Parse notes
United Natural Foods disclosed a cyberattack on June 5 that disrupted operations and order fulfillment. The company activated incident response protocols and took systems offline. This follows similar recent attacks on grocery chains in the UK.
Sophos detected a campaign in which an attacker uses GitHub repositories with hidden backdoors to target other hackers and gamers. The repositories use various loaders to deploy various payloads, such as info-stealers and remote access trojans (RATs). Many of the fake repositories are designed to target other hackers, but some also use game cheats, mod tools, and fake exploits as lures.
While conducting a routine scan of industrial-control hosts, Censys researchers discovered an uncommon TLS certificate configuration that led to the discovery of a browser-based HMI platform. These internet-exposed platforms could be used to view and control water systems without authentication. Censys sent a bulk notification to the EPA, and the number of systems that were either read-only or fully controllable was reduced from 300 to 20.
An in-depth comparison of security features in EKS and GKE. The post breaks down features by Identity and Access Management (IAM), controlling network traffic, configuration/posture management, vulnerability/supply-chain management, and runtime threat detection.
SentinelOne observed and countered Chinese cyberespionage operations targeting the company in 2024-2025, including PurpleHaze reconnaissance and a ShadowPad intrusion via a hardware logistics partner, but SentinelOne wasn't compromised. The broader campaigns targeted 70+ organizations globally, including government, media, and cybersecurity vendors.
In late 2024, Ivanti released advisories for vulnerabilities in its Cloud Services Appliance (CSA) product, which were discovered to be part of an exploit chain against the products. In this post, Synacktiv researchers break down three of the open-source tools they observed used by attackers in post-exploitation activities on these devices and provide YARA rules to detect them. The attacker planted Suo5 after the initial compromise as a webshell to be used on an internet-facing Exchange server. The attacker then established persistence using the iox tunnel and attempted lateral movement using atexec.py to gain remote code execution via Task Scheduler.
Guardz continuously monitors organizations' internal and external digital footprint to provide real-time protection. From a single dashboard, administrators can immediately take action when necessary.
Bugfish Nuke is a powerful emergency data deletion tool for Windows designed to help you quickly and securely erase sensitive files, user data, and system traces.
ADeleginator is a tool for finding insecure trustee and resource delegations in Active Directory environments.
A security researcher discovered a Google bug that allowed attackers to reveal any account's private recovery phone number in under 20 minutes without owner notification. The exploit bypassed anti-bot protections through automated brute-force attacks. Google confirmed the fix after the researcher disclosed the vulnerability in April. It paid a $5,000 bounty and found no confirmed exploits occurred.
The Chrome Secure Web and Network team has drafted a proposal to require explicit permission for a site to access devices on the local network. This proposal seeks to address a common attack vector in which an attacker can use a CSRF vulnerability to attack a local device such as a printer. The proposal would require any request that seeks to access a more private IP space (such as public to private or private to loop back) to obtain a new “Local Network Access” permission from the user via a prompt.
The Linux Foundation has launched the FAIR Package Manager, a new way to manage WordPress plugins and themes. It was created after a major conflict between WordPress companies Automattic and WP Engine. This tool gives developers more control by offering a decentralized and secure plugin system.
OpenAI banned ChatGPT accounts associated with hackers in Russia and China who exploited the AI for cyberattacks, malware creation, and disinformation, while successfully mitigating the threats with partner assistance.
President Trump issued an executive order altering previous cybersecurity regulations by eliminating support for digital IDs in public benefits, modifying the government's software, AI, and encryption approaches, and restricting cyber sanctions to foreign threats only.
Two fake npm packages pretended to be useful tools but deleted all files in project folders instead.