Tag: web security
15 articles
Websites Deploy Indirect Prompt Injection via HTTP Headers
Thousands of websites are secretly sending instructions to AI agents through HTTP headers, using a sneaky tactic called indirect prompt injection to manipulate these intelligent systems. This surprising attack vector allows hidden messages to be embedded in web pages, emails, files, or tool results, and is a growing concern for security researchers.
Google Certificates Targeted in ccTLD Hijacks
Google thwarted a sneaky attack where hackers hijacked three country-code domains to obtain fake HTTPS certificates for several Google sites and other organizations, quickly blocking the unauthorized certificates through Chrome's emergency response system. The compromised domains included .gh, .sl, and .as, which were manipulated by attackers to gain DNS control.
Hackers Hijack Country-Code Domains to Obtain Google HTTPS Certificates
Hackers hijacked country-code domains to obtain unauthorized Google HTTPS certificates, putting several domains at risk between September 22 and 27. Google quickly sprang into action, revoking the certificates and blocking them in Chrome to prevent any further damage.
Browser Alerts Expose Rogue Scripts in Thousands of Sites
Thousands of websites, repositories, and documentation pages are unwittingly exposing users to rogue scripts, thanks to a long-abandoned content delivery network domain that was re-registered by a malicious actor. This simple domain hack has opened the door to a massive security vulnerability.
Hackers Exploit WooCommerce Plugin to Upload PHP Backdoors on WordPress Sites
A single flaw in a third-party WooCommerce plugin has sparked over 100,000 attacks, allowing hackers to upload PHP backdoors and take control of WordPress sites - a stark reminder of the importance of keeping your plugins up to date!
Glassbox Exposes Browser Fingerprinting Tricks
Meet Glassbox, a tool that shines a light on browser fingerprinting tricks, allowing you to see how easily trackers can single out your browser and device from the crowd. By mirroring live fingerprinting, Glassbox gives you a glimpse into the raw data that can be used to identify you online.
AliExpress Exposed Using Silent Audio Trick to Fingerprint Shoppers
Ever had your phone's audio mysteriously cut out when browsing a specific website? A developer discovered that AliExpress was using a sneaky silent audio trick to secretly fingerprint shoppers, sparking concern over online privacy.
AI Crawlers Exposed to Secret Ads in Web Pages
Imagine discovering hidden ads that can influence the output of entire AI models, allowing advertisers to reach a vast audience with a single placement - and get their message served up as fact. German developer Vincent Schmalbach stumbled upon these secret ads, cleverly disguised as FAQs, embedded in Time Magazine articles served to crawlers.
Google Blogger False Positive Disrupts Hundreds of Legitimate Sites
Hundreds of legitimate Blogger sites have been mistakenly flagged and locked by Google's automated systems, causing widespread disruption - a rare and large-scale false positive that has left many publishers scrambling. The error, which began on August 4, has sparked concerns about the reliability of Blogger's malware classification.
Polyfill Compromise Targets Major Websites with Rogue Login Prompts
Major websites, including Toshiba and Muji, have been compromised by a rogue login prompt scam through polyfill.io, tricking visitors into entering sensitive information. If you encountered the fake sign-in screen, be sure to cancel and change your password to protect your account.
Google Chrome Bolsters Defenses with Cookie Theft Protection Rollout
Google's new Cookie Theft Protection is a game-changer, tying session cookies to device hardware to prevent hackers from using stolen cookies to access your accounts. This cutting-edge tech binds user sessions to a machine's security chip, making it virtually impossible for thieves to get in.
Shadow AI Exposes 2,000 Vibe-Coded Apps with Sensitive Data
A shocking discovery by Red Access revealed over 2,000 apps with sensitive corporate, operational, or personal data exposed online, leaving countless organizations vulnerable to risk. These apps, found on popular vibe-coding platforms, were often deployed without basic security controls, granting open access to sensitive information.
cPanel Vulnerability Exposes Millions of Domains to Root Access Attacks
A critical cPanel vulnerability, rated 9.8 under CVSS, has been discovered, allowing attackers to craft a simple sequence of requests to bypass authentication and gain root access to servers, putting millions of domains at risk. Emergency patches are available to fix this gaping security flaw.
Google Chrome Fails to Thwart Browser Fingerprinting
If a browser claims to be safe but fails to block one of the easiest ways for advertisers to track you online, can it really be considered safe? Google Chrome, despite its reputation for security, surprisingly leaves users vulnerable to browser fingerprinting, a pervasive tracking method that can uniquely identify and follow you around the web.
Malicious Chrome Extensions Infiltrate Web Store, Compromise User Data
Malicious Chrome extensions, masquerading as harmless tools, have infiltrated the official Web Store, putting millions of users' data at risk by stealing sensitive tokens, planting backdoors, and running ad fraud. Over 100 of these rogue add-ons have been identified, highlighting a growing threat in a marketplace we thought was safe.