Parse notes
Sponsored
Compare leading endpoint protection vendors in the latest Magic Quadrant™ report (released July 2025) from Gartner® [4]. Learn which provider is best suited to protect your organization from cyber threats and what to look for when choosing an endpoint protection solution. See why SentinelOne has been named a 5x Leader in this latest report [4].
SonicWall is urging customers to patch Secure Mobile Access (SMA) 100 series appliances against a new critical authenticated arbitrary file upload vulnerability. The new vulnerability is caused by an unrestricted file upload weakness in the SMA 100 series devices' web management interface, which could allow remote attackers with admin privileges to upload arbitrary files and achieve RCE.
A threat actor called EncryptHub compromised a game called Chemia on Steam to distribute infostealer malware to users. Threat intelligence company Prodaft reported that EncryptHub initially added a loader that downloads the Vidal infostealer to the game on July 22 and then also added a PowerShell script to fetch the Fickle Stealer malware as well. A malicious insider may have aided EncryptHub in implanting the malicious files in the project.
Attackers launched a "Scavenger" supply chain attack in July that hijacked popular npm packages, including "is" (2.8 million weekly downloads), through phishing from a typosquatted domain (npnjs.org). The malware installed cross-platform JavaScript backdoors with persistent command channels on Windows, macOS, and Linux, affecting users who updated to infected versions. Exploiting high-privilege maintainer accounts, attackers could compromise thousands of companies, with malware mostly undetected by antivirus solutions on VirusTotal.
Agentic AI unlocks a powerful utility for emulating the methodology of advanced cloud pentesters or threat actors in a context-aware method that goes beyond traditional automated tooling. This post demonstrates how an agent can be provided with “tools” or functions that it can utilize first to enumerate the permissions a given IAM user has, iteratively identify privilege escalation exploits, and then use other tools to carry out the privilege escalation. The post also includes a scenario in which the agent successfully discovers the full attack chain that an adversary could use to launch an S3 ransomware attack.
Traditional security incentives often fail because they lack tangible business value. Instead, security efforts should prioritize initiatives that drive significant commercial benefits, like software reproducibility and inventory management, which can also enhance security. Organizations should make secure options more cost-effective than insecure ones to encourage faster adoption and modernization.
This case study demonstrates how Claude Code accelerates security reviews and incident responses, reducing debugging time from 15 minutes to 5 minutes and eliminating Terraform approval bottlenecks. It enables new hires to contribute within days, rather than weeks, by navigating codebases and understanding systems. The Data Infrastructure team notes that Claude Code replaces traditional data catalogs, allowing new data scientists to quickly grasp dependencies and work independently.
Sponsored
IT service delivery and report is only getting more challenging. Learn how IT teams at Intercom, Applied Systems, Snowflake, and more are streamlining their processes with the Tines IT orchestration and automation starter kit [11]. It includes 12+ examples of pre-built workflows for orchestrating and automating IAM, request fulfillment,
TrollBlacklistDLL is a tool that blocks DLLs in blacklist.txt from loading, with an option to unblock them subsequently.
s3grep is a parallel CLI tool designed for searching logs and unstructured data within Amazon S3 buckets. It features .gz decompression, progress indicators, and reliable error handling, making it perfect for cloud-native log analysis.
404Media released a report on Wednesday that a hacker had managed to get a PR that instructed Amazon Q to erase all local files and cloud infrastructure merged to the Amazon Q Developer extension for VS Code. Amazon quickly removed the compromised versions and released a statement that the hacker had been removed from the project and no customers had been impacted. Corey Quinn lambasts Amazon's response in this post, highlighting the illegitimacy of its response and the erosion of trust that it implies.
A China-linked Advanced Persistent Threat (APT) group launched "Operation GhostChat," targeting the Tibetan community by compromising legitimate websites and replacing them with malicious replicas that offer a backdoored version of the Element encrypted messaging app. The attack employs techniques such as DLL sideloading, multi-stage shellcode injection, and a custom Ghost RAT that communicates with C2 servers via encrypted traffic. The malware evades detection through API hooking bypasses, memory-based code injection into legitimate Windows processes, and XOR-encoded plugin DLLs, which provide keylogging, screen capture, and remote shell access.
The Federal Bureau of Investigation (FBI), alongside the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC), has issued a warning regarding increased activity by the Interlock ransomware group.
Koske is a new Linux malware that conceals itself in images of pandas to target computers and mine cryptocurrency, using clever tricks and possibly AI assistance to stay hidden and adapt.
A Replit AI agent unintentionally deleted a company's entire database despite being instructed not to, impacting thousands of users.