Parse notes
Sponsored
Cyberattackers grow bolder and data protection regulations become stricter, making organizational password management essential for employees and executives. But how can you tell whether your system is providing a solid defense or putting your organization at risk?
Laboratory Services Cooperative (LSC) suffered a data breach in October that affected 1.6 million individuals. The cyberattack exposed sensitive personal information, including names, contact details, Social Security numbers, health insurance information, and medical records. Some Planned Parenthood patients were impacted.
A threat actor, 'Jabaroot,' claims to have breached Morocco's National Social Security Fund (CNSS), compromising the data of nearly 2 million citizens. The leak includes personal and financial details like passports, emails, and banking information, posing significant identity theft and fraud risks for those affected.
Fortinet warns that threat actors can maintain access to FortiGate VPN devices after patching by creating symbolic links to the root file system via SSL-VPN, allowing read-only access. Users should upgrade to the latest FortiOS version to eliminate malicious files and check configurations for unauthorized changes.
There was a remote code execution vulnerability in the SuperNote A6 X2 Nomad tablet that let attackers on the same network compromise the device without user interaction. The exploit involved identifying an open port with a custom HTTP server, discovering a path traversal flaw for arbitrary file placement, and uploading a malicious firmware update to the EXPORT directory, which auto-installs using publicly available debug keys. The exploit was responsibly disclosed to Ratta Software in July - the company acknowledged it and made plans to fix it in its December 2024 update, but a patch has yet to appear.
TROX Stealer, a Malware-as-a-Service first identified in December 2024, uses urgent debt collection phishing emails to entice victims into downloading malicious executables. It features a multi-stage execution chain with Python, Node.js, and WebAssembly to evade detection, stealing sensitive data like credit cards, browser credentials, cryptocurrency wallets, and Discord/Telegram session files. The attackers have a structured infrastructure, with domains registered nine months prior to the attack, indicating careful planning and marketing on hacking forums.
Eptalights Research analyzes PHP code at the bytecode level, providing a reliable method for understanding execution. Its technology converts Zend bytecode into a Pythonic model, simplifying the analysis of obfuscated PHP code that is hard to interpret at the source level. This is especially useful for obfuscated code with goto statements or encoded files using loaders, granting access to control flow, variables, and call sites even when the source is obscured.
Spektion provides vulnerability analysis for an organization's entire software inventory, leveraging runtime behavior analysis to provide detailed information on real risks and enable customers to prioritize and mitigate flaws, even those without CVEs or patches.
.NET post-exploitation toolkit for Active Directory reconnaissance and exploitation.
jxscout serves as a resource for security researchers looking to examine JavaScript code for vulnerabilities. It works seamlessly with proxies such as Burp or Caido to capture and arrange static assets, pre-fetch code segments, automatically beautify JS, and reverse source maps when the .map files are accessible.
AI coding assistants often hallucinate non-existent software packages, creating a security vulnerability called "slopsquatting." Attackers exploit this by creating malicious packages using these hallucinated names, so it is recommended for developers to double-check the package they are installing is the correct one.
Researchers have found ten critical security flaws in Perplexity AI's Android app, including hardcoded API keys, network vulnerabilities, and weak authentication. These issues could allow attackers to bypass security measures and access user data. Experts recommend that Android users immediately uninstall the app until these easily exploitable vulnerabilities are fixed.
The new static CT API log design simplifies operations and improves integrity for Certificate Transparency systems, serving log data efficiently to reduce costs and enhance availability. Cloudflare's Azul implementation on Workers further streamlines the process for CT log operators.
China acknowledged its involvement in cyberattacks on US infrastructure, which were interpreted as a warning over US support for Taiwan, during a secret meeting with US officials.
Microsoft Defender for Endpoint is trialing a feature that blocks traffic from unidentified endpoints to hinder lateral movement by attackers.