Parse notes
Cisco disclosed vulnerabilities (CVE-2025-20188) in IOS XE for Catalyst Wireless Controllers and APs. The vendor indicated that a hard-coded JSON Web Token (JWT) allows unauthenticated remote attackers to upload files, perform path traversal, and execute commands with root privileges. CVE-2025-20188 is only dangerous if the 'Out-of-Band AP Image Download' feature is enabled on the Wireless Controllers.
The Interlock ransomware group has deployed a Remote Access Trojan (RAT) called NodeSnake in attacks on two UK universities over two months. NodeSnake enables attackers to control infected computers, access files, monitor activity, and install additional malware while remaining undetected. It emerged in September 2024 and previously targeted large organizations in North America and Europe. Interlock now focuses on educational institutions and local governments, possibly to steal intellectual property and test new attack methods.
Two race condition vulnerabilities (CVE-2025-5054 and CVE-2025-4598) in Linux dump handlers enable local attackers to steal password hashes and sensitive data from crashed privileged processes. These flaws affect apport in Ubuntu and systemd-coredump in Red Hat and Fedora, allowing attackers to exploit SUID programs via timing attacks that replace crashed processes with malicious ones to access core dumps. Organizations can mitigate risk by disabling core dumps for SUID binaries with "echo 0 > /proc/sys/fs/suid_dumpable" until patches are applied.
Nix enables secure software supply chains by providing verifiable proofs of the sources that produced a final product, removing the need for restrictive air-gapped environments. It tracks all dependencies to their source code through fixed-output derivations and exports these sources, typically a few GB, to an offline system for integrity proof by rebuilding everything from scratch. This method lets developers use modern tools and workflows while ensuring the cryptographic supply chain verification needed by agencies like CISA, BSI, and ANSSI for critical systems.
U.S. authorities have dismantled DanaBot, a Russian malware operation that infected 300,000+ systems and caused $50+ million in damage. The takedown showcased agentic AI's cybersecurity capabilities. Autonomous threat detection and real-time analysis were used to accelerate investigations and enable swift law enforcement action against sophisticated cyber threats.
Even well-configured enterprise Wi-Fi networks that use EAP-TLS can be compromised via wireless pivots targeting trusted devices connecting to untrusted networks outside the corporate perimeter. Attackers capture probe requests from corporate devices, set up rogue access points mimicking home networks (like Thomson routers), crack Wi-Fi passwords via WPA handshake captures, and use tools like Responder to intercept NetNTLM hashes from mDNS/LLMNR broadcasts. Once cracked, these hashes provide internal credentials for accessing cloud services like Office 365, illustrating that the security boundary extends beyond the corporate network to any location where trusted devices connect.
Sponsored
Industrial environments—such as critical infrastructure and manufacturing—face unique threats that IT security training doesn't address. Watch the video [11] to see why specific ICS/OT training is a must. Ready to start? SANS offers hands-on labs with real equipment and instructors who are active in the field today. See available
Envilder is a CLI that securely centralizes your environment variables from AWS SSM as a single source of truth.
PromptMe is an educational project that showcases security vulnerabilities in large language models and their web integrations. It includes 10 hands-on challenges inspired by the OWASP LLM Top 10, demonstrating how these vulnerabilities can be discovered and exploited in real-world scenarios.
Unbound's AI Gateway product connects to commonly used AI tools to surface usage patterns and provide model routing, real-time protection, and usage analytics.
International law enforcement seized AVCheck, one of the largest counter-antivirus services cybercriminals used to test whether their malware could evade commercial antivirus software before deployment. The operation, which involved U.S., Dutch, and other agencies, also took down related crypting services Cryptor.biz and Crypt.guru that helped obfuscate malware to make it undetectable. The takedown was part of Operation Endgame and disrupted a key component of the cybercriminal ecosystem that allowed ransomware groups to refine their attacks against security systems.
German police have identified "Stern," the enigmatic leader of the notorious Trickbot cybercrime cartel, as 36-year-old Russian Vitaly Kovalev. Trickbot attacked thousands of victims, including hospitals, stealing hundreds of millions over six years. Kovalev was previously sanctioned under different aliases, but his connection to "Stern" remained hidden until now.
Meta disrupted propaganda campaigns from Iran, China, and Romania that misled users with fake accounts and AI-generated images.
93.7 billion stolen cookies are for sale online, with 7-9% still active and exploitable by cybercriminals for account access.
Victoria's Secret responded to a cybersecurity incident that disrupted its website and online orders by shutting down its website, pausing some in-store services, and collaborating with third-party experts to restore operations.