Parse notes
Sponsored
It's not too late to join ThreatLocker's _100 Days to Secure Your Environment_ [4] — the step-by-step, tactical series that's helping security teams methodically fix what previous admins broke (or never built).
Vanta experienced a data breach affecting fewer than 4% of its 10,000+ customers due to a product code bug, not an intrusion. The incident exposed employee account data, including names, roles, and security configurations between customer instances. Vanta identified the issue on May 26 and will complete remediation by June 4.
MainStreet Bancshares disclosed that hackers stole data from 4.65% of its customer base through a third-party vendor attack in March. The bank's own systems weren't compromised.
Qualcomm has patched three zero-day vulnerabilities in its Adreno GPU driver that are being actively exploited in targeted attacks. CVE-2025-21479 and CVE-2025-21480 cause memory corruption through unauthorized GPU command execution and CVE-2025-27038 is a use-after-free vulnerability in Chrome's graphics rendering. Google's Threat Analysis Group confirmed these vulnerabilities are under limited, targeted exploitation, and Qualcomm provided patches to device manufacturers in May with urgent deployment recommendations. This continues a pattern of Qualcomm chipset vulnerabilities being exploited by threat actors, including a previous zero-day used by Serbian authorities with Cellebrite software to unlock activists' and journalists' Android devices.
InterceptSuite is a Windows network traffic analysis tool that intercepts and decrypts any TCP/TLS protocol communications, not just HTTP/HTTPS like existing tools. Built with C/OpenSSL and C#/.NET, it operates as a SOCKS5 proxy enabling real-time viewing and modification of encrypted traffic for security testing and application debugging. This blog dives into it and how it can be used.
This is a guide on maximizing value from the OSCP certification journey post-exam. It focuses on three actions: reflecting on exam performance to pinpoint weaknesses for targeted study plans, networking with professionals and peers via Discord servers and cybersecurity communities, and reassessing career goals to decide next steps. The author recommends a structured retrospective approach that includes data collection (timeline reconstruction and machine breakdowns), analysis (identifying operational hurdles and technical gaps), and reconstruction (developing focused practice plans and strategies). For new professionals, it suggests taking a break, updating resumes, exploring advanced topics like web applications or Active Directory, and considering related fields such as DevSecOps, SOC analysis, or detection engineering based on personal interests.
Muddled Libra, a threat group specializing in social engineering attacks using the 0ktapus phishing kit, targets organizations in software automation, BPO, telecommunications, and technology, particularly large outsourcing firms for high-value cryptocurrency institutions. The group shows deep knowledge of enterprise IT systems and utilizes a comprehensive toolkit, including smishing, MFA bombing, help desk social engineering, and commercial remote monitoring tools to maintain access and evade detection. Its main goal is data theft for supply chain attacks, leveraging stolen information from initial victims to infiltrate downstream customer environments.
Sponsored
Online threats against high-profile individuals can escalate into real-world harassment or even physical harm. This is growing more urgent due to geopolitical tensions, AI-powered deepfakes [11], and exploitable vulnerabilities. Learn how to use OSINT to identify these threats and take preventive action in Flashpoint's Complete Guide to OSINT for Executive Protection [11].
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Cradle is a cutting-edge open-source threat intelligence platform created by Prodaft and designed for collaborative analysis, visualization of entities and relationships, and report generation. The Cradle platform can be deployed using Docker and Compose, comprising a Python and Django backend, with an Electron and React frontend. It employs Redis and Postgres as its data storage solutions.
MarkItDown is a lightweight Python tool designed to convert various files into Markdown format for use with LLMs and text analysis workflows. It is most comparable to textract, but specifically aims to maintain key document structures and content in Markdown (such as headings, lists, tables, links, etc). Although the output is generally presentable and user-friendly, it is primarily intended for text analysis tools, and may not be ideal for high-fidelity document conversions intended for human readers.
The "Russian Market" cybercrime marketplace has become a leading platform for buying and selling stolen credentials, with logs available for as low as $2 and containing data from information-stealing malware, including passwords, session cookies, and credit card details. The marketplace has grown significantly following the takedown of Genesis Market, with 61% of stolen logs containing enterprise SaaS credentials from platforms like Google Workspace and Salesforce, and 77% including single sign-on credentials. Lumma stealer previously dominated 92% of the market but faces disruption from recent law enforcement actions, while a new stealer called Acreed is rapidly gaining traction with over 4,000 logs uploaded in its first week.
Cartier reported a data breach where hackers accessed customer information, including names, emails, and countries. However, no passwords or payment details were compromised. Other fashion brands like Dior and Adidas have experienced similar cyberattacks recently.
The fiscal 2026 budget proposal from President Donald Trump would cut the Cybersecurity and Infrastructure Security Agency workforce by eliminating 1,083 positions and reducing its budget by $495 million to $2.4 billion. This cut is slightly deeper than earlier forecasts. A new document from the Department of Homeland Security details the CISA personnel reductions and shows planned decreases in other federal cybersecurity programs.
Australia implemented the world's first mandatory ransomware payment disclosure rules in May, requiring organizations with AUS$3 million+ annual turnover to report payments to authorities within 72 hours.
Google Chrome will stop trusting SSL/TLS certificates from Chunghwa Telecom and Netlock starting August 1 (Chrome version 139) due to ongoing compliance failures and broken improvement commitments.
Certain Ulefone and Krüger&Matz phones have security flaws in preinstalled apps, allowing any app to reset the phone, steal PIN codes, or misuse system functions.