Parse notes
Sponsored
The corporate firewall is a relic of bygone times. With employees working from coffee shops, airports, and home networks, traditional perimeter security leaves your endpoints exposed to unmanaged devices and compromised networks.
Complete source code for Android banking Trojan ERMAC 3.0 leaked from an open directory, revealing a Malware as a Service (MaaS) infrastructure targeting over 700 banking, shopping, and cryptocurrency apps. The leak exposed critical security flaws, including hardcoded JWT secrets, static admin tokens, and default credentials in the malware's PHP/Laravel backend and React frontend. ERMAC 3.0 features enhanced form injection methods, AES-CBC encrypted communications, and a Kotlin-based Android backdoor that avoids infecting devices in countries in the Commonwealth of Independent States (CIS).
Plex has reached out to some of its users and urged them to update their Plex Media Server installation due to a recently patched security vulnerability. Plex has not assigned a CVE to the vulnerability or released details yet, but has stated that it was discovered via the Plex bug bounty program.
The Warlock ransomware gang targeted the UK telecommunications firm Colt, causing disruptions to its online and voice services. In response, Colt took its systems offline, resulting in service interruptions, and is currently in the process of restoring operations. The attackers have claimed to have stolen sensitive data, potentially exploiting a flaw in Microsoft SharePoint.
Website typo protection is an automatically enabled, typosquatting protection in Microsoft Edge. Upon typing a misspelling of a common domain in Edge, the user will get a notification of the potential typo, and the address bar will include a “Not Secure” badge (similar to when visiting a website without HTTPS). This post provides details for configuring protection if it isn't enabled and includes screenshots of the notifications.
In preparation for the creation of a Cryptographically Relevant Quantum Computer (CRQC), NIST selected three post-quantum (PQ) cryptographic standards. This post details how to test hybrid TLS, where classical keys are used in combination with PQ ML-KEM keys, in Python on AWS. boto3, the Python SDK for AWS, relies upon the Python `ssl` module, which in turn relies on OpenSSL, which added support for hybrid TLS in version 3.5.
This article explains how to achieve end-to-end encryption of credit card data in Kafka without changing any application code, using the Kroxylicious proxy. This solution simplifies PCI compliance and data protection by encrypting messages transparently, minimizing disruption to existing systems and workflows.
Sponsored
If you're leading governance, risk and compliance, you're under constant pressure: security reviews, audits, vendor questionnaires -
streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.
An eBPF-based Linux kernel framework disrupts DNS-based C2 channels and tunneling through high-speed deep packet inspection in the kernel stack. It features a userspace deep learning model for detecting obfuscated DNS payloads, dynamic blacklisting, and real-time threat intelligence. It also provides kernel-level DNS exfiltration prevention with access control and threat event streaming.
Rust Interactive Function Tool (RIFT) is a tool to assist reverse engineers in identifying library code in Rust malware.
Approv provides runtime protections to secure devices, apps, APIs, and the channels used to communicate with the cloud, as well as real-time threat analytics to deliver visibility into mobile application security.
Russian threat actor EncryptHub is exploiting patched Windows vulnerability CVE-2025-26633 via social engineering and malicious MSC files to deploy Fickle Stealer malware and backdoors. The group uses fake IT support requests, a compromised Brave Support platform, and fake videoconferencing to gain control. Attacks feature encrypted C2, persistence, and evasion techniques like fake browser traffic.
State Department documents with sensitive details about the August 15 Trump-Putin summit were left in an Alaskan hotel's printer. The eight pages revealed meeting locations, times, and phone numbers of U.S. government employees involved in the summit at Joint Base Elmendorf-Richardson. Guests found the papers, photographed them, and reported the breach.
Vulnerabilities in home solar inverters pose cybersecurity risks, potentially exposing the power grid to attacks. Lax industry security, regulatory gaps, and widespread adoption have made these devices a national concern, highlighting the complexity of securing modern, distributed energy networks
A critical remote code execution vulnerability (CVSS 10) in Cisco's Firewall Management Center via RADIUS permits unauthenticated remote code execution when RADIUS authentication is enabled - apply patches immediately.
Italian authorities confirm a major breach affecting at least 10 hotels with nearly 100,000 records for sale, including high-resolution passport and ID scans stolen via a booking system breach between June and August.
Anthropic has updated its paid Claude Opus 4 and 4.1 AI models to terminate conversations if harm or abuse is detected, a feature most users will rarely encounter.