Parse notes
Sponsored
Most PAM vendors started with password vaults and bolted on cloud connectors. StrongDM was built differently [4]: a universal access platform that treats authorization, not authentication, as the primary control plane.
CVE-2025-62518 is a high-severity boundary-parsing vulnerability (CVSS 8.1) in the abandoned async-tar Rust library that allows remote code execution through file overwriting. The flaw affects critical tools, including the uv package manager, tokio-tar (5+ million downloads), and multiple widely-used forks. The issue highlights the open-source abandonware crisis, where unmaintained code is repeatedly forked, spreading bugs across ecosystems with limited visibility and patchability. Security teams should audit dependencies for async-tar and related forks (tokio-tar, testcontainers, wasmCloud), apply available patches, and establish processes to track abandoned dependencies.
TP-Link has issued a warning about two command injection vulnerabilities in Omada gateway devices that could allow attackers to execute arbitrary OS commands. One of the flaws has a critical severity rating (CVSS 9.3) and can be exploited by unauthenticated attackers, while the second requires access to the web management interface. TP-Link also disclosed two additional vulnerabilities in a separate bulletin that could allow command injection and root access.
Researchers from ANY.RUN identified a new phishing campaign using SVG attachments as lures, dubbed the Typical phishing kit or Tykit. The malicious SVG distracts users while embedded JavaScript redirects the victim to a “trampoline” page, which then leads to a phishing site mimicking the Microsoft 365 login page. ANY.RUN believes this campaign is operated by a Phishing-as-a-Service (PhaaS) operator.
Trail of Bits discovered argument injection vulnerabilities across three popular AI agent platforms that allow attackers to bypass human approval safeguards and achieve remote code execution. The flaw exploits pre-approved “safe commands” such as git, find, and ripgrep through malicious flag combinations (e.g., git show --format to write files, fd -x=python3 for execution, or go test -exec to run arbitrary code). These one-shot prompt-injections can be embedded in code comments, GitHub repositories, or logs. Researchers note that maintaining allowlists of “safe commands” without sandboxing is fundamentally insecure, as flag filtering is impractical. Security teams should use container-based sandboxing, use argument separators (--), drastically reduce allowlists, and audit against GTFOBINS/LOLBINS for potential abuse.
British Airways offers free “messaging” WiFi to frequent flyer members, limited to whitelisted messaging app domains via SNI (Server Name Indication) filtering in TLS handshakes. By simulating traffic to approved domains, researchers found they could tunnel general web activity through the free tier. The method relies on customizing TLS connections and proxying traffic, demonstrating how SNI leaks destination domains even when content is encrypted and how service restrictions can be bypassed with technical knowledge.
Many organizations overlook mobile security, leaving them exposed as employees transmit attacks from personal devices. Smishing has become more effective than email phishing, with up to half of users failing simulated tests. Despite the availability of strong mobile defenses, most organizations fail to adopt them, leading to increased breach risk, downtime, and regulatory consequences.
Sponsored
Uncontrolled data equals uncontrolled risk. BENlabs deployed Onna to protect against litigation costs and infosec vulnerabilities hiding in Slack. The result: proactive discovery, predictable costs, and stronger compliance. Onna gives teams the confidence to scale without fear of legal or security fallout.
Imhex is a modern, high-performance hex editor for reverse engineers and programmers. It features a visually optimized interface, data pattern analysis, and powerful scripting capabilities.
Gravwell is an enterprise analytics and security platform that helps teams centralize logs, accelerate threat hunting, and analyze data from both IT and OT environments.
Wiz has open-sourced HoneyBee, an automation framework that rapidly deploys realistic honeypots by generating intentionally misconfigured Dockerfiles and Docker Compose manifests for popular cloud apps. Each honeypot can include AI-generated misconfigurations, Nuclei validation templates, and optional tcpdump monitoring. Using HoneyBee, Wiz researchers discovered cryptomining campaigns targeting exposed Java Debug Wire Protocol (JDWP) and PostgreSQL, capturing complete attack chains, from XMRig deployment to fileless persistence within hours. Honeybee supports three key use cases: validating detection rules safely, orchestrating honeypot networks with SIEM/CSPM integration, and creating hands-on training environments that mirror real-world misconfigurations
Chinese organized crime groups have generated over $1 billion in just three years through a large-scale SMS scam operation targeting Americans with fake toll, postage, and government refund messages. The campaign has surged 350% since January 2024, with a record 330,000 scam texts reported in a single day. The operation uses US-based SIM farms to send messages, steals credit card data, and bypasses MFA by adding stolen cards to mobile wallets (which banks often trust after first use). The groups also employ 400-500 gig workers and money mules recruited via Telegram to buy and resell high-value goods and gift cards for laundering. Security teams should educate users to avoid unsolicited payment messages, verify messages through official channels, tighten device trust policies for mobile wallets, monitor gift card purchases, and deploy anti-malware solutions with web protection and scam detection capabilities.
Datadog's 2025 State of Cloud Security report shows progress alongside persistent gaps across AWS, Azure, and Google Cloud. IMDSv2 enforcement has increased to 49% of EC2 instances, and federated authentication adoption now covers 79% of organizations. However, 59% of AWS IAM users still have access keys older than one year, and nearly one in five EC2 instances remain overprivileged. While data perimeter adoption and public access blocking have improved, insecure defaults and lingering legacy practices continue to expose organizations to risk.
Jaguar Land Rover suffered one of the most expensive cyberattacks in UK history, disrupting production for weeks and affecting over 5,000 organizations. The attack is estimated to have cost at least £1.9 billion in damages and triggered significant supply chain and operational fallout. Government agencies intervened to assist in recovery, but full restoration of systems remains ongoing.
Sponsored
Discover how attackers “call home” through your outbound traffic—and how you can stop them before they do real damage. Read
The bipartisan Foreign Robocall Elimination Act has passed the Senate Commerce Committee, establishing an FCC-led task force to investigate overseas robocalling operations, recommend countermeasures, and evaluate the effectiveness of STIR/SHAKEN caller authentication protocols.
The Shadowserver Foundation has identified over 266,000 internet-exposed F5 BIG-IP instances, nearly half located in the United States.