Parse notes
Sponsored
Senior IAM pros from MONGODB teamed up with TINES to write this guide to modern IAM [4]. If you feel like your identity service isn't keeping up, grab your free copy for useful resources including:
A critical vulnerability in Grafana's SCIM user management feature (CVE-2025-41115) allowed attackers to impersonate users or escalate privileges if certain settings were enabled. Only Grafana Enterprise versions 12.0.0 to 12.2.1 with SCIM activated were affected. The flaw, found internally, was quickly patched. Users are strongly urged to update to the latest secure release to prevent exploitation.
Researchers discovered major security flaws in the messaging app LINE, which is widely used in Asia. These bugs let attackers replay messages, impersonate users, and access plain-text details, all due to weak custom encryption. The risks are amplified because LINE handles everything from banking to government services, yet there are no current plans to fix the vulnerabilities, leaving millions exposed.
Spanish flag carrier Iberia suffered a data leak after a third-party vendor was breached. Iberia has notified customers. The exposed data includes full names, email addresses, and loyalty card numbers, but not passwords or financial information. This notice comes days after a 77GB trove of data allegedly stolen from the airline surfaced on hacker forums.
Attack Surface Management is about continuously identifying and tracking all digital assets and potential entry points that attackers could exploit within an organization. This includes everything from obvious domains and public APIs to obscure subdomains, old servers, cloud resources, mobile apps, code repositories, and even collaboration tools such as Slack or Trello. The attack surface changes constantly as new assets are spun up and others become forgotten or misconfigured, often outside regular security practices. The key is ongoing discovery and reduction - eliminating unnecessary assets, restricting access, hardening configurations, securing supply chains, and monitoring for leaks - because attackers look for what you overlook, not just what you defend.
Traditional GRC approaches fail to address GenAI-driven supply chain risks, such as shadow AI adoption (vendors using public LLMs for code generation without disclosure) and model drift (AI systems changing behavior over time, exposing data or introducing regulatory violations). This article proposes a GenAI GRC framework that uses LLMs for contextual intelligence across unstructured data sources, continuous monitoring via a “digital trust ledger” that dynamically scores vendor risk, and regulatory synthesis to maintain compliance with evolving requirements such as the EU DORA and AI Act. CISOs should pilot this approach by monitoring critical vendors' self-attestations against their public digital footprint, shifting from static compliance reporting to predictive risk velocity metrics that translate technical vulnerabilities into boardroom-ready strategic resilience indicators.
Penetration tests typically focus on finding long lists of bugs in a small time scope and limited attack surface, but attackers are not restricted by time or other scoping and hunt for smaller numbers of critical vulnerabilities. To address this gap, testers should have a holistic view of the application from a user, source code, and architectural perspective, test assumptions that were made during development, and search for a small number of deep bugs. Real offensive security should focus on following intuition, finding the truth, and focusing on impact.
A collection of intel and usernames scraped from various cybercrime sources and forums, including DarkForums, HackForums, Patched, Cracked, BreachForums, LeakBase, and more.
Apono provides organizations with an understanding of privileged access within their cloud environments, enforces robust security guardrails, and leverages AI-driven least privilege and anomaly detection capabilities to enhance security measures.
Quiet Riot is an unauthenticated enumeration tool that validates the existence of AWS Account IDs, Azure AD users, and Google Workspace users by exploiting differences in error messages across cloud service APIs. The tool achieves ~1,100 checks/second by using a multi-threaded API to AWS services like SNS, ECR, and KMS, though exhaustively scanning all possible AWS Account IDs would still take years from a single account. It requires valid AWS credentials to provision resources, but performs unauthenticated reconnaissance by observing service-specific error responses when accessing non-existent versus existing principals.
A China-linked hacking group has compromised thousands of older Asus routers, mainly in Asia, by exploiting vulnerabilities in unsupported models. The hacked devices, named in the WrtHug campaign, are likely being reserved for covert espionage. Users can check for compromise by examining their router's certificate details. They are advised to upgrade hardware and disable remote access features to enhance security.
The SEC has dropped its lawsuit against SolarWinds and its Chief Information Security Officer, who were accused of misleading investors about security practices before the 2020 SUNBURST attack. SolarWinds welcomed the dismissal as vindication, hoping it would relieve pressure on CISOs across the industry.
The FCC reversed a ruling from January that required US telecom providers to implement and annually certify cybersecurity risk management plans under CALEA, removing federal mandates established after the Salt Typhoon attacks that compromised major carriers and exposed at least 200 US organizations. Security experts criticized the rollback as “shockingly incompetent,” noting it eliminates the only concrete federal regulatory response to attacks that allowed Chinese state actors to access wiretap systems, record calls, and geolocate millions of individuals, including high-ranking US officials. The reversal came after heavy lobbying by compromised telecom providers that failed to document their remediation efforts, raising concerns about national security at a time when telecommunications infrastructure remains vulnerable to nation-state attacks.
CrowdStrike recently dismissed an employee accused of leaking company data to a hacker group called Scattered Lapsus$ Hunters.
Two British teenagers linked to the Scattered Spider hacking collective pleaded not guilty to computer misuse and fraud charges related to the August 2024 Transport for London breach, which caused millions in damage and compromised customer data.