⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A now-patched vulnerability in Azure Cosmos DB could have allowed an attacker to escape the service's Gremlin query sandbox and gain full read and write access to databases across customer tenants, according to Wiz. The exploit chain, dubbed CosmosEscape, began with a crafted Gremlin query against a database controlled by the attacker, then achieved code execution on a multi-tenant gateway that exposed a platform-wide signing secret.
A security researcher demonstrated how Microsoft Copilot for Word can be tricked into spreading a self-propagating prompt-injection 'AI worm' by hiding malicious instructions in white text on white background. The attack spreads through legitimate document-sharing workflows, and no complete mitigation exists for this class of LLM attacks.
A security researcher revealed a method to turn Microsoft Copilot for Word into a self-propagating "AI worm" through prompt injection. The attack involves embedding hidden JSON-formatted instructions as white text in a Word document.
A security researcher has demonstrated how Microsoft Copilot for Word can be tricked into spreading a self‑propagating.
CISA urgently warns water and wastewater systems sector organizations to protect OT systems against escalating cyber threats. Recent incidents show adversaries targeting critical water treatment infrastructure.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device.