Trusted Identities for AI Agents: Leveraging Telco-Hosted ESIM Infrastructure

The rise of autonomous AI agents in enterprise and industrial environments introduces a critical challenge: how to securely assign, verify, and manage their identities across distributed systems. Existing identity frameworks based on API keys, certificates, or application-layer credentials lack t...

Dell ECS 信任管理问题漏洞

Dell ECS is an enterprise-class object storage solution from Dell Technologies. Dell ECS suffers from an information disclosure vulnerability that originates from the system failing to properly validate certificates. An attacker could exploit the vulnerability to cause an information disclosure...

The Evolution of Zero Trust Architecture (ZTA) from Concept to Implementation

Zero Trust Architecture ZTA is one of the paradigm changes in cybersecurity, from the traditional perimeter-based model to perimeterless. This article studies the core concepts of ZTA, its beginning, a few use cases and future trends. Emphasising the always verify and least privilege access, some...

On the Feasibility of Using MultiModal LLMs to Execute AR Social Engineering Attacks

Augmented Reality AR and Multimodal Large Language Models LLMs are rapidly evolving, providing unprecedented capabilities for human-computer interaction. However, their integration introduces a new attack surface for social engineering. In this paper, we systematically investigate the feasibility...

A Scalable Framework for Post-Quantum Authentication in Public Key Infrastructures

This work explores the performance and scalability of a hierarchical certificate authority framework with automated certificate issuance employing post-quantum cryptographic PQC signature algorithms. The system is designed for compatibility with both classical and PQC algorithms, promoting...

CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm giving an online talk on AI and trust for the Weizenbaum Institute on April 24, 2025 at 2:00 PM CEST 8:00 AM ET. The list is maintained on this page...

Siemens License Server（SLS） 信任管理问题漏洞

Siemens License Server SLS is a tool for managing and distributing licenses for Siemens software products from Siemens AG, Germany. A trust management issue vulnerability exists in Siemens License Server SLS versions prior to V4.3 that stems from not properly restricting user privileges, which...

⚡ Weekly Recap: VPN Exploits, Oracle's Silent Breach, ClickFix Surge and More

Today, every unpatched system, leaked password, and overlooked plugin is a doorway for attackers. Supply chains stretch deep into the code we trust, and malware hides not just in shady apps — but in job offers, hardware, and cloud services we rely on every day. Hackers don't need sophisticated...

CVE-2024-45557 Use of Out-of-range Pointer Offset in Trust Management Engine

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation...

CVE-2024-45557 Use of Out-of-range Pointer Offset in Trust Management Engine

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation...

CVE-2024-45557

CVE-2024-45557 describes memory corruption in Qualcomm’s Trust Management Engine (TME) when it processes addresses from TZ and MPSS requests without proper validation, affecting Qualcomm chipsets. The CVSSv3.1 base score is 7.8 (High) with Local, Low complexity, Low privileges, and no user intera...

CVE-2025-20661

In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3185...

CVE-2025-20660

In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3186...

Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457)

Ivanti released security updates to address vulnerabilities CVE-2025-22457 in Ivanti Connect Secure, Policy Secure & ZTA Gateways. A cyber threat actor could exploit CVE-2025-22457 to take control of an affected system. CISA has added CVE-2025-22457 to its Known Exploited Vulnerabilities Catalog...

CISA Adds One Vulnerability to the KEV Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-22457link is external Ivanti Connect Secure, Policy Secure and ZTA Gateways Stack-Based Buffer Overflow Vulnerability These types of vulnerabilities are frequent...

The vulnerability of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA Gateways’ network access control devices lies in buffer overflows in the stack, allowing attackers to execute arbitrary code.

The vulnerability of Ivanti Connect Secure, Ivanti Policy Secure, and ZTA Gateways lies in buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ivanti Connect Secure CVE-2025-22457 exploited in the wild

On Thursday, April 3, 2025, Ivanti disclosed a critical severity vulnerability affecting Ivanti Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateways. CVE-2025-22457 is a stack-based buffer overflow vulnerability that allows remote, unauthenticated attackers to execute code on the...

AI Threats Are Evolving Fast — Learn Practical Defense Tactics in this Expert Webinar

The rules have changed. Again. Artificial intelligence is bringing powerful new tools to businesses. But it's also giving cybercriminals smarter ways to attack. They're moving quicker, targeting more precisely, and slipping past old defenses without being noticed. And here's the harsh truth: If...

Overly Permissive Authorization

aws-cdk-lib is vulnerable to Overly Permissive Authorization. The vulnerability is due to the CDK Construct Library automatically generating an overly permissive AWS IAM trust policy, which allows any user with unrestricted sts:AssumeRole permissions to assume the role...