Parse notes
MediSecure, an Australian e-prescription provider, has fallen victim to a ransomware attack that resulted in the suspected theft of patients' personal and health data. The company stated that the incident likely originated from a third-party vendor breach. MediSecure has notified regulators about the large-scale data breach, which impacted an unspecified number of individuals.
A critical vulnerability dubbed "Llama Drama" (CVE-2024-34359) has been discovered in the llama_cpp_python package used for integrating AI models with Python. The flaw, related to the improper use of the Jinja2 template rendering tool, enables template injection attacks and allows arbitrary code execution, putting AI application systems and data at risk.
Santander Bank has reported that some customer data, as well as all data from all past and present employees which was stored in a third-party database, were accessed by an unauthorized party. No data on transactions or credentials were leaked.
This article explains how to use AuditD to detect threats by creating rules based on logs and analyzing them further. It provides a simple example rule to monitor executions in the /tmp directory, emphasizing the importance of monitoring to enhance security. The article offers insights into investigating AuditD events and conducting in-depth analysis for security monitoring.
Zero Trust Architecture (ZTA) is a revolutionary cybersecurity approach that shifts from the outdated "trust but verify" model to a robust "never trust, always verify" principle, addressing weaknesses of traditional security measures. This post dives into the intricacies of Zero Trust.
This article introduces a new attack method for injecting rogue files and forcing victims to download them. The attack requires a page to have a path confusion vulnerability, a download link with an anchor tag that uses relative paths, and content that is injectable via a persistent XSS or XSS cache poisoning. The attack expands on RPO because it doesn't rely on deprecated technologies.
Sponsored
Are you an expert in all things cloud security? Come prove it at at Lacework's virtual Capture the Flag Challenge [10]!
Sydeabs is a security and risk management platform aimed at securing Generative AI throughout the entire development lifecycle.
JavaScript & Node.js open-source SAST scanner. A static analyzer for detecting most common malicious patterns.
Reverst is a load-balanced, Golang reverse tunnel that runs over HTTP3/QUIC. The tunnel server is meant to be deployed publicly while clients in restrictive networks connect out to it.
YARA has been rewritten as YARA-X in Rust for better user experience, rule-level compatibility, performance, reliability, and developer-friendliness. The rewrite was necessary due to significant design changes and the limitations of the existing C codebase. YARA-X is currently stable but in beta. The project aims to surpass YARA in all aspects through ongoing enhancements.
Chinese nationals Daren Li and Yicheng Zhang have been charged with laundering $73 million in a pig butchering crypto scam. Victims were tricked into transferring money to U.S. bank accounts opened by shell companies. Li and Zhang face up to 20 years in prison for money laundering charges.
Slack is facing backlash from users over its approach to using customer data for training AI models. While many tech companies leverage user data for AI training, Slack's confusing and seemingly outdated privacy policy allows it to opt users in by default, requiring them to actively email the company to opt out.
Microsoft will enforce multi-factor authentication for Azure users starting in July to enhance security.
Due to a misconfiguration, Google Cloud accidentally deleted the entire account of Australian pension fund UniSuper, which manages $135 billion in funds for 647,000 members, including all backups stored on the service.
The American Radio Relay League (ARRL) faced a cyberattack that affected its online services, including Logbook of the World.