Parse notes
Sponsored
Poorly-managed passwords are the #1 cause of breaches, and they leave IT teams struggling with fragmented access management and manual onboarding/offboarding processes. Reddit was dealing with all these challenges, plus a compromised security vendor. They needed a solution that reduced credential risk without slowing down their employees.
Hyundai AutoEver America, which provides IT services for Hyundai and Kia affiliates, reported a data breach. The breached data includes names, SSNs, and driver's licenses. The disclosure did not state whether the breach only included employee data or also included customer data.
Researchers from Zscaler report that an estimated 239 malicious apps were downloaded 42 million times from the Google Play Store between June 2024 and May 2025. Zscaler noted a 67% year-over-year growth in malware targeting mobile devices during this period. Zscaler has identified three malware families that had a notable impact on Android users: the Asta banking trojan, the Android Void Android TV backdoor, and the Xnotice RAT.
Over 400,000 WordPress sites are at risk due to a severe vulnerability in the Post SMTP plugin, which allows hackers to view password reset emails and potentially take over accounts. Exploitation is already underway. Users must urgently update to version 3.6.1 to prevent their site from being compromised.
The 'Building Cloud Trust" report by AWS and Vanson Bourne surveyed 2,800 organizations across 13 countries, revealing that about 80% experienced data breaches in the past year, with common attack vectors including vulnerability exploitation, compromised credentials, misconfigurations, and physical theft. Attackers are increasingly using stolen credentials through methods like VPN/VDI abuse, AI-enabled phishing, and legitimate tool exploitation, with a predicted shift toward targeting non-human identities protected by single-factor authentication. To combat these threats, security teams should focus on cloud security posture management, adopt phishing-resistant MFA, enforce least privilege access, and prioritize patching internet-facing infrastructure, while acknowledging human error as a primary cause.
Attackers can abuse globally scoped GitLab instance runners to execute arbitrary code and pivot into cloud environments if runners are configured with shell executors and attached IAM roles. Once a runner is compromised, the attackers can scrape build artifacts and environment files to steal secrets, SSH keys, or cloud credentials. Strategic defense centers on eliminating global runners, enforcing containerized job isolation, tightening IAM role scoping, and restricting access to the GitLab instance to reduce blast radius.
Secure Calls are a mechanism in Windows that allows the “regular” (NT) kernel, residing in virtual trust level (VTL) 0, to communicate with the secure kernel (SK) operating in VTL 1. Secure calls are implemented as a hypercall with the hypervisor brokering the connection. In this post, the author reverse-engineers the secure call process and structure and introduces a tool for making secure calls with user-supplied arguments.
Sponsored
When cloud, identity, and network tools operate in silos, they can't stop fast-moving attacks. Vectra AI's Attack Signal Intelligence™ connects the dots for faster MTTD, fewer false positives, and stronger SOC performance. See how in the Best Practices Guide: How to Test an NDR Solution Effectively [12]. Want to experience it firsthand? Book a demo [11].
curl-impersonate is a special build of curl that can impersonate Chrome, Edge, Safari, and Firefox.
This tool recovers deleted NPM packages by querying five registries (npmjs.org, cnpmjs.org, npmmirror.com, huaweicloud.com, and tencent.com) to download 1-20 recent versions with metadata, including usernames, emails, and maintainer information, utilizing auto-retries and security filtering. Security researchers can retrieve discontinued malicious packages for malware analysis and threat intelligence. Features include custom output, silent mode with JSON, and no external dependencies, making deployment easy. Teams use this for post-incident recovery, building malware collections, and investigating suspicious packages that have been quickly removed from NPM.
Malanta is a cybersecurity startup that utilizes AI to detect digital traces left by attackers during their attack setup, forecasting, and dismantling malicious infrastructure before attacks occur. Its technology provides warning in advance and proactive defense for clients.
A China-linked breach of F5's BIG-IP software exposed source code and undisclosed vulnerabilities, creating a path for custom exploits against critical infrastructure and government networks. At the same time, significant workforce cuts at CISA and a federal shutdown are degrading incident response capacity, election protection efforts, and national coordination. Security teams should assume reduced federal support and prioritize proactive hardening, continuous monitoring, and supply chain risk management across high-impact edge and network devices.
Researchers from Meta and CrowdStrike introduced the open-source CyberSOCEval benchmark to assess large language models (LLMs) on two critical SOC tasks: malware analysis and threat intelligence reasoning. Technical findings show that current models score only ~15-28% on malware analysis and 43-53% on threat-intelligence reasoning, highlighting significant gaps in interpreting JSON logs, mapping attack chains to MITRE ATT&CK, and reasoning about multi-hop adversaries. Security teams should be cautious about off-the-shelf LLM reliance, instead using these benchmarks to validate models, augment human analysts rather than replace them, and prioritize training with domain-specific cyber data.
Internal documents from late last year predicted that Meta would earn about 10% of its overall annual revenue ($16 billion) from fraudulent ads. Meta's automated system only bans advertisers if it is 95% certain that the ads are malicious. Otherwise, the advertisers are simply charged a higher rate. Documents also show that users who click on these scams or malicious ads are more likely to see them in the future.
A federal judge reaffirmed a non-custodial sentence for the engineer behind the massive Capital One breach, maintaining supervised release and restitution rather than prison time despite appeals arguing the punishment was too lenient.
Marks & Spencer faced a £136 million cleanup bill for a cyberattack, which hurt profits, as the retailer struggled with halted online operations and expensive recovery efforts, resulting in a drop of over 55%.
Nation-state attackers breached SonicWall's cloud backup, stealing firewall configs but no other data.