Securing the Journey: Cybersecurity Challenges in the Tourism Industry

This weekend is World Tourism Day, a celebration of the global travel industry and the cultural, economic, and social connections it fosters. However, as the tourism industry continues to grow and evolve, it faces an increasing array of cybersecurity threats. From data breaches targeting personal...

Neon App pays users to record their phone calls, sells data for AI training [updated]

TechCrunch reports about a “bizarre app” inviting you to record and share your audio calls so that it can sell the data to AI companies. And if that’s not weird enough on its own, it’s ranking No. 2 in Apple's US app store at the time of writing. The name of the app is Neon Mobile and it promises...

A Global Analysis of Cyber Threats to the Energy Sector: "Currents of Conflict" from a Geopolitical Perspective

The escalating frequency and sophistication of cyber threats increased the need for their comprehensive understanding. This paper explores the intersection of geopolitical dynamics, cyber threat intelligence analysis, and advanced detection technologies, with a focus on the energy domain. We...

Red Teaming Quantum-Resistant Cryptographic Standards: A Penetration Testing Framework Integrating AI and Quantum Security

This study presents a structured approach to evaluating vulnerabilities within quantum cryptographic protocols, focusing on the BB84 quantum key distribution method and National Institute of Standards and Technology NIST approved quantum-resistant algorithms. By integrating AI-driven red teaming,...

CVE-2025-59408

Flock Safety Bravo Edge AI Compute Device BRAVO00.00local20241017 ships with Secure Boot disabled. This allows an attacker to flash modified firmware with no cryptographic protections...

What 400 Executives Reveal About the Future of AI Adoption

Learn how a Forrester study discovered that most companies are already using AI for competitive differentiation, personalization, and customer retention...

CVE-2025-10360

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

ForcedLeak Flaw in Salesforce Agentforce AI Agent Exposed CRM Data

Cybersecurity firm Noma Security reveals ForcedLeak, a critical flaw in Salesforce Agentforce that allowed data theft. Learn what companies need to do now to secure AI agents...

CVE-2025-59402

The Flock Safety Bravo Edge AI Compute Device (version BRAVO_00.00_local_20241017 ) is vulnerable because it accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. An attacker with physical access can exploit this to flash arbitrary firmware, dump partitions, and bypass both...

CVE-2025-10360 Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models

Cybersecurity researchers have disclosed two security flaws in Wondershare RepairIt that exposed private user data and potentially exposed the system to artificial intelligence AI model tampering and supply chain risks. The critical-rated vulnerabilities in question, discovered by Trend Micro, ar...

Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models

Cybersecurity researchers have disclosed two security flaws in Wondershare RepairIt that exposed private user data and potentially exposed the system to artificial intelligence AI model tampering and supply chain risks. The critical-rated vulnerabilities in question, discovered by Trend Micro, ar...

This Is How Your LLM Gets Compromised

Poisoned data. Malicious LoRAs. Trojan model files. AI attacks are stealthier than ever—often invisible until it’s too late. Here’s how to catch them before they catch you...

This Week in Spring - September 23rd, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm preparing my talks for several amazing shows including: Commit Your Code conference in Plano, Texas starting tomorrow; Dev2Next in Colorado; Devoxx Belgium in Antwerp, Belgium; and CloudFoundry Days in Germany. So much go...

AI-Powered App Exposes User Data, Creates Risk of Supply Chain Attacks

Trend™ Research’s analysis of Wondershare RepairIt reveals how the AI-driven app exposed sensitive user data due to unsecure cloud storage practices and hardcoded credentials, creating risks of model tampering and supply chain attacks...

Centralized Vs. Decentralized Security for Space AI Systems? A New Look

This paper investigates the trade-off between centralized and decentralized security management in constellations of satellites to balance security and performance. We highlight three key AI architectures for automated security management: a centralized, b distributed and c federated. The...

AI Forensics Help Europol Track 51 Children in Global Online Abuse Case

Europol and 18 countries used AI forensics to identify 51 child victims and 60 suspects in a global online abuse investigation...

How to Gain Control of AI Agents and Non-Human Identities

We hear this a lot: "We've got hundreds of service accounts and AI agents running in the background. We didn't create most of them. We don't know who owns them. How are we supposed to secure them?" Every enterprise today runs on more than users. Behind the scenes, thousands of non-human identitie...

Static Security Vulnerability Scanning of Proprietary and Open-Source Software: an Adaptable Process with Variants and Results

Software vulnerabilities remain a significant risk factor in achieving security objectives within software development organizations. This is especially true where either proprietary or open-source software OSS is included in the technological environment. In this paper an end-to-end process with...

ChatGPT Deep Research zero-click vulnerability fixed by OpenAI

OpenAI has moved quickly to patch a vulnerability known as “ShadowLeak” before anyone detected real-world abuse. Revealed by researchers yesterday, ShadowLeak was an issue in OpenAI’s Deep Research project that attackers could exploit by simply sending an email to the target. Deep Research was...