Parse notes
Sponsored
Pentesting prices are a CFO's worst nightmare. $50K for a web app test. Another $30K if you want APIs included. Scope creep? That'll be extra. Need a retest after fixes? Start the procurement process again.
covers unlimited penetration testing: red team exercises, API testing, vulnerability scans, infrastructure reviews - everything.
The North Face says hackers stole customer information in a cyberattack in April. The attack happened because many people reused passwords from other sites. This is the fourth data breach for the company since 2020.
Google released an emergency Chrome update to fix a serious security flaw. The bug, CVE-2025-5419, is already being used by hackers. The vulnerability has been flagged as an out-of-bounds read and write vulnerability in the V8 JavaScript and WebAssembly engine.
The Crocodilus Android malware can now add fake contacts to trick users into thinking calls are from trusted people or companies. It has spread worldwide and added new tools to avoid detection and steal better data. Experts warn users to only download apps from trusted sources and use Google Play Protect.
A security engineer outlines five crucial decisions for startups to minimize security risks: using an identity provider like Google Workspace or Okta ($6-15/month), implementing hardware security keys for phishing-resistant MFA ($50-75/user), and adopting Infrastructure as Code tools like Terraform for version control. The guide also suggests leveraging managed cloud services such as AWS Fargate and RDS over self-managed VMs, and deploying Mobile Device Management to secure employee endpoints from the outset. The author highlights that significant security improvements stem from operational excellence and strategic tool choices rather than additional security processes or analysts.
Wiz researchers discovered a cryptojacking campaign called "JINX-0132" targeting misconfigured DevOps servers, including Nomad, Consul, Docker, and Gitea. Attackers exploit default settings and vulnerabilities to deploy XMRig miners, avoiding custom malware by using GitHub repositories. The campaign affects 25% of cloud environments, with 5% exposed and 30% misconfigured.
Microsoft's Deputy CISO for AI outlines key principles for safe AI deployment: understand potential failures and create plans, analyze entire systems, including humans, continuously assess risks, and maintain written safety plans. AI errors are intrinsic—treat AI like "well-intentioned but inexperienced new hires." Emphasize extensive testing over coding time and careful information presentation across human-AI boundaries.
Sponsored
RSA was filled with promises of AI and shift-left. But talk to teams on the ground and it's a different story, filled with unaddressed risks, bolted-on tools, and security that slows down development. Here are the four ways the current approach is failing - and how develop-first security fix them [11] on the Symbiotic blog [11].
The Delegations tool enables management of all types of Kerberos delegations (unconstrained, constrained, and resource-based) in Active Directory.
Sbommv is a tool for transferring SBOMs between systems. It is designed to fetch SBOMs from input sources, translate and validate them, enrich metadata, and push them to output destinations.
Securely share sensitive information with automatic expiration and deletion after a set number of views or duration, with full audit logs. Track who, what, and when.
Microsoft and CrowdStrike are leading an effort to map different names for the same cyber threat groups. This helps security teams better understand and track threats without needing a single standard name. Other companies like Google and Palo Alto Networks are joining to make threat info clearer and more useful.
Meta and Yandex exploit browser protocols to bypass Android security, linking web browsing to app identities. Their tracking code sends identifiers from websites to Facebook, Instagram, and Yandex apps via localhost ports, de-anonymizing users. Google is investigating this violation of privacy principles. Both companies have confirmed they have paused the practice.
Hackers exploited misconfigured DevOps tools such as HashiCorp Nomad, Consul, Docker, and Gitea to mine Monero cryptocurrency, prompting security experts to emphasize the need for better protection of these tools to prevent future attacks.
Hackers deceived users into downloading malware by creating counterfeit Python and NPM packages that mimicked legitimate software.
Hackers reportedly stole over 100 GB of data from the EPA, primarily consisting of harmless scientific test results.