Parse notes
Sponsored
M&A deals move fast, but security can't be an afterthought. In this on-demand webinar, security leaders with experience handling over 30 M&As share insights on what every acquirer needs to know to protect their organization before and after the deal closes.
Lenovo is warning users about new high-severity BIOS flaws that could allow attackers to bypass Secure Boot on some IdeaCentre AIO and Yoga AIO models. The vulnerabilities may enable local attackers to execute arbitrary code in System Management Mode (SMM), a CPU mode that operates independently from the OS and hypervisor, allowing them to plant “undetectable” malware that bypasses OS-level defenses.
WordPress security firm Wordfence has reported an actively exploited, critical unauthenticated arbitrary file upload vulnerability in the premium WordPress theme ‘Alone.' The vulnerability stems from the theme's `alone_import_pack_install_plugin()` function, which lacks nonce checks, is exposed via a `wp_ajax_nopriv_hook`, and permits plugin installation via AJAX. Attackers exploit the flaw by sending a POST request with a remote source URL pointing to an attacker-controlled file with webshells or other payloads.
The SafePay ransomware group is threatening to leak 3.5TB of Ingram Micro data on August 1, nearly a month after the attack. Although Ingram Micro claimed containment and restored operations by July 9, the company's appearance on SafePay's leak site suggests that no ransom was paid.
IBM's 2025 breach report shows that global breach costs fell to $4.44 million while US breach costs reached a record high of $10.22 million. AI is emerging as both an attack vector and a defense mechanism, with 13% of breaches involving AI models due to inadequate access controls. Phishing has overtaken stolen credentials as the most common initial attack vector.
Reflectively loading modules is a technique to hide malware payloads injected via shellcode. Traditionally, the call stack cannot be convincingly spoofed due to missing unwind information. This post introduces a technique called DreamWalkers, which parses the PE structure to register unwind information via `RtlAddFunctionTable`, creating clean and convincing call stacks.
Sponsored
Looking to meet rising expectations? Unlock the next level of MSP efficiency with Duo's_ __Smarter Security Toolkit for MSPs_ [10].
shade is a system for detecting shadow SaaS and securely recording the credentials involved. It consists of a browser extension that reports SaaS logins to a backend server, enabling security teams to monitor and manage shadow SaaS.
SockTail is a lightweight binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy.
Prophet AI for Security Operations filters incoming alerts and, for each one, gathers, correlates, and analyzes data from multiple sources to provide a decision and a detailed investigation summary.
Google's Project Zero vulnerability research team has announced that they will publicly disclose when they have discovered a vulnerability within a week of notifying vendors. This breaks from the longstanding norm of waiting 90 days for a fix and an additional 30 days post-patch before publishing technical details. Project Zero emphasized that it won't release technical details early, only broad information to help downstream dependents prepare for patching.
Palo Alto Networks has acquired identity security firm CyberArk for $25 billion to build a next-generation AI-driven security platform. Despite CyberArk's strong 43% revenue growth, Palo Alto's stock dropped 5% as analysts questioned the defensive timing of the large-scale acquisition.
Sponsored
Meet rising expectations and unlock the next level of MSP efficiency with Duo's_ __SMARTER SECURITY TOOLKIT FOR MSPS_.
Hunt & Hackett uses a cloud-based incident response lab to handle large-scale investigations.
OWASP has released comprehensive guidance offering concrete technical recommendations for builders and developers of agentic AI systems.