Search: “integrity”

4 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 44 AI research 35 Research 32 AI industry 26 AI safety & security 23 Vulnerability 21 Tools 21 Threat actor 16 Exploit / PoC 14 Malware 13 Advisory 12 AI tools & infra 6 Model release 5 Phishing & fraud 5

SeverityAll critical 12 high 51 medium 27 low 5 info 188

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-securitySep 16, 15:09 UTC · 19h agoVulnerability 2 sources1

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · SecuritySep 14, 18:31 UTC · 2d agoResearch

Scans Targeting Hospitality Applications, (Wed, Sep 16th)

Scans from a bulletproof-hosting IP target the abandoned PIAF-HMS hospitality application, which contains numerous unpatched SQL injection flaws.

SANS ISC observed requests for /PIAF-HMS/ using the unusual user-agent Farez-Sorter/1.0, along with paths like /admin/, /ucp/, /hms/, and /hotel/, starting September 15 from the single source IP 94.102.49.125 (IP Volume, AS202425, a bulletproof hoster). PIAF-HMS, a PBX in a Flash Hospitality Management System, was last updated 10 years ago and a SQL injection vulnerability was reported recently; the code shows many injection flaws and lacks authentication and access control. The handler notes hotels are soft targets for personal data theft and guest MitM attacks, and asks for community insight on the campaign.

SANS Internet Storm CenterSep 16, 18:44 UTC · 15h agoExploit / PoC

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · securitySep 16, 13:24 UTC · 21h agoResearch