Parse notes
Sponsored
As you scale your business, security needs to be more than a checkbox—it should be the foundation for customer trust and long-term growth. Vanta's Trust Maturity Report [4] helps you benchmark your security program against your peers so you can level up your security with confidence.
US-based kidney dialysis provider DaVita confirmed that sensitive PII and clinical data were stolen from its systems, impacting over 900K customers. In an attack that began on March 24 and continued until April 12, the attackers stole names, dates of birth, SSNs, health-insurance information, health conditions and other treatment details, specific dialysis lab test results, tax identification numbers, and images of checks written to DaVita.
A report from Bloomberg details the data that was stolen from Columbia University in a politically motivated data breach that occurred in June. The attackers stole banking details, GPA records, student loan disbursement records, scholarship information, health-related financials tied to university insurance plans, and other PII from current students and alumni dating back several years.
Cisco Talos reported 5 vulnerabilities to Broadcom and Dell affecting the ControlVault3 firmware and its associated Windows APIs. Dell ControlVault is a hardware-based Unified Security Hub (USH) that connects various security peripherals, such as fingerprint readers, smart card readers, and NFC readers, to function as a vault for storing passwords, biometric templates, and security codes. These vulnerabilities include a remote code execution vulnerability that could allow non-administrative users to read data off the ControlVault firmware or store an implant on it, as well as a vulnerability in which a physical attacker could access the USH board without requiring a login.
C4 (Chrome Cookie Cipher Cracker) is a technique that defeats Google's AppBound Cookie Encryption, which was introduced in July 2024 to protect against infostealers. The attack exploits a padding oracle vulnerability to decrypt cookies as a low-privileged user, ironically turning Chrome's security feature into an attack vector for accessing SYSTEM-level data on Windows machines. New security implementations can inadvertently create novel attack surfaces when not properly hardened against cryptographic vulnerabilities.
Modern adversaries focus on appearing believable rather than staying hidden, using techniques like process impersonation, legitimate parent-child relationships, and contextually appropriate command-line arguments to blend into everyday operations. Deception can be categorized into visual (fooling human analysts), logical (passing reasoning checks), and behavioral (mimicking legitimate timing and patterns) verisimilitude layers. Detection strategies must shift from pure anomaly detection to plausibility-based approaches that question whether actions make contextual sense for specific users, systems, and operational environments.
KubeForenSys is a tool for collecting Kubernetes cluster data and ingesting it into Azure Log Analytics for analysis post-compromise.
Kanvas is an Incident Response (IR) case management tool with an intuitive, Python-based desktop interface.
Promptfoo embeds automated red-team tests into the build and release processes, provides actionable guidance for the identified issues, and feeds the results into the organization's existing vulnerability management workflows.
Insikt Group identified new infrastructure associated with the Israeli-backed Candiru spyware. Candiru developed a spyware called DevilsTongue, which is a Windows-based spyware with user and kernel-mode components that maintains persistence via COM hijacking to enable deep access to victim devices, enabling file extraction, browser data collection, and theft of encrypted messages. Insikt Group has identified five active clusters linked to infrastructure in Hungary and Saudi Arabia.
Microsoft Project Ire is an AI system designed to reverse-engineer and identify malicious software autonomously. Project Ire automatically dissects software files to understand how they work, what they do, and whether they're dangerous without any clues as to the software's origin or purpose. Microsoft's testing showed Project Ire to have a 98% true positive rate on detecting malicious files.
WhatsApp deleted 6.8 million accounts linked to global criminal scam centers, mainly from Cambodia, in the first half of 2025. Meta, in partnership with OpenAI, disrupted these campaigns and is introducing new WhatsApp safety tools to curb scams and protect users worldwide.
Google Threat Intelligence Group (GTIG) said that one of its Salesforce database systems was breached by the ShinyHunters hacking group, but the accessed data was confined to basic and largely publicly available business information.
Microsoft paid $17 million in bug bounties to 344 security researchers across 59 countries in the past year, its highest annual payout since 2018.
The TeaOnHer dating app exposed 53,000 users' private data, including selfies and driver's licenses, due to exposed admin credentials, highlighting the security risks of copycat applications that rapidly gain popularity without proper security controls.