Parse notes
Sponsored
SentinelOne has just released the 2025 Cloud Security Risk Report [4]. Learn the 5 latest cloud security risks and how to protect against them along with in-depth case studies and insights into attackers' methods and mindsets to uplevel your cloud security posture.
Episource, a UnitedHealth subsidiary, suffered a ransomware attack between January 27 and February 6 that exposed the data of 5.4 million patients, including medical records, diagnoses, medications, and insurance info. This is the second major breach for UnitedHealth in 13 months, following the Change Healthcare attack that affected 190 million Americans in February 2024. The attack suggests that threat actors are now targeting third-party healthcare providers to access large amounts of protected health information across multiple organizations.
Fitify, a popular fitness app, exposed 373,000 files, including 138,000 progress photos, via an unsecured Google Cloud storage bucket. Many of the photos showed users in minimal clothing, making the exposure highly sensitive. Additionally, private data was accessible without passwords or security keys, and the app contained hardcoded secrets that could have allowed attackers to access more user information.
Mobile Notary Zone (MNZ), a third-party notary service vendor, reported a highly sensitive data breach. The compromised data includes full names and addresses, SSNs, dates of birth, government-issued IDs, bank account and payment details, loan, employment, and escrow data. The breach also affected clients served by MNZ, prompting at least one provider (New American Funding) to terminate its relationship with them.
Hackers target home routers to use as residential proxies, command-and-control servers, and botnets. Recent ASUS breaches demonstrate that backdoors can survive updates. These attacks often brute-force default passwords or exploit vulnerabilities, then install SSH backdoors. Defenses include disabling WAN management and SSH, changing default credentials, enabling automatic updates, and auditing configs for unauthorized access.
Android malware "Konfety" employs sophisticated evasion tactics, including dual-app deception (same package name for benign and malicious versions), ZIP-level tampering to break analysis tools, dynamic code loading with encrypted assets, stealth techniques such as icon hiding, and the use of the CaramelAds SDK for ad fraud.
Matanbuchus, a Malware-as-a-Service (MaaS) loader that has been active since 2021, has evolved to version 3.0 with enhanced capabilities. Recent campaigns have used Microsoft Teams impersonation and Quick Assist for deployment. Updates include improved communication protocols, in-memory stealth, enhanced obfuscation, indirect system calls, broader execution support, and enriched data collection targeting EDR controls.
Sponsored
Watch 1Password's on-demand webinar [11] exploring proactive approaches to managing the sprawl of unapproved SaaS apps and AI tools.
The Go programming language has introduced native FIPS 140-3 compliance support directly into its standard library and `go` command, starting with Go 1.24. Developers can enable FIPS 140-3 mode by setting the `fips140=on` GODEBUG option (either as an environment variable or in go.mod), and can build against validated cryptographic modules using `GOFIPS140=v1.0.0 go build`. This native integration eliminates the need for unsupported third-party solutions, providing a seamless developer experience with cross-compilation support and no performance overhead from foreign function interfaces.
VulnerableCode is a free and open database of open source software package vulnerabilities.
SSH-Snake is a tool designed to perform automatic network traversal using SSH private keys discovered on systems with the goal of creating a comprehensive map of the network and its dependencies.
Cloudflare blocked 7.3 million DDoS attacks in Q2 2025, including a record-breaking 7.3 Tb/s attack. Most attacks were small and brief, but intense attacks are increasing. Attackers are using increasingly powerful botnets and targeting new industries and countries.
Hackers are concealing malware in DNS records, particularly TXT records, by converting binary files to hexadecimal and splitting them across multiple subdomains. This technique evades security defenses as DNS traffic is often unmonitored and has been used to deliver malware like Joke Screenmate and malicious PowerShell scripts.
UK cybersecurity firm Adarma has entered administration, the UK equivalent of bankruptcy, after investor Livingbridge withdrew funding three months earlier due to major contract losses. All 173 employees were made redundant with immediate effect on July 14. The company struggled financially despite charging daily rates of £740-£2,380 and serving clients with a combined turnover of £150 billion.
A Chinese state-sponsored hacking group known as Salt Typhoon breached a U.S. Army National Guard network, stealing sensitive data, including passwords and network diagrams.
Google patched CVE-2025-6558, a high-severity sandbox escape vulnerability in Chrome's ANGLE graphics layer that was actively exploited by attackers, marking the fifth zero-day Chrome fix in 2025.
Co-op's CEO confirmed that hackers stole the personal data, including names, addresses, and contact details, of all 6.5 million customers during a cyberattack in April.