Parse notes
Sponsored
M&A deals move fast, but security can't be an afterthought. In this on-demand webinar, security leaders with experience handling over 30 M&As share insights on what every acquirer needs to know to protect their organization before and after the deal closes.
AMEOS Group, an operator of a Central European healthcare network, suffered a security breach that may have exposed customer, employee, and partner information. In response to the breach, AMEOS has shut down all IT systems and terminated all external and internal network connections while it responds to the incident. AMEOS has stated that it doesn't currently have evidence of any data being leaked, but it is continuing to investigate.
Jeremiah Fowler discovered an unprotected, unencrypted, and publicly exposed database containing over 3.5 million PDFs belonging to the Australian fashion brand SABO. The files contain PII, including names, physical addresses, email addresses, phone numbers, and other personal information corresponding to retail and corporate customers. Some of the PDFs contain multiple orders, suggesting that the number of affected individuals may be higher than 3.5 million.
Chinese government-affiliated hackers exploited a Microsoft SharePoint vulnerability affecting 50+ organizations, including the National Nuclear Security Administration. The zero-day flaw enables remote access to on-premises SharePoint versions, allowing attackers to steal documents and sensitive information.
This post walks through a demo setup of the Mythic C2 framework that uses redirectors to disguise itself as legitimate WordPress traffic. The redirectors use a legitimately registered domain and certificates and use Nginx to offer WordPress as a front end, as well as an api subdomain that forwards traffic to the C2 server and a dl subdomain that disguises payloads as font files. The setup also utilizes the EarlyBird Injection technique, where the loader executes code before the target process is fully initialized, both in its loader and through string obfuscation to employ evasion during installation. The post concludes with a discussion of further enhancements, such as ensuring domain age before weaponizing it and detection mechanisms for this setup.
A critical SharePoint vulnerability (CVE-2025-53770), dubbed "ToolShell," is being mass-exploited by Chinese government groups, affecting over 400 systems, including the US National Nuclear Security Administration. The flaw allows unauthenticated remote code execution, credential theft, and data exfiltration. Microsoft patched it on Saturday, but it is being exploited on any company that has not updated their SharePoint.
VPNs mainly serve two purposes: bypassing internet censorship and remote access to corporate networks, despite being marketed as security tools. They hide your IP and encrypt traffic, but don't ensure anonymity (Tor is better), don't fully secure public Wi-Fi (most traffic is HTTPS), and shift data from your ISP to the VPN provider. When choosing one, review the provider's business model, data practices, encryption protocols (prefer OpenVPN or WireGuard), and verify claims through third-party audits.
Sponsored
Security policy differences and insider threats can emerge during M&As. On July 17, hear from security leaders with experience handling over 30 M&As as they share real-world advice on aligning access, mitigating risk, and securing new environments.
golem automates C/C++ vulnerability scans by combining Semgrep rule scans, LLVM call-graph and CFG slicing, and AI-driven context analysis to flag potential security issues, generate graph artifacts, and produce a detailed, prioritized audit report.
Faraday is an open-source vulnerability management platform designed to centralize vulnerability data and automate scanners.
Proton's Lumo AI uses open-source models, zero-access encryption, and doesn't train on user data, emphasizing privacy-focused development.
Clorox sued Cognizant over a 2023 cyberattack by Scattered Spider hackers, claiming that Cognizant staff had given away employee passwords when asked by phone without proper verification. The breach caused $380 million in damages. Cognizant disputes responsibility, saying it only provided limited help desk services, not cybersecurity management.
The UK government proposes banning public sector organizations (NHS, councils, and schools) and critical infrastructure from paying ransomware criminals, aiming to make them less attractive targets. The Cyber Resilience Bill will impose daily fines of £100,000 for security failures. Private companies must still report their intentions to pay ransoms to authorities.
China has launched a voluntary national online ID service aimed at centralizing citizen identity verification and reducing the collection of private company data. While officials claim it enhances privacy, critics argue that it strengthens government surveillance capabilities, as authorities can revoke digital certificates and effectively erase users' entire online presence.
Sponsored
Join the biggest names in tech and AI at SecurityWeek's AI Risk Summit to explore real-world AI threats, governance, and security. August 19–20 at the Ritz-Carlton in Half Moon Bay, CA.
Australian IVF giant Genea has confirmed that, following a February data breach, stolen patient health information was posted on the dark web.
Brave Browser will block Windows Recall from screenshotting browsing activity by default using Microsoft's SetInputScope API with the IS_PRIVATE scope, joining Signal in proactively preventing the controversial feature from capturing sensitive user data.
Trump's new AI Action Plan encourages critical infrastructure to adopt AI for cyber defense while acknowledging the vulnerabilities of AI systems, but offers no new funding and adopts a deregulatory approach that critics say prioritizes innovation over safety.