Parse notes
Sponsored
* How can you protect commonly exploited ports and services? * Which policies do you need to have in place to get started? * How can you build a multi-layered approach to securing your servers?
Hellcat has claimed the attacks on Ascom and Jaguar Land Rover (JLR). It stole 44GB of sensitive data from Ascom's ticketing system and hundreds of gigabytes from JLR. Ascom confirmed the attack, while JLR hasn't responded.
Operation Zero, a Russian exploit broker, offers up to $4 million for Telegram zero-day exploits exclusively to the Russian government and local firms. Payouts vary: $500,000 for one-click RCE, $1.5 million for zero-click RCE, and $4 million for a full chain of exploits.
Cisco Smart Licensing Utility (CSLU) is a Windows application that allows admins to manage licenses and linked products on-prem without connecting them to Cisco's cloud licensing software. In September, Cisco patched a vulnerability that exposed an undocumented, static credential for a built-in admin account and allowed unauthenticated users to access log files containing sensitive data. SANS' Dean of Research reports that threat actors are now chaining these two vulnerabilities to exploit internet-exposed CSLU instances.
Google has acquired cloud security startup Wiz for $32 billion, its most expensive purchase ever. This move aims to strengthen Google Cloud against rivals Microsoft and Amazon, whose cloud services generate significantly more revenue.
Tenable's 2025 report revealed that most organizations deploy AI services in cloud environments with dangerous default configurations, with 91% enabling root access in Amazon SageMaker. This "Jenga-like" approach, where compromising one service affects all connected services, mirrors early cloud deployment mistakes.
The Splunk Threat Research Team identified a new campaign targeting ISP infrastructure. Attackers use weak credentials to gain initial access, downloading malware from a C2 server that runs a crypto miner and an infostealer to detect crypto wallet passphrases and take screenshots. They establish persistence and pivot to additional IP CIDRs, utilizing Python and Powershell scripts to maintain a minimal presence, including IoCs in the post.
Sponsored
Cyber incidents—ransomware attacks, data breaches, and IT disruptions—topped the Allianz Risk Barometer for the third time in the survey's history in 2024. Companies have to manage these risks, and the costs of a miscalculation can be catastrophic.
* An overview of IT and cybersecurity risk management. * Why you need risk management. * How to make risk management work for your organization.
SentryPeer is a fraud detection tool that tracks bad actors' attempted calls by saving their IP addresses and dialed numbers.
Faction is a Pen Test Report Generation and Assessment Collaboration tool that helps automate pen testing and security assessment reports.
shadow-rs is a Windows kernel rootkit written in Rust that includes advanced kernel manipulation techniques.
Targeting illegal football streaming, Italy's court has ordered Google to block pirate websites at the DNS level under its Piracy Shield law. Meanwhile, critics call the approach draconian due to collateral damage like accidentally blocking entire domains.
The tj-actions and xz utils supply chain attacks have highlighted the issues that exist in establishing a maintainer's identity on GitHub. GitHub should require certain security features on a repository once it hits a certain popularity threshold, such as signed commits, PRs, blocking force pushes with an emergency override system, and 2FA for all admin credentials and maintainers. It should create an opt-in standard for verifying open-source maintainer identities, managing roster changes, and maintaining public audit logs and security settings. GitHub could also implement a production version of Chainguard's octo-sts for short-lived runner credentials and check for typosquatting in GitHub Actions.
Ex-NFL coach Matt Weiss has been charged with hacking college athletes' accounts and college databases to obtain intimate photos.
Hackers from six nations have exploited a Windows zero-day vulnerability in .lnk files since 2017, targeting over 300 organizations for espionage and data theft.
Two harmful VSCode extensions, "ahban.shiba" and "ahban.cychelloworld," deployed an early ransomware, exposed flaws in Microsoft's review process.