Parse notes
Sponsored
Remote hiring, deepfakes, and interview-cheating tools create a dangerous opportunity for bad actors. Rigid identity verification at every step solves it, but makes life hell for your honest employees.
Murphy Law Firm is investigating a class action lawsuit against Century Support Services following a November 2024 data breach that compromised the personal information of 160,759 individuals. Exposed data includes Social Security numbers, financial account information, medical records, and driver's licenses. The firm is seeking damages for affected individuals whose sensitive information may now be available to cybercriminals.
The ransomware group DragonForce attacked US department store chain Belk in May, compromising the names and Social Security numbers of customers. The attack disrupted online and physical operations for days, with Belk's website still offline. DragonForce claims to have exfiltrated 156GB of data and made it publicly available, suggesting no ransom was paid.
The CISA is warning users of a new critical (CVSS 10/10) vulnerability in the Wing FTP software that is under active exploitation. The vulnerability stems from Wing FTP software not sanitizing usernames that contain a NULL byte and then constructing a Lua session file from the username, which can potentially include Lua code after the NULL byte. Huntress and Arctic Wolf have both recorded that they have seen attackers exploiting exposed servers to download and execute malicious files, perform reconnaissance, and install remote monitoring and management software.
This article introduces a four-part cybersecurity playbook on analyzing and exploiting Windows kernel drivers. It highlights the rising threat of BYOVD (Bring Your Own Vulnerable Driver) attacks, where attackers exploit legitimate but flawed signed drivers to bypass kernel protections.
The first part of Zach Allen's Detection Engineering Field Manual introduces the concept of detection engineering, which primarily focuses on detecting when a threat actor circumvents controls. Allen models SOC operations in three loops: Loop 1 identifies assets and utilizes controls to protect them, Loop 2 employs rules to detect threats and responds with containment, and finally, Loop 3 focuses on recovering and learning from incidents. A detection engineer can focus on one loop or all of them and should, at a minimum, possess some coding expertise and a customer-centric mindset.
Typage 0.2.3 introduces passkey-based file encryption using the WebAuthn PRF extension, allowing users to encrypt files that can only be decrypted with biometric authentication or hardware security keys. The implementation creates a new age recipient format (fido2prf) that binds each encrypted file to specific hardware credentials, requiring both the encrypted file and physical access to the authenticator for decryption. Files encrypted on one device can be decrypted on another through synced passkeys. A companion CLI plugin also enables this functionality with FIDO2 hardware tokens outside the browser.
Zip Security helps organizations implement security best practices and achieve compliance, while also managing their IT infrastructure to reduce service overhead and costs.
Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time.
Patchman is a Django-based patch status monitoring system for Linux servers.
Meta fixed a security bug that allowed users to access other users' private AI prompts and responses by manipulating unique prompt numbers. Security researcher Sandeep Hodkasia discovered the vulnerability in December and received a $10,000 bug bounty. Meta deployed the fix in January after finding no evidence of malicious exploitation of the flaw.
On Tuesday, it was revealed that in 2022, a British official accidentally leaked data of Afghans who had applied to move to the UK under the Afghan Relocations and Assistance Program (ARAP). ARAP was set up for Afghans who feared reprisal from the Taliban. The impacted individuals are now being notified after a “super injunction” that prohibited discussion of the leak was lifted on Tuesday.
The UK's NCSC announced the launch of a new Vulnerability Research Initiative (VRI) to partner with external cybersecurity researchers. Researchers who partner with the program will be given objectives to identify flaws in specific projects of interest, assess proposed mitigations, and then disclose the flaws through the “Equities Process” procedure.
DOGE employee Marko Elez accidentally committed an xAI API key that had access to at least 52 different LLMs, an oversight that raises concerns, as Elez has access to various government databases, including SSNs.
Abacus Market, the largest Western darknet marketplace that facilitated an estimated $300 million in illegal drug transactions, has suddenly gone offline in what appears to be an exit scam where operators vanished with users' escrowed funds.
Scammers are tricking UK pet owners with fake emails asking for microchip renewal fees using real pet details stolen from insecure databases.