Help Net Security دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۸:۲۷

ARTEX goes from pentesting tool to attacker staple in three months

A security researcher’s AI agent breached an internal sales application used by WorkOS’s go-to-market teams, the developer platform provider confirmed on Friday. “The researcher was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment. Its interaction with WorkOS was unintended,” WorkOS said. The researcher confirmed that they deleted and did not further…

Penetration Testing

Read the full article at Help Net Security Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

Help Net Security دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۸:۲۴

Hackers abuse refrigeration controllers to send spam and route proxy traffic

Internet-exposed refrigeration controllers used in supermarkets and cold storage facilities are being hijacked and turned into infrastructure for a suspected spam botnet and proxy services, SecurityScorecard has found. The report follows a string of attacks against European refrigeration systems, which Help Net Security started covering in October, when hundreds of French supermarkets had to throw out spoiled stock a…

Botnet & DDoS Hardware & Chips

Source

Help Net Security دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۶:۵۳

PyPI makes release attestations easier to find with new security tab

The Python Package Index (PyPI) has added a security tab to its project pages, giving developers a place to check where individual release files came from. How PyPI shows where release files came from The Security tab shows whether release files have digital attestations, which provide verifiable information about how a file was published or built. A release has full provenance when every file has at least one attest…

Programming & Languages

Source

Help Net Security دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۵:۱۷

Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million

Three men allegedly used deepfakes of company CEOs and law firm attorneys to trick employees into wiring more than $129 million to accounts the group controlled, the Justice Department said. The indictment names the three as Jacob Soall, 41, Sharon Hazan, 54, and Guy Sheetrit, 42. Soall used the alias “Rocky Balboa,” and Hazan went by “Superman Cash,” “Impossible Mission” and “Fat Boy,” among others. The scheme ran f…

Source

Help Net Security دوشنبه ۱۸ آبان ۱۴۰۵ · ۱۴:۰۰

Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN log…

Vulnerabilities & Zero-Day Identity & Access Security

Source