OpenAI Atlas Omnibox Is Vulnerable to Jailbreaks
The danger with jailbreaks comes from them being a process methodology rather than an isolated bug.
Once the process is discovered, the potential for abuse is limited only by the attacker’s imagination and skill.
But there are three immediate implications: the successful process can override user intent, can trigger cross-domain actions, and can bypass safety layers.
Cyber_Security_Channel
The danger with jailbreaks comes from them being a process methodology rather than an isolated bug.
Once the process is discovered, the potential for abuse is limited only by the attacker’s imagination and skill.
But there are three immediate implications: the successful process can override user intent, can trigger cross-domain actions, and can bypass safety layers.
Cyber_Security_Channel
SecurityWeek
OpenAI Atlas Omnibox Is Vulnerable to Jailbreaks
Researchers have discovered that a prompt can be disguised as an url, and accepted by Atlas as an url in the omnibox.
❤6👍1
Throwback №2: JLR Extends Production Halt After Cyber-Attack
The cause of the disruption lies in the fact that modern automotive manufacturers operate a ‘just-in-time’ logistics and parts supply strategy.
Rather than stockpiling parts, interconnected third party systems receive updates for stock deliveries for vehicles that are being manufactured at the JLR sites.
Some small businesses within the wider JLR supply chain rely solely on JLR for contracts.
Cyber_Security_Channel
The cause of the disruption lies in the fact that modern automotive manufacturers operate a ‘just-in-time’ logistics and parts supply strategy.
Rather than stockpiling parts, interconnected third party systems receive updates for stock deliveries for vehicles that are being manufactured at the JLR sites.
Some small businesses within the wider JLR supply chain rely solely on JLR for contracts.
Cyber_Security_Channel
Infosecurity Magazine
JLR Extends Production Halt After Cyber-Attack
Jaguar Land Rover (JLR) has confirmed that its pause in production will last until at least Wednesday, September 24
❤3👍2
Hacktivist Attacks on Critical Infrastructure Surge: Cyble Report
Russia-aligned hacktivist groups INTEID, Dark Engine, Sector 16, and Z-Pentest were responsible for the majority of recent ICS attacks, primarily targeting Energy & Utilities, Manufacturing, and Agriculture sectors across Europe.
Their campaigns focused on disrupting industrial and critical infrastructure in Ukraine, EU and NATO member states.
Cyber_Security_Channel
Russia-aligned hacktivist groups INTEID, Dark Engine, Sector 16, and Z-Pentest were responsible for the majority of recent ICS attacks, primarily targeting Energy & Utilities, Manufacturing, and Agriculture sectors across Europe.
Their campaigns focused on disrupting industrial and critical infrastructure in Ukraine, EU and NATO member states.
Cyber_Security_Channel
Cyble
Hacktivist Attacks On Critical Infrastructure Surge In Q3 2025
Hacktivist attacks on industrial control systems nearly doubled in Q3 2025, with Russia-aligned groups targeting critical sectors across Europe and beyond.
👍4❤2
Google Pays $100,000 in Rewards for Two Chrome Vulnerabilities
Google says it paid $130,000 in total for the bugs fixed with the release of Chrome 142.
While no bounties will be awarded for five issues, the company has yet to disclose the amounts to be handed out for two defects.
Cyber_Security_Channel
Google says it paid $130,000 in total for the bugs fixed with the release of Chrome 142.
While no bounties will be awarded for five issues, the company has yet to disclose the amounts to be handed out for two defects.
Cyber_Security_Channel
SecurityWeek
Google Pays $100,000 in Rewards for Two Chrome Vulnerabilities
The two bugs are high-severity type confusion and inappropriate implementation issues in the browser’s V8 JavaScript engine.
❤5👍3
State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack
The attacks, the cybersecurity firm said, did not appear linked to the cloud backup incident.
However, the sensitive information stored in the stolen files poses a high risk for the impacted organizations.
Cyber_Security_Channel
The attacks, the cybersecurity firm said, did not appear linked to the cloud backup incident.
However, the sensitive information stored in the stolen files poses a high risk for the impacted organizations.
Cyber_Security_Channel
SecurityWeek
State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack
The threat actor stole the firewall configuration files of all SonicWall customers who used the cloud backup service.
👍4❤3🔥1
Useful Material: Getting a Grip on Digital Identity
Identity really is sort of the tip of the spear of watching for breaches, because there will be failures probing an identity that will give you indicators that something bad is going to happen before it happens.
Once they have the authenticated identity, then it's really damaging.
But if you can see the leading indicators, you can get in front of it, and I think this is where AI is going to really help
Cyber_Security_Channel
Identity really is sort of the tip of the spear of watching for breaches, because there will be failures probing an identity that will give you indicators that something bad is going to happen before it happens.
Once they have the authenticated identity, then it's really damaging.
But if you can see the leading indicators, you can get in front of it, and I think this is where AI is going to really help
Cyber_Security_Channel
IT Pro
Getting a grip on digital identity
As AI agent adoption explodes, security leaders will need better identity controls than ever before
👍4❤2
🔴 Live Stream Announcement!
Join Mauro Eldritch to dissect FunkLocker; AI-powered #FunkSec ransomware behind 120+ attacks across North America and Asia.
Get actionable insights and learn to detect a full attack chain in minutes.
🕒 When: Nov 12, 3:00 PM, UTC
🔔 Set a reminder and tune in: https://www.youtube.com/live/PiWOtiYs25s?si=8CT55R0mxTFkQafx
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
Join Mauro Eldritch to dissect FunkLocker; AI-powered #FunkSec ransomware behind 120+ attacks across North America and Asia.
Get actionable insights and learn to detect a full attack chain in minutes.
🕒 When: Nov 12, 3:00 PM, UTC
🔔 Set a reminder and tune in: https://www.youtube.com/live/PiWOtiYs25s?si=8CT55R0mxTFkQafx
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤5👍4🔥4
Fresh, Just In: Many Forbes AI 50 Companies Leak Secrets on GitHub
Wiz’s scans also covered members and contributors of the core organization that could inadvertently expose company secrets in their own public repositories.
In addition, the scans targeted less common AI-related secrets that may be missed by traditional scanners.
Cyber_Security_Channel
Wiz’s scans also covered members and contributors of the core organization that could inadvertently expose company secrets in their own public repositories.
In addition, the scans targeted less common AI-related secrets that may be missed by traditional scanners.
Cyber_Security_Channel
SecurityWeek
Many Forbes AI 50 Companies Leak Secrets on GitHub
Wiz found the secrets and warned that they can expose training data, organizational structures, and private models.
👍8❤2
📣 Webinar: GenAI in Cybersecurity and Cybercrime
Join ImmuniWeb webinar to enhance your ImmuniWeb® AI Platform skills, earn CPE credits, and qualify to become ImmuniWeb® Certified Professional.
Key insights that will be covered:
• Emerging AI laws and regulations to consider
• Overall state of GenAI trends and developments
• GenAI in cybercrime: myths, realities and threats
• GenAI in cybersecurity: myths, risks and benefits
• Hacking AI-powered apps: OWASP Top 10 for LLMs
→ Date & Time: November 20 at 10am, 5pm and 9pm CET.
→ Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
Registration is open:
Session 1 – November 20, 2025
Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – November 20, 2025
Geneva 5pm | New York 11am | California 8am
👉 Click here.
Session 3 – November 20, 2025
Geneva 9pm | New York 3pm | California 12pm
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
Join ImmuniWeb webinar to enhance your ImmuniWeb® AI Platform skills, earn CPE credits, and qualify to become ImmuniWeb® Certified Professional.
Key insights that will be covered:
• Emerging AI laws and regulations to consider
• Overall state of GenAI trends and developments
• GenAI in cybercrime: myths, realities and threats
• GenAI in cybersecurity: myths, risks and benefits
• Hacking AI-powered apps: OWASP Top 10 for LLMs
→ Date & Time: November 20 at 10am, 5pm and 9pm CET.
→ Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
Registration is open:
Session 1 – November 20, 2025
Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – November 20, 2025
Geneva 5pm | New York 11am | California 8am
👉 Click here.
Session 3 – November 20, 2025
Geneva 9pm | New York 3pm | California 12pm
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤5🔥3
August Spotlight: Australia’s TPG Telecom Investigating iiNet Hack
The investigation is ongoing, but the company has determined that the hackers have exfiltrated email addresses, phone numbers and other types of data from the compromised system.
Cyber_Security_Channel
The investigation is ongoing, but the company has determined that the hackers have exfiltrated email addresses, phone numbers and other types of data from the compromised system.
Cyber_Security_Channel
SecurityWeek
Australia’s TPG Telecom Investigating iiNet Hack
TPG Telecom has disclosed a cybersecurity incident after discovering unauthorized access to an iiNet order management system.
❤3
Google Finds Malware Connecting to AI Large Language Models to Hone Attacks
One of the attacks, dubbed Quietvault, has been designed to steal login credentials from a Windows PC while leveraging "an AI prompt and on-host installed AI CLI [command line interface] tools to search for other potential secrets on the infected system.
Another malware strain, called Promptflux, appears to be experimental work by hackers. It stands out by tapping Google’s Gemini chatbot to modify its computer code to avoid detection.
“The most novel component of PROMPTFLUX is its ‘Thinking Robot’ module, designed to periodically query Gemini to obtain new code for evading antivirus software,
Cyber_Security_Channel
One of the attacks, dubbed Quietvault, has been designed to steal login credentials from a Windows PC while leveraging "an AI prompt and on-host installed AI CLI [command line interface] tools to search for other potential secrets on the infected system.
Another malware strain, called Promptflux, appears to be experimental work by hackers. It stands out by tapping Google’s Gemini chatbot to modify its computer code to avoid detection.
“The most novel component of PROMPTFLUX is its ‘Thinking Robot’ module, designed to periodically query Gemini to obtain new code for evading antivirus software,
Cyber_Security_Channel
PCMAG
Google Finds Malware Connecting to AI Large Language Models to Hone Attacks
The company is warning about newly discovered malware, including 'Promptflux' and 'Promptsteal,' that use generative AI. But one prominent researcher is questioning the findings.
👍5
👨💻 SOC Leader’s Playbook: 3 Steps to Faster MTTR
Get actionable tips in a Live Webinar on November 25.
In this session, ANY.RUN experts will demonstrate how to:
• Eliminate the alert fatigue
• Achieve a 3x performance boost
• Ensure early detection of new attacks
• Reduce MTTR by 21 minutes per incident
✔️ Who should attend?
SOC leaders, security managers, CISOs, and analysts of all tiers looking to improve their security posture.
Join a FREE webinar → click here to register.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
Get actionable tips in a Live Webinar on November 25.
In this session, ANY.RUN experts will demonstrate how to:
• Eliminate the alert fatigue
• Achieve a 3x performance boost
• Ensure early detection of new attacks
• Reduce MTTR by 21 minutes per incident
✔️ Who should attend?
SOC leaders, security managers, CISOs, and analysts of all tiers looking to improve their security posture.
Join a FREE webinar → click here to register.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤7👏3🔥2
Newly Identified Android Spyware Appears to be From a Commercial Vendor
The Android spyware, dubbed LANDFALL, exploited a zero-day, or previously undocumented, vulnerability in Galaxy phones’ image processing libraries.
The spyware was likely sent via the WhatsApp messaging platform to exfiltrate data and snoop on targets.
The vulnerability was privately reported to Samsung in September 2024 but the company did not release a firmware update to fix it until April 2025.
Cyber_Security_Channel
The Android spyware, dubbed LANDFALL, exploited a zero-day, or previously undocumented, vulnerability in Galaxy phones’ image processing libraries.
The spyware was likely sent via the WhatsApp messaging platform to exfiltrate data and snoop on targets.
The vulnerability was privately reported to Samsung in September 2024 but the company did not release a firmware update to fix it until April 2025.
Cyber_Security_Channel
therecord.media
Newly identified Android spyware appears to be from a commercial vendor
Researchers spotted a 9-month-long campaign involving previously undiscovered spyware they call LANDFALL, which leveraged a zero-day bug in Samsung Galaxy phones.
👍2🔥2❤1🤯1
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
As soon as the card details, along with the expiration data and CVV number, are entered, the page attempts to process a transaction in the background...
While a "support chat" window appears on the screen with steps to complete a supposed "3D Secure verification for your credit card" to secure against fake bookings.
📷 Photo Credit: Dreamstime
Cyber_Security_Channel
As soon as the card details, along with the expiration data and CVV number, are entered, the page attempts to process a transaction in the background...
While a "support chat" window appears on the screen with steps to complete a supposed "3D Secure verification for your credit card" to secure against fake bookings.
📷 Photo Credit: Dreamstime
Cyber_Security_Channel
❤13👀7👍1🤬1🤮1
Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks
BadAudio is deployed as a DLL and uses search order hijacking for execution.
Recent versions have been dropped in archives also containing VBS, BAT, and LNK files, designed to automate the malware’s placement, to achieve persistence, and trigger the DLL’s sideloading.
Cyber_Security_Channel
BadAudio is deployed as a DLL and uses search order hijacking for execution.
Recent versions have been dropped in archives also containing VBS, BAT, and LNK files, designed to automate the malware’s placement, to achieve persistence, and trigger the DLL’s sideloading.
Cyber_Security_Channel
SecurityWeek
Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks
APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads.
👍6❤4🔥2👏2
Back in August: 6.4 million Bouygues Telecom customers just had their data exposed in a huge data breach – and it's the second to hit French telecoms operators in a month
Never share your usernames and passwords.
Be particularly wary of calls from fake bank advisors who may try to gain your trust by giving your name or account number.
If in doubt, end the call and call your bank or bank advisor back at their usual number.
Cyber_Security_Channel
Never share your usernames and passwords.
Be particularly wary of calls from fake bank advisors who may try to gain your trust by giving your name or account number.
If in doubt, end the call and call your bank or bank advisor back at their usual number.
Cyber_Security_Channel
IT Pro
6.4 million Bouygues Telecom customers just had their data exposed in a huge data breach – and it's the second to hit French telecoms…
A broad range of customer data was exposed, according to Bouygues Telecom
❤7👍2🤯1
Chrome Sandbox Escape Earns Researcher $250,000
$250,000 is the maximum reward that Google is prepared to pay out for a Chrome sandbox escape vulnerability, but the amount can only be earned for a submission that includes a high-quality report with demonstration of remote code execution.
Cyber_Security_Channel
$250,000 is the maximum reward that Google is prepared to pay out for a Chrome sandbox escape vulnerability, but the amount can only be earned for a submission that includes a high-quality report with demonstration of remote code execution.
Cyber_Security_Channel
SecurityWeek
Chrome Sandbox Escape Earns Researcher $250,000
A researcher has been given the highest reward in Google’s Chrome bug bounty program for a sandbox escape with remote code execution.
1👍3❤2🤯2
Securing The Human Layer: Modernising Workforce Authentication
Attackers are using increasingly sophisticated techniques, including credential spraying, brute-force attacks and malware that intercepts passwords and one-time passwords (OTPs).
Additionally, push-bombing or MFA fatigue attacks overwhelm users with mobile push authentication prompts, increasing the likelihood of accidental approval.
These vulnerabilities highlight the urgent need to move away from legacy authentication methods, which consistently fail to prevent breaches and expose organizations to financial, reputational and operational harm.
Cyber_Security_Channel
Attackers are using increasingly sophisticated techniques, including credential spraying, brute-force attacks and malware that intercepts passwords and one-time passwords (OTPs).
Additionally, push-bombing or MFA fatigue attacks overwhelm users with mobile push authentication prompts, increasing the likelihood of accidental approval.
These vulnerabilities highlight the urgent need to move away from legacy authentication methods, which consistently fail to prevent breaches and expose organizations to financial, reputational and operational harm.
Cyber_Security_Channel
BW People
Securing The Human Layer: Modernising Workforce Authentication
The cyberthreat landscape is rapidly evolving, with attackers leveraging advanced phishing campaigns, credential-stuffing attacks and deepfake-enabled social engineering to target organizations. These sophisticated tactics have exposed the limitations of…
👍3❤1
⚡️University of Pennsylvania Confirms New Data Breach After Oracle Hack
University of Pennsylvania disclosed another breach in late October 2025, after a hacker compromised internal systems and stole data on Penn's development and alumni activities.
The attacker claimed they exfiltrated personal information belonging to roughly 1.2 million students, alumni, and donors.
Institution noted that the attackers exploited a previously unknown security vulnerability.
@Cyber_Security_Channel
University of Pennsylvania disclosed another breach in late October 2025, after a hacker compromised internal systems and stole data on Penn's development and alumni activities.
The attacker claimed they exfiltrated personal information belonging to roughly 1.2 million students, alumni, and donors.
Institution noted that the attackers exploited a previously unknown security vulnerability.
@Cyber_Security_Channel
BleepingComputer
University of Pennsylvania confirms new data breach after Oracle hack
The University of Pennsylvania (Penn) has confirmed a new data breach after attackers stole documents containing personal information from its Oracle E-Business Suite servers in August.
👍4❤2
📣 Webinar: Cybersecurity Law, Regulations and Compliance
Enhance your ImmuniWeb® AI Platform skills, earn CPE credits & qualify to become ImmuniWeb® Certified Professional.
Key insights:
• Recent developments in data protection, privacy law
• Cybersecurity requirements, penalties personal liability for non-compliance
• Strategies to reduce legal risks
• Insurance pitfalls & ways to avoid them
• Best data breach investigation practices & disclosure in 2026
• How cybersecurity compliance services by ImmuniWeb can help
→ When: December 11 at 10am, 5pm and 9pm CET.
→ Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
Registration is open:
Session 1 – December 11, 2025
Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – December 11, 2025
Geneva 5pm | New York 11am | California 8am
👉 Click here.
Session 3 – December 11, 2025
Geneva 9pm | New York 3pm | California 12pm
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
Enhance your ImmuniWeb® AI Platform skills, earn CPE credits & qualify to become ImmuniWeb® Certified Professional.
Key insights:
• Recent developments in data protection, privacy law
• Cybersecurity requirements, penalties personal liability for non-compliance
• Strategies to reduce legal risks
• Insurance pitfalls & ways to avoid them
• Best data breach investigation practices & disclosure in 2026
• How cybersecurity compliance services by ImmuniWeb can help
→ When: December 11 at 10am, 5pm and 9pm CET.
→ Host: Dr. Ilia Kolochenko, CEO & Chief Architect at ImmuniWeb, Attorney-at-Law.
Registration is open:
Session 1 – December 11, 2025
Geneva 10am | Dubai 1pm | Singapore 5pm
👉 Click here.
Session 2 – December 11, 2025
Geneva 5pm | New York 11am | California 8am
👉 Click here.
Session 3 – December 11, 2025
Geneva 9pm | New York 3pm | California 12pm
👉 Click here.
-----
#ad #paidpromotion #sponsored
@Cyber_Security_Channel
❤3🔥1
Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors
All gained ‘Featured’ and ‘Verified’ statuses from Google, before the threat actor weaponized them with a malicious update in mid-2024.
One of them, Clean Master, had more than 300,000 installs.
The update essentially transformed the extensions into a remote code execution framework, Koi says.
Every hour, the extensions would check an external server for instructions and execute arbitrary JavaScript code, with full browser API access.
Cyber_Security_Channel
All gained ‘Featured’ and ‘Verified’ statuses from Google, before the threat actor weaponized them with a malicious update in mid-2024.
One of them, Clean Master, had more than 300,000 installs.
The update essentially transformed the extensions into a remote code execution framework, Koi says.
Every hour, the extensions would check an external server for instructions and execute arbitrary JavaScript code, with full browser API access.
Cyber_Security_Channel
SecurityWeek
Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors
The extensions were seen profiling users, reading cookie data to create unique identifiers, and executing payloads with browser API access.
❤2💩1