Parse notes
A major data breach at Gravy Analytics threatens millions of people's smartphone location data, collected through app advertising networks. The hacker leaked 30 million location points from various apps, including sensitive locations. The breach occurred via a compromised Amazon cloud key, prompting investigations by data protection authorities.
Nominet discovered a network intrusion through Ivanti VPN software's latest zero-day vulnerability (CVE-2025-0282). While domain systems remain operational and no data theft is confirmed, this marks the first public case of this exploit.
Apple patched a macOS vulnerability that allowed hackers to bypass System Integrity Protection and install malicious kernel drivers by exploiting a flaw in the Storage Kit daemon. This flaw, designated as CVE-2024-44243, could be abused by local attackers with root privileges to compromise Mac systems without physical access, potentially leading to the installation of persistent malware and data theft. Microsoft emphasized the importance of SIP in protecting macOS systems and highlighted the need for robust security solutions to detect and prevent such threats.
FunkSec ransomware group emerged in late 2024, claiming 85+ victims in December. Analysis suggests they use AI-assisted malware development despite apparent inexperience and that many of their leaked datasets appear to be recycled from previous hacktivist campaigns.
This post dives into the landscape of OSS, which in 2025 faces increased supply chain attacks and regulatory demands. Key trends include AI's dual role in cybersecurity (both helping and hindering), the impact of the EU's Cyber Resilience Act, and the growing emphasis on continuous monitoring.
This article discusses a critical security issue with AWS OpenID Connect (OIDC) integrations where missing or incorrectly configured conditions in IAM role trust policies could allow unauthorized access to AWS accounts. The article explains that while the "sub" condition is commonly known to be required (especially for GitHub Actions), different vendors may require different or additional conditions, such as Microsoft Defender requiring "sts:RoleSessionName" or some vendors using custom conditions. The key recommendation is that AWS customers should ensure all their OIDC integrations have both "aud" and "sub" conditions (unless vendor documentation specifically indicates otherwise) and investigate any exceptions carefully, as there are many vendors that work differently and some even recommend additional security measures like IP address restrictions.
Social Analyzer is an API, CLI, and Web App for analyzing and finding a person's profile across over 1,000 social media/websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process.
burpference is a Burp Suite extension that captures in-scope HTTP requests from Burp's proxy history and sends them to an LLM in JSON format.
MEGR-APT is an APT hunting system that discovers suspicious subgraphs matching an attack scenario published in Cyber Threat Intel (CTI) reports.
Plaid launched an effort to build its own Key Management System (KMS) to curb bespoke cryptographic processes across different teams and services. It chose to build its own system over using a vendor-provided solution to avoid API limitations that would hamper scalability, lower costs, and be self-service. The migration process proved to be the most challenging part of building the system.
This post enumerates the many different ways that an attacker might be able to obtain credentials in an AWS environment. The AWS SDK looks for hard-coded credentials, followed by environment variables, followed by AWS credential files, and lastly IMDS. The post concludes by listing out more specialized ways that certain services can obtain credentials.
Source Code Red claims that NPM packages were deployed to target Cursor.com by a user named sn4k-s3c from Snyk. These packages collected sensitive data from systems and exfiltrated it to an attacker-controlled web service. It is essential to be cautious when installing NPM packages and look for suspicious signals like limited files in the package.
The National Cyber Security Centre and international cyber experts urge critical infrastructure operators to integrate security into procurement processes to defend against cyber threats.
Azure and Microsoft 365 experienced a four-hour outage for multi-factor authentication that affected users in Western Europe, Chile, and the US.
CISA ordered U.S. federal agencies to patch a command injection bug in BeyondTrust software within three weeks to protect against ongoing attacks.