Parse notes
Sponsored
Managing security across hybrid networks can be challenging, especially when consistent policies need to be set across systems. Simplify your security approach to a single dashboard with AWS and Fortinet.
Data I/O, a tech manufacturer, suffered a ransomware attack on August 16 that led to major outages. The incident's impact remains unclear as the investigation is still underway, but restoration of operations has begun. Costs may be substantial.
PromptLock, the world's first known AI-powered ransomware, uses OpenAI's gpt-oss-20b model to generate malicious scripts. It is currently only a proof-of-concept and has not been seen in active attacks. PromptLock demonstrates how AI can simplify cybercriminal operations.
The popular NX build system was compromised with malicious versions published to npm that steal cryptocurrency wallets, API keys, and credentials from at least 1,400 affected users. The malware creates repositories prefixed with "s1ngularity-repository" in victims' GitHub accounts. It uniquely leverages the Claude Code CLI or Gemini CLI to execute file system searches for sensitive data through AI prompts, making detection more challenging for traditional security tools. Users should immediately check for unauthorized repositories, update to version 21.4.1, and rotate all potentially compromised credentials, including GitHub tokens, npm keys, and SSH keys.
Sometimes, when people are hunting for HTTP request smuggling vulnerabilities, they actually run into false positives caused by connection reuse. Some scenarios where connection reuse may be necessary for finding vulnerabilities include situations where the frontend server only reuses the upstream connection if the client connection was reused, connection-state attacks, and client-side desync attacks. James Kettle created a Custom Action for Burp Suite called `Smuggling or pipelining?` to distinguish between a genuine HTTP smuggling attack and an HTTP pipelining false-positive.
Threat actors like The Com and Scattered Spider bribed TaskUS workers in India with up to $2,500 to steal data from 70,000 Coinbase customers, resulting in a $20 million ransom demand that Coinbase refused, offering the same as a bounty. The breach revealed a shift from phishing to insider targeting through bribery, primarily targeting customer support staff with data access. Coinbase fired 226 workers, opened a US support hub, and enhanced controls. Experts advise red-team exercises to test employee responses to bribery attempts worldwide.
A flaw (CVE-2025-54309) in CrushFTP servers allows attackers to gain administrative access if certain features are disabled. Researchers used a honeypot sensor network to catch hackers exploiting this race condition in real time and confirmed that two coordinated HTTP requests could add a rogue admin account. The vulnerability impacts thousands of vulnerable servers and is being exploited in the wild, highlighting the need for organisations to patch and monitor for unusual activity.
Sponsored
Most AI note-takers create AI governance gaps: over-capture, default model training, and the spread of Shadow AI. Fellow [11] puts you in control with policy-based recording, consent/disclosure, transcript redaction, role-based access, retention, audit logs, SSO/SAML and no training on your data. Record meetings without causing a security meltdown. Try Fellow today [11].
BruteForceAI is an advanced penetration testing tool that transforms traditional brute-force attacks by incorporating large language models for smart form analysis. The tool automatically detects login form selectors with AI and then performs complex multi-threaded attacks that mimic human behavior.
Mercator is an open-source web application designed to manage the mapping of information systems, as described in ANSSI's "Mapping the Information System Guide".
Reach Security employs virtual assistants in exposure management to automate drift detection, policy enforcement, and remediation. Its new ConfigIQ Drift module empowers customers to set custom deviation rules and baselines, all of which are managed centrally.
Sni5Gect is a framework that can downgrade 5G connections to vulnerable 4G, crash phone modems, and bypass authentication by passively sniffing unencrypted messages between base stations and phones during the initial connection phase before authentication. The attack achieves 80% sniffing accuracy and 70-90% message injection success rates from up to 20 meters away, exploiting the window before NAS security context establishment without requiring a rogue base station. Tests successfully targeted phones from OnePlus, Samsung, Google, and Huawei. The GSMA has acknowledged the vulnerability as
Anthropic's new Claude for Chrome AI extension, now in limited preview, allows AI to control browser actions but poses significant security risks. Researchers found these AI agents are vulnerable to hidden, malicious website instructions, with attacks succeeding up to 23.6% of the time. Although new safety measures cut success rates, experts warn browser-integrated AI may be fundamentally unsafe for now.
Cybercriminals are misusing agentic AI systems, such as Claude, to power new types of cyberattacks. In one major case, a single actor utilized AI to extort data from 17 organizations by crafting targeted extortion demands and executing sophisticated attacks end-to-end, highlighting how AI enables complex threats with minimal resources.
Gartner's 2025 CNAPP Market Guide highlights the industry shift from fragmented security tools to unified cloud-native application protection platforms that consolidate vulnerability management, compliance, and threat detection into single solutions.
Citrix urgently released a security update for a critical vulnerability in NetScaler ADC and Gateway, which hackers exploited as a zero-day to execute arbitrary code remotely, risking widespread network compromise.
The U.S. Treasury sanctioned four entities for aiding North Korea's IT worker scheme, which places workers in U.S. jobs using fraudulent documents to evade sanctions and fund weapons programs.