Aggregator

今天想要应聘麦当劳工作的人可能首先需要在 McHire.com 平台上与 AI 聊天机器人 Olivia 聊一聊。Olivia 会询问应聘者个人信息和简历，进行性格测试。该聊天机器人由 Paradox.ai 公司提供。安全研究员 Ian Carroll 和 Sam Curry 在听闻麦当劳使用 AI 聊天机器人筛选应聘者后好奇之下对 McHire.com 进行了一番研究，结果意外发现该平台的管理员用户名和密码都是 123456。登陆管理员面板之后，他们可以访问 Paradox.ai 账户，查询该公司保存的所有 McHire 用户与 Olivia 聊天记录的数据库。数据库包含了多达 6400 万条记录，包括了应聘者的姓名、电子邮件地址和电话号码。麦当劳表示 Paradox.ai 需要对该漏洞负责。Paradox.ai 确认并在一天内修复了漏洞。

立即查看漏洞详情

当前环境出现异常状态，需完成验证后才能继续访问。

​面对 AI 能力跃升，我们该如何重新理解人的价值与教育的意义。

In this Help Net Security interview, David Warburton, Director at F5 Labs, discusses how the EU’s Post-Quantum Cryptography (PQC) roadmap aligns with global efforts and addresses both the technical and regulatory challenges of migrating to PQC. Warburton also outlines practical steps organizations must take to ensure cryptographic agility and long-term data protection. How does the EU’s PQC roadmap align with global efforts, such as those from NIST and ETSI? Are there any key differences or … More →

The post What EU’s PQC roadmap means on the ground appeared first on Help Net Security.

A vulnerability was found in mintplex-labs anything-llm and classified as problematic. Affected by this issue is some unknown functionality of the component User Invite Handler. The manipulation leads to time-of-check time-of-use. This vulnerability is handled as CVE-2024-2913. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in wpbean WPB Popup for Contact Form 7 Plugin up to 1.7.5 on WordPress. This affects the function wpb_pcf_fire_contact_form of the component Shortcode Handler. The manipulation leads to code injection. This vulnerability is uniquely identified as CVE-2024-11038. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in SysPass 3.2x. Affected is an unknown function of the component Header Handler. The manipulation of the argument Host leads to injection. This vulnerability is traded as CVE-2025-25477. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability, which was classified as critical, has been found in benjaminprojas WP Editor Plugin up to 1.2.9.1 on WordPress. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2025-3294. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in benjaminprojas WP Editor Plugin up to 1.2.9.1 on WordPress. Affected is an unknown function. The manipulation leads to path traversal. This vulnerability is traded as CVE-2025-3295. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Lester Chan WP-DownloadManager Plugin up to 1.68.10 on WordPress. This affects an unknown part of the file wp-config.php. The manipulation leads to denial of service. This vulnerability is uniquely identified as CVE-2025-4798. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in WP-DownloadManager Plugin up to 1.68.10 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to absolute path traversal. The identification of this vulnerability is CVE-2025-4799. The attack may be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Lester Chan WP-DownloadManager Plugin up to 1.68.10 on WordPress. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2025-4798. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical has been found in CubeWP Plugin up to 1.1.23 on WordPress. Affected is the function update_user_meta. The manipulation leads to improper privilege management. This vulnerability is traded as CVE-2025-4315. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in SysPass 3.2.x. It has been rated as critical. Affected by this issue is some unknown functionality of the component Filename Handler. The manipulation leads to unrestricted upload. This vulnerability is handled as CVE-2025-25478. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in SysPass 3.2.x. This vulnerability affects unknown code of the component Notification. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-25476. The attack can be initiated remotely. There is no exploit available.

A vulnerability has been found in SeedDMS 6.0.29 and classified as problematic. This vulnerability affects unknown code of the component Category Name Handler. The manipulation of the argument Name leads to cross site scripting. This vulnerability was named CVE-2025-25461. The attack can be initiated remotely. There is no exploit available.

A severe security vulnerability in McDonald’s AI-powered hiring system has exposed the personal information of potentially 64 million job applicants to unauthorized access.  Key Takeaways1. McDonald's AI hiring bot exposed 64 million job applicants' personal data through weak security using password "123456."2. Researchers accessed the entire system in 30 minutes using simple password guessing and […]

The post McDonald’s AI Hiring Bot With Password ‘123456’ Leaks Millions of Job-Seekers Data appeared first on Cyber Security News.

Shopping on a fake online store can lead to more than a bad purchase. It could mean losing money, having your identity stolen, or even getting malware on your device. E-shop scams rose by 790% in the first quarter of 2025 compared to the same period in 2024, according to Avast. Cybercriminals might be exploiting economic uncertainty as rising tariffs push consumers to seek cheaper deals online. This makes it easier to trick people with … More →

The post Fake online stores look real, rank high, and trap unsuspecting buyers appeared first on Help Net Security.