Parse notes
Sponsored
Security researchers from Check Point's open-appsec tested the efficacy of several leading WAF solutions using a comprehensive dataset: 1,040,242 legitimate HTTP requests from 692 real websites [4], and 73,924 malicious payloads from common attack vectors.
Researchers discovered 33 compromised Chrome extensions affecting 2.6 million devices during the holiday season. The incident began when Cyberhaven's extension was hijacked through a phishing attack on Christmas Eve, leading to malicious code that stole sensitive data including Facebook and ChatGPT credentials.
MyGiftCardSupply's unsecured server exposed over 600,000 customer ID documents and selfies belonging to around 200,000 customers. After researcher JayeLTee discovered the breach, the company secured the server and promised better data handling, but wouldn't commit to notifying affected individuals or explain the delayed response.
Volkswagen Group's software subsidiary Cariad exposed sensitive data of 800,000 EV owners through a misconfigured Amazon cloud storage system. The breach revealed vehicle locations, contact details, and addresses across multiple European countries, affecting various VW brands. The issue was fixed after ethical hackers reported it.
Cybersecurity budgets are expected to increase for 90% of organizations in 2025, with leaders facing pressure to demonstrate ROI. While 35.9% of CISO budgets go to software, automation of SOC workflows and patch management offers clear returns. Gartner predicts industry spending will grow from $184B (2024) to $294B (2028), with cloud security leading growth.
The blog discusses the risks of unsafe archive unpacking in software development due to vulnerabilities in handling archive files across different programming languages. The author demonstrates vulnerable implementations and provides safe alternatives, along with Semgrep rules, to automatically detect and mitigate these risks. The research aims to help developers identify and address security vulnerabilities in archive extraction methods to prevent potential attacks like path traversal.
Managed Identities as Federated Identity Credentials for Microsoft Entra allow secure access to cloud resources without using secrets or certificates. This new approach improves security by reducing the risk of credential leaks and simplifies resource access setup. Apps can now trust managed identities, eliminating the need to manage app secrets or certificates for accessing Entra-protected resources.
Ephemeral, zero-knowledge sensitive data sharing with end-to-end encryption and seamless UX - no sign-up, just secure and instant sharing.
Amitai Cohen built this Pivot Atlas as an educational tool to help cyber analysts understand various pivoting strategies. This website contains simple reference material for how to make the best use of various threat activity observables, such as IP addresses and file hashes. Mermaid diagrams are also included for easy and clickable navigation between artifact types.
Pytune is a post-exploitation tool that enrolls devices into Microsoft Intune.
Apple has agreed to pay $95 million to settle claims that Siri inadvertently recorded private conversations. US users who had Siri-enabled devices between 2014-2024 and can swear their private conversations were accidentally recorded could receive up to $20 per device, pending judicial approval.
Akamai will end its China CDN services by June 30, 2026, with content requests to be served from neighboring countries unless a partner solution is activated. It has partnered with Tencent Cloud and Wangsu Science & Technology to offer high-performance content delivery and security solutions in mainland China. Existing China CDN customers must transition to the partner solutions by the deadline to avoid service interruptions.
macOS has become more private over the last five years, with a significant increase in Private Frameworks. The percentage of Private Frameworks has risen from 76% to 84% from 2019 to 2024. Apple's Private Frameworks are not accessible to third-party developers and are crucial for app approval in the App Store.
A lawsuit by Youtuber LegalEagle claims that PayPal's Honey extension is diverting earnings from creators by substituting affiliate links, accusing the company of undermining the affiliate marketing system.
The U.S. Department of the Treasury sanctioned Integrity Technology Group, a Beijing-based cybersecurity company, for supporting a Chinese state-sponsored cyber group called Flax Typhoon that targeted U.S. critical infrastructure sectors.
49 Videos from FIRSTCON 24, an event that focused on the issues of incident response and security teams.