Parse notes
Sponsored
Flashpoint's Threat Intelligence Report looks at +3.6 petabytes of data from the hardest-to-reach corners of the web — revealing 2.1B stolen credentials and 5,742 ransomware attacks in 2024, with five major RaaS groups responsible for nearly half.
The Common Vulnerability and Exposures (CVE) repository, a 25-year-old program run by MITRE for DHS, serves as the global cybersecurity standard for identifying and documenting security vulnerabilities. Yesterday, there were rumors that MITRE's contract would expire, but it has received an 11-month extension from CISA, averting potential widespread disruption to vulnerability management worldwide.
Apple has released emergency security updates to patch two new zero-day vulnerabilities exploited in sophisticated attacks against iPhones. The first vulnerability is a flaw in CoreAudio, which can be exploited by processing an audio stream in a malicious file to execute remote code. The second vulnerability is a flawed RPAC that allows attackers with read or write access to bypass Pointer Authentication, which is a security feature to protect against memory vulnerabilities.
Security researchers have discovered a publicly accessible server containing 1,229 unique AWS credentials. Upon investigation, the researchers found that the active keys were used in S3 ransomware campaigns, where the attackers utilized SSE-C to encrypt S3 bucket data and demanded 0.3 BTC (~$25,000) per victim. In some cases, the highly automated attackers were willing to offer a “proof of decryption” test file restoration.
EDV is a tool that feeds Windows Sysmon security events to Microsoft's Copilot AI through WebSocket connections, asking it to identify malicious activity. Testing with known attack techniques showed Copilot could detect about 40% of malicious events not blocked by Windows Defender, though with inconsistent results and false positives.
IDOR vulnerabilities occur when attackers manipulate direct object references like IDs in URLs to access unauthorized data. As a common form of Broken Access Control, these flaws are prevalent in web applications, relatively easy to find, and highly impactful. This guide walks through how bug bounty hunters regularly exploit it.
Frequency analysis is a technique that allows for the detection of anomalies in a set of data. This post details how Fourier Transforms can be used to shift data to the frequency domain and then detect C2 beaconing behavior. When a C2 beacon utilizes jitter to vary its periodicity, a sliding window must be used to properly detect the activity.
Sponsored
Developers are moving fast - your security should too. Symbiotic Security v1 [11] helps you ship secure code without slowing down. With AI-powered remediation, real-time contextual training, and an AI chat assistant built into your IDE, security works with developers to accelerate their flow. Teams can save an estimated $750+ per developer, per month. Speed and security, finally aligned. Get
Aurascape helps corporate IT departments monitor AI employee usage across thousands of AI applications—both approved and unauthorized. The technology tracks interactions, decodes prompt-response data, and evaluates security risks, even for less common AI tools.
Security automation content in SCAP, Bash, Ansible, and other formats
ollvm-unflattener is a Python tool to deobfuscate control flow flattening applied by OLLVM.
Companies with cyber insurance face ransomware demands 2.8 times higher than uninsured victims, as criminals specifically search for insurance policies during attacks. Insured victims pay more often (44% vs 24%) and pay significantly larger amounts.
SIEM provider RunReveal released an MCP server for use with its product. In this post, RunReveal provides insights into some ways that its customers are using the MCP server for threat hunting with Cursor, investigating GuardDuty alerts, and tuning and testing alerts. RunReveal believes that enriching and standardizing data to make it easier for LLMs to query is the future of its product.
This blog post focuses on kernel-mode registry objects essential for runtime hive management. It meticulously examines key internal structures, including _CMHIVE, _HHIVE, memory mapping mechanisms, cell maps, and key control blocks that collectively enable registry functionality like transaction management and synchronization. The post provides detailed explanations of these previously undocumented structures based on reverse engineering of Windows Server 2019, noting these findings apply to Windows 11 as well.
Chris Krebs resigned from SentinelOne after his security clearance was revoked and a presidential order was issued to review CISA's conduct under his leadership.
BidenCash Market leaked over 910,000 stolen credit card records on a Russian forum without names but with card details.
Microsoft has advised Windows 11 users of blue screen crashes following recent updates and suggests using Known Issue Rollback or Group Policy for fixes - deployment guidance is available on its support website.