Parse notes
Sponsored
Traditional File Integrity Monitoring (FIM) often becomes shelfware. Daily polling scans generate endless notifications without context — and as an added bonus, they're so resource-intensive that you can't actually run them in real time.
* Real-time detection vs polling methodologies * Change management and reconciliation workflows
The May 2025 WordPress Core malware campaign, discovered by Wordfence, has three versions: one steals credit card data from checkout pages while mimicking Cloudflare security screens, another hijacks Google Ads and steals login credentials, and the third spreads more malware by replacing website links. Since September 2023, all have been disguised as legitimate plugins and employ advanced anti-detection methods, including hosting management systems on infected sites.
Two major healthcare data breaches have been disclosed. Mainline Health Systems (Arkansas) suffered a ransomware attack by the Inc. Ransom group in April 2024, affecting over 101,000 individuals with stolen sensitive files. Select Medical Holdings (Pennsylvania) was impacted by a vendor breach at Nationwide Recovery Services that exposed nearly 120,000 people's data.
Rapid7 discovered eight vulnerabilities that affect 748 printer models from five vendors, with Brother accounting for 689 affected devices. The critical flaw CVE-2024-51978 (CVSS 9.8), which allows attackers to generate default admin passwords using device serial numbers, cannot be firmware-patched.
Low session expiration times frustrate users and don't effectively improve security. Frequent reauthentication aims to prevent credential theft, but if attackers have physical access, a screen lock suffices, and if remote, expiration times are often too long to prevent breaches. Instead, systems should reauthenticate only before sensitive actions and use continuous verification like device checks and SCIM controls.
Researchers found that AI-related secrets dominate public code repository leaks, comprising 4 of the top 5 vulnerable secret types. The three main sources are Python notebook files, AI agent config files, and new AI vendor secret types that scanners overlook. Valid secrets from more than 30 companies, including Fortune 100 firms, were found, highlighting poor AI development security practices.
Horizon3.ai suggests security teams should prioritize "exploitability" over "vulnerability," as many weaknesses can't be exploited in real-world scenarios. Their NodeZero platform conducted over 50,000 pentests in 2024, uncovering 765,000 critical exploitable paths and showing attackers can gain domain admin access in 60 seconds by chaining vulnerabilities and misconfigurations. They recommend continuous autonomous testing rather than annual assessments, with 82% of their customers now testing monthly compared to 26% of organizations testing more than once yearly.
Sponsored
Identity security is messy, and AI is making it messier. Restore sanity with Permiso Discover — an identity inventory and visibility tool for human, non-human, and AI.
(You'll also get an instant tour [11] of the full Permiso Platform.)
OktaGinx is an Evilginx phishlet that bypasses Okta authentication chained with Azure.
IntelOwl is an Open-Source solution for managing Threat Intelligence at scale. It integrates several analyzers available online and many cutting-edge malware analysis tools.
The "wsuks" tool automates man-in-the-middle attacks on Windows Server Update Service (WSUS) configs using HTTP instead of HTTPS. It uses ARP spoofing to impersonate the WSUS server. It serves malicious updates with PsExec64.exe and PowerShell scripts that run as SYSTEM to create local admin users or add domain users to the local administrators group.
Microsoft has announced a new method for consumers to enroll their Windows 10 devices in the free Extended Security Updates (ESU) program. The method requires users to enable Windows Backup to sync settings and folders to the cloud. If a user has more than 5GB of data to sync, they must purchase additional space for Windows Backup to work and claim the free ESU enrollment. Users can also enroll in the program by paying $30 or redeeming 1K Microsoft Reward points for a year of updates.
French authorities detained five suspected BreachForums operators, including known cybercriminals ShinyHunters, IntelBroker, Hollow, Noct, and Depressed, who allegedly ran the stolen data marketplace and targeted French companies. They tried to revive BreachForums after its earlier 2023 shutdown following the founder "pompompurin's" arrest.
The UK Home Office's 2022 anti-encryption "No Place to Hide" campaign website was hijacked to promote payday loans from Wage Day Advance. Tech expert Heather Burns discovered the unauthorized content insertion. This appears to be part of a growing trend where abandoned campaign websites on trusted domains are exploited for SEO spam content.
The UK's ICO has issued its first guidance on handling personal data after complaints about excessive data collection by smart devices, with users feeling powerless over how their data is shared and used.
Trezor users are receiving phishing emails that mimic genuine support messages, with attackers exploiting Trezor's support system to send fake alerts and links to steal wallet seed phrases.
Researchers in Sweden developed a highly efficient, on-demand amplifier that conserves power and safeguards quantum bits, potentially boosting future quantum computers.