement" and "SEO Poisoning Part 1: Understanding SEO Poisoning and Its Impact". #cybersecurity #cyberprotection https://lnkd.in/e7VaJUw

🚀 𝗕𝗼𝗼𝘀𝘁𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀 𝗜𝗺𝗮𝗴𝗲 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆: 𝗪𝗵𝗶𝘁𝗲𝗹𝗶𝘀𝘁𝗶𝗻𝗴 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝗶𝗲𝘀 & 𝗜𝗺𝗮𝗴𝗲𝗣𝘂𝗹𝗹𝗦𝗲𝗰𝗿𝗲𝘁𝘀 🔐 Did you know that securing your Kubernetes images isn't just about using private registries? There are some under-the-radar practices that can take your image security to the next level! Let’s talk about whitelisting registries and ImagePullSecrets. 🔍 1. 𝗪𝗵𝗶𝘁𝗲𝗹𝗶𝘀𝘁𝗶𝗻𝗴 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝗶𝗲𝘀: Stay One Step Ahead of Malicious Actors Most people focus on securing their code, but what about the source of your container images? Whitelisting specific registries ensures your cluster only pulls images from trusted sources. This drastically reduces the risk of pulling compromised or malicious images. 💡 Pro Tip: Did you know that you can use Admission Controllers like 𝘐𝘮𝘢𝘨𝘦𝘗𝘰𝘭𝘪𝘤𝘺𝘞𝘦𝘣𝘩𝘰𝘰𝘬 to reject images from unknown registries before they even reach your cluster? It's like a security gate at your Kubernetes door! 🛡️ 🔑 2. 𝗜𝗺𝗮𝗴𝗲𝗣𝘂𝗹𝗹𝗦𝗲𝗰𝗿𝗲𝘁𝘀: Unlock Private Registries Securely When you're using private registries, ImagePullSecrets make sure only authenticated pods can pull images. This prevents unauthorized access and ensures you're pulling the correct, safe images into your environment. 👉 Best Practice: Store your secrets securely and rotate them regularly to stay ahead of any security breaches. And always use PodSecurityPolicies for tighter control! 🔐 💥 Bonus Tip 💥 🔔 𝗪𝗵𝗶𝘁𝗲𝗹𝗶𝘀𝘁 𝗦𝗽𝗲𝗰𝗶𝗳𝗶𝗰 𝗜𝗺𝗮𝗴𝗲 𝗧𝗮𝗴𝘀! Not many are aware, but you can limit image pulls to specific tags from approved registries to ensure you’re running the exact version you expect. This reduces the risk of accidentally running untested or insecure versions. What’s your go-to method for securing your Kubernetes images? Let’s connect and discuss your strategies in the comments! 👇 #KubernetesSecurity #DevSecOps #ContainerSecurity #K8s #ImagePullSecrets #CloudNative

In case you missed it: In this article, we'll demonstrate how to effectively use Google Dorking to uncover hidden and sensitive information on websites. Google Dorking provides an immense advantage for everyone who uses the Internet regularly. We'll provide practical examples of how to use it manually and automatically to unlock the full power of search engines. Google Dorking enables security researchers to proactively discover and address potentially sensitive information that might not be intended for public access. Read the post: https://lnkd.in/eYfP3Akf #dorking #⁠googledorking #hacking #pentesting #infosec #informationsecurity #cybersecurity