Parse notes
Sponsored
IT and security teams are trapped in a reactive mode when managing SaaS and AI app sprawl. While accounting for an ever-growing number of risks, admins are continually bogged down by manual processes and disconnected workflows.
that explores how IT and security teams can:
Hackers breached Allianz Life's third-party cloud-based CRM system on July 16, using social engineering techniques to steal personal data from approximately 1.4 million of the insurer's North American customers. The German parent company immediately contained the breach, notified the FBI, and confirmed no other company systems were compromised.
Tea, an app for anonymous dating reviews, suffered a data breach exposing 72,000 images, including 13,000 verification selfies and IDs. The breach affected users who signed up before February 2024. 4chan users reportedly shared the stolen data, coinciding with Tea's surge in viral popularity.
A critical security vulnerability (CVE-2025-24000) in the Post SMTP WordPress plugin allows low-privileged users to access email logs and hijack administrator accounts by intercepting password reset emails. The flaw affects all versions up to 3.2.0 and stems from broken access controls that only checked if users were logged in without verifying their permission levels. Despite a fix being released in version 3.3.0 on June 11, over 200,000 WordPress sites remain vulnerable, as more than half of users haven't updated their plugin.
Microsoft's Copilot Enterprise Python sandbox vulnerability allowed researchers to gain root access within the container through a PATH hijacking attack in the keepAliveJupyterSvc.sh script, which executed `pgrep` without a full path every 2 seconds. Researchers exploited this by placing a malicious script in /app/miniconda/bin, which was writable by the ubuntu user and prioritized in $PATH, to execute arbitrary commands as root. While container breakout proved impossible due to patching, the vulnerability demonstrated how improper PATH handling in privileged scripts can lead to privilege escalation even in sandboxed environments.
OSS-Fuzz-Gen introduced an agent-based LLM approach that automatically generates build scripts and fuzzing harnesses for integrating projects into OSS-Fuzz, using iterative command execution and environment exploration to handle diverse C/C++ codebases. The system achieved 88 successful integrations from 225 tested repositories, demonstrating its ability to handle complex builds that require custom tools and dependencies. Key limitations include build scripts that avoid target source code or only support single-harness compilation, requiring post-processing validation improvements.
The emergence of LLMs and coding agents fundamentally transforms application security, as AI now both writes and debugs code. As LLMs advance, humans will focus more on prioritizing vulnerabilities, providing additional context, and assessing exploitability. The vulnerability disclosure process will also become much quicker, with LLMs rapidly identifying vulnerabilities and offensive and defensive teams promptly collaborating to evaluate exploitability.
Sponsored
Cloud security is crowded — and evolving fast. If you're trying to make sense of the vendor landscape, this new report from IDC is a great place to start.
UnMarker is designed to be the first universal attack against defensive watermarking, which is used to detect AI-generated deepfakes. The attack disrupts watermarks in image spectral amplitudes without requiring detector feedback or knowledge of the scheme, thereby defeating both traditional and advanced semantic watermarking systems and rendering deepfake detection ineffective.
HeroDevs provides commercial licenses to over 30 Never-Ending Support (NES) products, which are patched versions of software that organizations already use, behave identically, and are compatible with modern browsers and key third-party libraries.
hypnus is a Rust library for memory obfuscation designed to protect memory regions during inactivity or sleep periods.
International law enforcement's Operation CheckMate dismantled the BlackSuit ransomware group, but a new group called "Chaos" quickly emerged, likely comprising former BlackSuit members. Chaos is targeting major organizations primarily in the US, demanding ransoms of around $300,000.
Scattered Spider is targeting VMware ESXi hypervisors across retail, airline, transportation, and insurance sectors using social engineering to impersonate employees and trick IT help desks into resetting passwords for privileged accounts. Once they gain vCenter access, attackers enable SSH on ESXi hosts, perform "disk-swap" attacks to extract the NTDS.dit Active Directory database, wipe backups, and deploy ransomware to encrypt all VMs in the datastores. Google recommends hardening vSphere with execInstalledOnly, VM encryption, disabled SSH, phishing-resistant MFA, isolating Tier 0 assets, and centralizing logs in a SIEM to detect suspicious vCenter logins and configuration changes.
Chainguard's Libraries for Python is a secure index that rebuilds Python packages and their dependency trees from source within a Supply-chain Levels for Software Artifacts (SLSA) Level 2-hardened setup to prevent supply chain threats. The platform specifically addresses Python wheels with native code and re-bundled OS libraries, such as OpenSSL, which create "software dark matter" that is hidden from SCA scanners. Early testing indicates that 98% of known malicious packages would be identified and blocked. This development follows notable incidents in 2023 and 2024 that involved attacks on PyTorch and Ultralytics YOLO where compromised builds and leaked API tokens facilitated malware distribution via PyPI.
The Trump administration plans to utilize an AI tool called the "Doge AI Deregulation Decision Tool" to analyze 200,000 federal regulations and eliminate half of them by January, aiming to save trillions in compliance costs.
CloudSEK researchers used facial recognition and GPS data to expose a $2 million counterfeit currency operation in India, identifying over 750 social media accounts selling fake notes and pinpointing key perpetrators in Maharashtra.