Parse notes
Sponsored
Threats against high-profile individuals often start online — but if they go unnoticed, they can escalate into real-world harassment or even physical harm. This threat is growing more urgent at a time when:
MathWorks, creator of MATLAB computing platform, disclosed a ransomware attack that began May 18 that affected customer-facing applications and internal systems. The company has been gradually restoring services with cybersecurity experts' help and has notified federal authorities, but it hasn't revealed which ransomware group was responsible or whether data was stolen.
Adidas disclosed that an unauthorized person stole customer contact information from a third-party customer service provider. The data included names and email addresses of customers who previously contacted support, but excluded passwords and payment information. The company is notifying affected customers and authorities while investigating the breach.
A critical vulnerability in GitHub's MCP integration allows attackers to use prompt injection in public issues to trick coding agents (e.g., Claude) into leaking data from private repositories. This exploit, termed a "toxic agent flow," does not rely on compromised tools but exploits trusted agents' interactions with untrusted external content. The issue requires system-level mitigations—like runtime guardrails and continuous MCP traffic monitoring—since model-level alignment is insufficient to prevent such context-driven attacks.
ReliaQuest has discovered a campaign that uses SEO poisoning to target employee mobile devices for payroll fraud. Attackers create fake company login pages that appear in search results, steal credentials when employees access them, and then redirect paychecks to attacker-controlled accounts. This post dives into the campaign, the attacks, and how they keep evading detection.
RedisRaider is a new Linux malware campaign that scans the internet for public Redis servers running on Linux and then abuses the Redis SET command to inject a cron job. The cron job downloads the RedisRaider binary to /tmp/mysql, makes it executable, and then executes it using nohup. The RedisRaider binary is a heavily obfuscated dropper for a modified version of the XMRig cryptominer that uses a custom packer to further complicate reversing and forensic analysis.
Tailscale can use ACLs to provide zero-trust network access to internal resources. This guide presents and walks through a sample Enterprise ACL and then deep-dives into how ACLs can be written and modified for some common use cases, such as RBAC, secure device access, hybrid infrastructure, and SSH auditing.
secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and is designed to improve productivity for pentesters and security researchers.
The top five tools for hacking Active Directory domains are PingCastle, ldapdomaindump, BloodHound & PlumHound, Responder, and HashCat.
azurevelo deploys a Velociraptor container on Azure App Service to aid incident responders.
"Laundry Bear," a Russian state-backed hacker group, breached Dutch police systems in September, accessing all officers' contact details. The group targets Western nations supporting Ukraine, seeking military equipment information.
Two new content-process exploits were demonstrated against Firefox at Pwn2Own 2025, but neither bypassed the browser's sandbox. Mozilla released patched versions the same day and urged users to update immediately. These results reflect recent architectural hardening and reinforce Firefox's security resilience.
macOS's TCC framework blocks unauthorized access to sensitive data, even for malware with root access, but many third-party apps expose vulnerabilities that bypass these protections. A flaw in Cursor.app shows how malware can inherit TCC permissions and access protected files without user knowledge. Developers and vendors often ignore these issues, despite their real threat to user privacy and system integrity.
Zscaler announced its intention to acquire Red Canary, known for Managed Detection and Response (MDR) services, to enhance its integration of artificial intelligence, automation, and human expertise into security.
Cloudflare CEO Matthew Prince warned that LaLiga's broad anti-piracy IP blocks, which target Cloudflare infrastructure, are causing significant collateral damage by disrupting access to critical and legitimate websites, including emergency services in Spain.
An Iranian man has confessed to his involvement in the Robbinhood ransomware attacks that targeted U.S. cities and organizations from 2019 to 2024, stealing data and demanding Bitcoin ransoms.