Parse notes
Sponsored
Based on 8,306 interviews with security professionals, the new 2025 Cost of Insider Risks [5] report highlights the scope of the insider threat problem, and the cost vs opportunity of insider risk management.
Berkeley Research Group (BRG), a financial advisory firm working on multiple church bankruptcy cases, has disclosed a data breach. BRG was involved in at least ten bankruptcy cases involving dioceses and archdioceses nationwide.
Pearson has reported that an attacker breached its systems and stole “legacy” data. Other sources revealed that the stolen data was obtained via an exposed .git/config file containing a GitLab Personal Access Token (PAT), which was used to obtain hardcoded secrets for cloud platforms and data stores from source code. The stolen data allegedly contains customer information, financials, support tickets, and source code.
Cisco has released fixes for a maximum severity (10.0 CVSS score) vulnerability affecting IOS XE Software for Wireless LAN Controllers. The devices utilize a hardcoded JWT that could allow unauthenticated attackers to exploit the AP image download interface to upload files, perform path traversal, or execute arbitrary code. Only devices with the “Out-of-Band AP Image Download” feature, which allows APs to download AP's OS images via HTTPS, are vulnerable.
In this blog post, the author recounts creating defendnot, a Windows Defender disabling tool, after his previous project faced a DMCA takedown. The twist in the story is that he built it while traveling and got inspired while in Seoul, which made him seek to develop a "clean" implementation using Windows Security Center API.
This post explores SCIM (System for Cross-domain Identity Management), detailing its core components, potential security vulnerabilities, and common implementation issues. It provides insights into authentication bypasses, token management risks, user re-provisioning flaws, and potential account takeover scenarios in identity management systems.
Enforcing FIDO as the sole MFA is often seen as phishing resistant. However, this post shows a new attack that utilizes the OAuth 2.0 Device Code Flow to downgrade MFA. The Device Code Flow enables a user to authenticate devices. In this method, an attacker uses a headless browser to automate the Device Code Flow, allowing the user to be phished through an attacker-controlled link without entering the code.
Sponsored
Qwiet AI has been named BEST APPLICATION SECURITY SOLUTION [14] by the SC Awards [15]. Our Agentic AI AutoFix accelerates vulnerability detection, prioritizes by exploitability, and remediates code directly. We're reshaping AppSec for faster, more secure development. Schedule a personalized demo [16]to see why industry leaders trust Qwiet AI.
VanishID offers online executive (and families) protection, including continuous dark web monitoring for compromised passwords, detection of fake social media accounts, identification of misconfigured websites, and data and fake profile takedown capabilities.
The Agentic Radar analyzes and assesses agentic systems for security and operational insights. It helps developers, researchers, and security professionals understand how agentic systems function and identify potential vulnerabilities.
KoviD is a Linux kernel rootkit that hides itself and files, grants root privileges, and evades firewalls. It can easily manipulate network logs, gain root access, and persist through reboots.
German authorities seized €34 million from the eXch crypto exchange, alleging unlicensed operations and money laundering by North Korean hackers, including proceeds from the Bybit hack through illicit cryptocurrency transactions.
Micah Lee searched for DOGE employee Kyle Schutt's personal Gmail address on Have I Been Pwned and found that he appeared in 51 breaches and five pastes. Notably, Schutt's credentials appeared in info-stealer logs, meaning that a device belonging to him was infected with info-stealer malware at some point. Schutt has access to FEMA's core financial systems. DOGE has not confirmed if employees are using work or personal devices.
Zakhar Fedotkin found that ASCII control characters such as SOH (\x01) and ETX (\x03) can be exploited in Visual Studio Code to run arbitrary commands via node-pty, which sends raw bytes to the shell. The vulnerability exploits two vectors: injecting control characters into run configuration files and creating maliciously named files that execute commands when dragged into VS Code's terminal. This issue impacts macOS and Ubuntu systems, where control characters are permitted in filenames, although Microsoft does not view it as a security vulnerability due to measures like workspace trust warnings.
Florida's proposed social media encryption backdoor bill fails, and it was rejected after concerns about user privacy and potential security vulnerabilities from law enforcement access.
Roblox is being sued for allegedly tracking children's data without proper consent and sharing it with advertisers through hidden tools.
Hackers are now exploiting ClickFix attacks on both Linux and Windows systems by deceiving users into executing commands that install malware via fraudulent website error messages.