Parse notes
Sponsored
Join award-winning WIRED journalist Andy Greenberg and leading security experts, including Upwind CSO Rinki Sethi (formerly Twitter CISO), at the free, virtual Open Source Security Summit [4] sponsored by Bitwarden.
EVERY BREACH STARTS WITH WEAK CREDENTIALS. Protect your business with Bitwarden—built on a trusted open source foundation, recommended by
There are over 35 Docker Hub images that still contain the XZ-Utils backdoor (CVE-2024-3094). Discovered in March 2024, the vulnerability allows attackers with a specific private key to bypass SSH authentication and execute commands as root. Debian has refused to remove the backdoored images, citing low exploitation risk and archival continuity, despite the danger of accidental pulls in CI/CD pipelines. Organizations should verify that their containers use XZ-Utils version 5.6.2 or later to avoid inheriting this supply chain compromise.
The Business Council of New York State (BCNYS), the largest employer association in the state, revealed that attackers stole personal, financial, and health data of over 47,000 people in a February breach. The data included full names, SSNs, birth dates, IDs, financial info, payment card details, and e-signatures. BCNYS said it didn't detect the breach until August 4, but cut off access immediately.
Bragg Gaming Group reported a cyberattack that affected only its internal systems. No customer or personal data was accessed. Operations continue normally, although key details about the attack method and duration are still unclear, leaving some questions about the incident's full impact.
Kaspersky and BI.ZONE analyzed PipeMagic backdoor's evolution from 2022 to 2025, revealing new infections in Saudi Arabia and Brazil using fake ChatGPT apps, exploiting CVE-2025-29824 for privilege escalation. The malware now includes enhanced modules for asynchronous communication, payload injection, and .NET execution, with attackers using LSASS memory dumping for lateral movement across compromised networks.
Malware analysis environments have complex requirements as they must allow analysts to effectively analyze potentially malicious code while it is executing in the environment. This post proposes a process in which a security analyst gains access to an EC2 instance with no outbound connectivity via AWS Systems Manager Session Manager. The analyst then connects to malware samples through a gateway endpoint for S3 to download the malware and detonate it, and then they can use services such as CloudTrail and GuardDuty to monitor the behavior. The post provides a detailed setup checklist that covers policy, account setup, VPC design, instance configuration, storage, monitoring, IAM, and lifecycle considerations.
The Noodlophile Stealer malware has evolved. It is now conducting targeted phishing campaigns impersonating copyright claims, mainly against organizations with large social media presences. The attackers steal browser and login data, adapting tactics for better success, and concentrate on enterprises with significant Facebook activity, highlighting the need for stronger cybersecurity and anti-phishing measures.
Sponsored
Discover how high-performing organizations use SANS to improve retention, cut external security costs by nearly $900K, and detect threats 4.2x faster. Download the IDC white paper, sponsored by SANS [12], and explore training and tools designed for measurable impact with SANS Cybersecurity Training [13].
Okta has open-sourced ready-made Sigma queries for Auth0 customers to detect account takeovers, misconfigurations, and suspicious behavior in event logs. Auth0 is an IAM platform used by organizations for login, authentication, and user management services. Organizations can utilize the rules by cloning the GitHub repo and using a Sigma converter (such as sigma-cli) to translate the rules into a query syntax that their SIEM supports.
Warren is an AI-powered security alert management system that reduces noise and accelerates response time. It ingests alerts from existing tools and enriches them with AI and threat intel.
SimpleCrypt is a powerful command-line tool designed for securely encrypting and decrypting files and directories using AES-256 encryption. It aims to provide users with a straightforward and efficient way to protect sensitive information directly from their terminal.
AWS changed Kiro's pricing from reasonable plans to a split request model with "vibe" at $0.04 and "spec" at $0.20. Developers report monthly costs of $550-$1,950, far above the promised 1,000 interactions for $19. The free tier offers only 50 vibe requests, with no spec requests, requiring immediate payment for actual code execution. Open-source developers use 4-6 requests per action, making Kiro more expensive than AWS's Amazon Q ($40 for 3,000 requests) or competitors with unlimited plans.
XProtect comprises YARA detection rules employed by Gatekeeper checks to identify known malware. Over six years, the number of rules has quadrupled, and the total size has grown to 22 times its original. This expansion results in longer scan times. However, removing older rules is risky, as it could leave newer Macs vulnerable to malware, especially if they still support x86 execution.
Mozilla has raised concerns about a recent ruling by Germany's Federal Supreme Court (BGH) in a case brought by online media company Axel Springer against Eyeo, the makers of the Adblock Plus browser extension. Axel Springer claimed that a website's HTML/CSS is a protected computer program, and therefore, ad blockers that interact with in-memory structures such as DOM, CSSOM, and the rendering tree should be considered unlawful reproduction and modification. The lawsuit has significant implications for other types of browser extensions that alter the DOM, as well as ad blockers.
Black Hat USA 2025 returns to Las Vegas August 2-7.
Linktree has been inaccessible in India for several days across all ISPs.
The UK government has dropped its demand for Apple to provide backdoor access to encrypted iCloud data following US pressure.