Parse notes
Sponsored
Meanwhile, compliance requirements keep expanding. New regulations emerge annually across privacy, financial controls, and cyber resilience. Each framework demands separate audits, evidence collection, and documentation — even when requirements overlap significantly [4].
Multiple malicious versions of the popular Nx build system package were published to NPM on August 26. The attack leveraged AI command line tools to search for sensitive files, extracted credentials, and then attempted lockout by appending `sudo shutdown -h 0` to .bashrc and .zshrc files. The root cause of the supply chain attack was a flawed GitHub Action that allowed code injection through unsanitized PR titles combined with the `pull_request_target` trigger.
The data theft affecting Drift AI, a Salesloft tool, is more extensive than initially reported. Attackers used compromised credentials to access Google Workspace emails, and as a result, all Salesloft Drift integrations are now considered potentially compromised. Organizations must revoke and rotate all connected credentials and check for unauthorized access.
A fraudster stole $1.5 million from Baltimore between February and March by pretending to be a vendor employee, hacking into the vendor's Workday account, and convincing AP staff to redirect bank details. The city recovered $721,000, but cannot recover $803,000 despite insurance claims and reissued payments. This is Baltimore's third instance of vendor fraud since 2019, highlighting ongoing weaknesses in financial controls following losses of $62,000 in 2019 and $376,000 in 2022.
Researchers discovered an authentication bypass (CVE-2024-28080) in Gitblit's SSH service that allows attackers to log in without requiring a user's private key or password, only needing the username and public key. This post analyzes how the vulnerability arose, detailing the SSH login handshake and highlighting where the implementation deviates from secure best practices with Apache MINA SSHD.
Traditional CVSS scores fail to address the unique risks posed by autonomous AI agents. The new AIVSS framework extends CVSS by evaluating behavioral factors—such as autonomy, tool access, and memory use—enabling security teams to measure and manage the risks of agentic AI systems more effectively, aligning with modern security frameworks like NIST AI RMF.
The Gayfemboy botnet exploits vulnerabilities in DrayTek, TP-Link, Raisecom, and Cisco devices to deploy a Mirai-variant that uses modified UPX packing, custom architecture naming schemes, and hardcoded process termination lists to eliminate competing malware infections. The malware implements sophisticated evasion techniques, including 50-nanosecond sandbox delays, utilizes public DNS servers (1.1.1.1, 8.8.8.8) to bypass local filtering, and scans 15 predefined ports for C2 communication with domains such as cross-compiling[.]org and i-kiss-boys[.]com. Organizations should implement network monitoring for unusual DNS queries to public resolvers, deploy IPS signatures for the listed CVEs, and monitor for processes attempting to bind to UDP port 47272 or exhibiting the malware's distinctive process termination behavior.
Sponsored
IT and InfoSec are technically on the same side… but it sometimes doesn't feel like it. In this 30-minute session [11], you'll learn how to start working as one team:
CatSniffer is an original, multiprotocol, and multiband board designed for sniffing, communicating with, and attacking IoT (Internet of Things) devices using the latest radio IoT protocols. It is a highly portable USB stick that integrates TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2.
Cortex Cloud ASPM is a prevention-first application security module that integrates with AppSec tools, such as Snyk, GitLab, and Checkmarx, to block vulnerabilities before they reach production. The platform offers automated remediation, inline IDE fixes, and correlates findings across code, cloud, and runtime to prioritize risks over false alarms. In early access, with general availability in H2 2025, it claims to be 10 times faster and more cost-effective than traditional reactive security.
Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).
The Chinese hacking group Salt Typhoon has infiltrated U.S. telecoms, stealing personal data from nearly every American and millions globally since 2019. FBI officials say the scale and indiscriminate nature of the campaign are unprecedented, affecting at least 80 countries, 200 U.S. organizations, and high-profile political figures.
North Korean APT37 (ScarCruft) carried out Operation HanKook Phantom using spear-phishing emails with malicious LNK files disguised as PDFs to deliver RokRAT malware to South Korean research targets. The attack utilized fake newsletter lures from the National Intelligence Research Association, employing PowerShell scripts and fileless techniques to exfiltrate data via Dropbox, Google Cloud, and Yandex. This campaign shows APT37's focus on espionage against the South Korean government, research, and academic targets.
A whistleblower at the Social Security Administration (SSA) stated that a former senior DOGE official, now at the SSA, copied the Social Security Numbers (SSNs), names, and dates of birth of over 300 million Americans to a private section of the agency's AWS cloud environment. The complaint states that the cloud environment was set up for DOGE-affiliated Social Security staffers but lacks independent security, monitoring, and oversight. The complaint also alleges that cybersecurity officials within the SSA described the decision to copy the data as “very high risk” and discussed the possibility of having to reissue SSNs in the event of a breach.
OpenSSH 10.1 will warn users when connecting to servers that use non-post-quantum key agreement schemes, encouraging migration to quantum-resistant cryptography such as mlkem768x25519-sha256 and sntrup761x25519-sha512 to protect against future "store now, decrypt later" attacks.
Spanish police arrested a 21-year-old suspected hacker in Seville for allegedly compromising at least 13 university professors' accounts on the Andalusia region's Séneca educational platform to alter his own and classmates' high school and university entrance exam grades.