Parse notes
Sponsored
Identity security is messy, and AI is making it messier. Restore sanity with Permiso Discover — an identity inventory and visibility tool for human, non-human, and AI.
(You'll also get an instant tour [4] of the full Permiso Platform.)
Salesforce assigned 5 CVEs after a security report revealed 20+ configuration weaknesses in Flexcards, Data Mappers, and core components. These vulnerabilities could expose customers to unauthorized access and session hijacking. 16 other flaws were classified as customer misconfigurations. Admins have been urged to review and secure configurations to prevent exploitation.
Researchers from Akamai are warning of two Mirai botnet campaigns exploiting a remote code execution vulnerability in the open-source security platform Wazuh. The first campaign has been active since March and uses a malicious shell script to download the Mirai payload. The second campaign seems to be targeting Italian-speaking users.
Researchers from AIM Labs discovered an attack against Microsoft 365 Copilot, an AI assistant built into Office apps, that allowed for the leaking of sensitive data. The attack involved embedding a hidden prompt in an email which bypasses Microsoft's cross-prompt injection attack classifier because it is phrased as text to a human. Later when the user requests Copilot's RAG engine to retrieve data from the email, the prompt is interpreted and injected into the LLM.
AI has revolutionized cybersecurity innovation, enabling startups to develop products and rapidly disrupt legacy providers. However, a paradox exists between fostering innovation and managing security vulnerabilities and compliance costs. Successful startups embed governance strategically, automate security with AI, contribute purpose-built tools, and prioritize community building for long-term advantage.
X's XChat messaging protocol uses flawed end-to-end encryption. It lacks forward secrecy, and stores user private keys on X's servers using Juicebox protocol across three software-based servers (not HSMs). This allows X to potentially decrypt messages for internal purposes or legal compulsion, making XChat's encryption largely ineffective against surveillance.
Researchers from Veracode detected a malicious NPM package called “solders” which uses a post-install hook to run the malicious lib.js file without user interaction. The lib.js file obfuscates the first layer using JavaScript type coercion to build up the strings from Japanese Unicode. The decoded string then uses hex encoding, array shuffling, and binary array encoding to build a base64 encoded PowerShell script that downloads a batch script that utilizes string reordering, 3DES encryption, and steganography.
Maze is building technology that models the workflow of an experienced analyst, where each agent ingests telemetry from a customer's public cloud accounts, reproduces the steps an attacker would take to move laterally, and then either closes the gap automatically or flags a concise set of exploitable weaknesses.
MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan, and more. Integrate security testing and penetration testing into AI workflows.
Claws is a static analysis tool for GitHub Actions modeled after Rubocop.
A roadmap from Hashicorp on how an organization can mature in its secrets management process. The guide is broken up into the adopting stage, where secrets management is first integrated; the standardizing stage, where automatic secrets rotation and compliance are introduced; and the scaling stage, where operations are scaled up and more services like PKI are managed. Each stage is broken up into three categories with actionable checklist items.
SmartAttack is a new method that uses smartwatches to steal data from air-gapped computers secretly using ultrasonic sound. The attack needs malware on the computer and a nearby smartwatch to receive hidden audio signals. Experts suggest banning smartwatches and removing computer speakers from secure areas to stop this.
Unit 42 researchers identified five actively evolving Linux ELF malware families (NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidPour) that threat actors are adapting to target cloud infrastructure, with cloud-based security alerts increasing 388% in 2024. These malware strains use techniques like dynamic linker hijacking and SSH daemon injection to achieve persistence, command and control, and data exfiltration in Linux-based cloud environments that comprise 70-90% of cloud computing instances. Palo Alto Networks' new machine learning detection module successfully identified 92% of tested ELF malware samples, demonstrating the effectiveness of ML-based approaches for detecting these evolving cloud threats.
INTERPOL conducted a global operation across 26 countries to shut down over 20,000 malicious IPs associated with 69 types of data-stealing malware, resulting in the arrest of 32 suspects and the seizure of servers and data.
Hackers are deceiving recruiters by masquerading as job seekers and submitting fake resumes that contain harmful files, which can compromise a company's system when opened.
Over 40,000 security cameras globally are accessible online, enabling hackers to potentially view or exploit live footage, particularly in homes and offices where security is often weak or non-existent.