#ExploitsExplained

A single prompt got an AI to hand over S3 bucket contents, and Amazon Bedrock's content moderation never flagged it. We broke down the full exploit chain, the sanitized PoC, and the fixes in this week's Exploits Explained: #ExploitsExplained #PromptInjection #AIsecurity #OffensiveSecurity #SynackRedTeam

The flaw was in the timing. Synack Red Team researcher Elison Kaloshi sent identical payments in parallel using free Burp Suite. A few milliseconds turned 2,000 units into a 10,000-unit card credit. #ExploitsExplained

@turakbusra breaks down three shifts security teams need to account for when pentesting AI systems: #ExploitsExplained #PromptInjection #AISecurity #LLMSecurity #SynackRedTeam

In the latest installment of #ExploitsExplained, see a demo of a vulnerability in an Oracle WebLogic Server that allows attackers to perform remote code execution via a single HTTP request. Check out this video walkthrough: #cybersecurity #hacking

What worries #hackers? Attend for our next #ExploitsExplained installment on 4/21 where @synackredteam researcher, @Adam_Logue details the risks #deserialization attacks pose to security practitioners, including a demo of a JBoss Server exploitation.