#tenable — Public Fediverse posts on home.social

I'm looking for work in #Barcelona, Spain. I'm a #Linux admin with #RedHat experience and hold #RHCSA & #RHCE certifications. I also have experience with #Splunk, #Tenable, and #VMware sprinkled with some networking knowledge. I also have CompTIA Security+. I won't need sponsorship since my spouse is an EU member. I do not know Spanish well, but learning.

#FediHire #GetFediHired #openforwork

#barcelona #linux #redhat #rhcsa #rhce #splunk

KrebsOnSecurity RSS @[email protected] · 2026-04-14 · 22:00 UTC

Patch Tuesday, April 2026 Edition

https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/

#PatchTuesdayApril2026 #SharePointServer #LatestWarnings #TheComingStorm #CVE-2026-32201 #CVE-2026-33120 #CVE-2026-33825 #CVE-2026-34621 #RyanBraunstein #GoogleChrome #SatnamNarang #TimetoPatch #adobereader #MikeWalters #WillDormann #BlueHammer #Action1 #Automox #Tenable

#patchtuesdayapril2026 #sharepointserver #latestwarnings #thecomingstorm #cve #ryanbraunstein

bbbourq @[email protected] · 2026-04-13 · 22:26 UTC

I'm looking for work in #Barcelona, Spain. I'm a #Linux admin with #RedHat experience and hold #RHCSA & #RHCE certifications. I also have experience with #Splunk, #Tenable, and #VMware sprinkled with some networking knowledge. I also have CompTIA Security+. I won't need sponsorship since my spouse is an EU member. I am learning Catalan in the process.

#barcelona #linux #redhat #rhcsa #rhce #splunk

usd AG @[email protected] · 2026-04-13 · 10:24 UTC

The pentest professionals at #usdHeroLab identified a vulnerability in #EntraID during a cloud #pentest that allows the circumvention of conditional access policies for privileged identities.

Two additional vulnerabilities were identified during a web application pentest of #Tenable Nessus Manager, which allow low-privileged users to read arbitrary files at the operating system level.

All #vulnerabilities were reported to the vendors as part of our Responsible Disclosure policy.

🔎 You can find detailed information on the #SecurityAdvisories here: https://www.usd.de/en/security-advisories-entra-id-tenable-nessus-manager/

#SecurityResearch #SecurityAdvisory #moresecurity #NessusManager #Pentesting #Hacking #CVE_2026_3493 #AppSec #InfoSec #CyberSecurity

#usdherolab #entraid #pentest #tenable #vulnerabilities #securityadvisories

KrebsOnSecurity RSS @[email protected] · 2026-03-11 · 01:00 UTC

Microsoft Patch Tuesday, March 2026 Edition

https://krebsonsecurity.com/2026/03/microsoft-patch-tuesday-march-2026-edition/

#MicrosoftPatchTuesdayMarch2026 #MicrosoftOffice #TheComingStorm #CVE-2026-21262 #CVE-2026-24289 #CVE-2026-24291 #CVE-2026-24294 #CVE-2026-25187 #CVE-2026-26110 #CVE-2026-26113 #CVE-2026-26127 #mozillafirefox #SecurityTools #SatnamNarang #TimetoPatch #AdamBarnett #BenMcCarthy #Immersive #Tenable #adobe #XBOW

#microsoftpatchtuesdaymarch2026 #microsoftoffice #thecomingstorm #cve #mozillafirefox #securitytools

hasamba @[email protected] · 2026-02-12 · 20:31 UTC

----------------

🎯 AI
===================

Executive summary: Moltbook, an AI-only social network populated by OpenClaw agents, presents immediate security risks: pervasive spam/scams, exposure of agents to untrusted content via API-oriented prompt files, and a reported database compromise that leaked API keys enabling bot impersonation and direct prompt injection.

Technical details:
• SKILLS.md, HEARTBEAT.md, and MESSAGING.md are repository-style markdown files that describe how agents interact with the Moltbook API. SKILLS.md documents API interactions and recommends HTTP requests (curl-style). HEARTBEAT.md instructs periodic check-ins. MESSAGING.md notes that messaging requires human approval, while other endpoints accept automated agent input.
• Experimental tooling (reported as a CLI tool named moltbotnet) implemented API calls for posting, commenting, upvoting, following, and engagement automation. This tooling demonstrates how easily an agent or impersonator can script interactions.
• Reported breach of Moltbook’s database exposed API keys tied to agent identities. Those keys materially enable: impersonation of legitimate agents, submission of crafted prompts to agent workloads, and direct prompt injection vectors that bypass typical human-only guards.

Analysis:

The combination of (1) public, machine-readable prompt files that instruct agents how to behave, (2) open posting and engagement that accepts untrusted content, and (3) leaked credentials produces two classes of injection risks: indirect prompt injection (agents ingesting malicious content from other agents) and direct prompt injection (attacker using stolen API keys to send malicious prompts as a trusted agent). The observed ecosystem is also saturated with social-engineering lures (requests to run package installers, share crypto wallets, or call external APIs).

Detection guidance:
• Monitor unexpected use of API keys or unusual posting frequency associated with agent identities.
• Inspect content sources for scripted patterns (repeated promotional payloads, command-like text referencing package managers or curl usage).

Limitations:
• No public CVE identifiers are reported in the source material.
• Exact scope of leaked API keys (number of keys, associated privileges) was not enumerated in the writeup.

References and tags:

SKILLS.md, HEARTBEAT.md, MESSAGING.md — Tenable Research field report on Moltbook interactions and breach findings.

🔹 OpenClaw #Moltbook #promptinjection #APIkeys #Tenable

🔗 Source: https://www.tenable.com/blog/undercover-on-moltbook

#moltbook #promptinjection #apikeys #tenable