Parse notes
Sponsored
Misconfigurations and excessive privileges quietly chain together into routes attackers can use to reach your critical assets — and they aren't taking a Thanksgiving break. ATTACK PATH MANAGEMENT (APM) shows identity risk the way adversaries see it, mapping relationships across identities, systems, and permissions so you can prioritize what truly matters.
A ransomware attack hit the OnSolve CodeRED emergency alert system, affecting local agencies nationwide in the US and leading to a data breach. Hackers accessed user data and encrypted systems, causing some areas to lose emergency notification capabilities. Crisis24, a platform provider, is transitioning agencies to a new system and has advised users to change reused passwords.
Harvard University suffered a data breach after a voice phishing attack compromised its Alumni Affairs and Development systems. Personal data like addresses, emails, and phone numbers of alumni, donors, and students were exposed, though financial details and passwords were not affected. Harvard is working with law enforcement. It has warned affected individuals to watch out for phishing attempts.
A malicious Chrome extension called "Crypto Copilot" (still available, with 12 installs) silently injects hidden SystemProgram.transfer instructions into Raydium DEX swaps, siphoning 0.0013 SOL minimum or 0.05% of trades over 2.6 SOL to a hardcoded attacker wallet before users sign transactions. The extension uses obfuscation via minification and variable renaming, communicates with a fake backend at crypto-coplilot-dashboard.vercel[.]app, and leverages legitimate services like DexScreener and Helius RPC to appear trustworthy while bypassing Chrome Web Store review. Crypto users should audit all transaction instructions before signing and avoid installing browser extensions that request wallet access. Security teams should monitor for wallet-draining extensions targeting DeFi platforms.
This comprehensive guide covers TLS authentication fundamentals, including the handshake process, certificate validation chain, and the distinction between server-only authentication and mutual TLS (mTLS) for high-security environments. Key recommendations include enforcing TLS 1.3 (or 1.2 minimum), using forward secrecy cipher suites with ECDHE, storing private keys in HSMs/KMS, and automating certificate lifecycle management via the ACME protocol. For modern architectures, the article emphasizes layering TLS with OAuth 2.0/OIDC for combined machine and user authentication and leveraging service meshes such as Istio for automated mTLS across microservices.
The Desktop Application Security Verification Standard (DASVS) is a comprehensive framework for addressing the unique security challenges of desktop applications across Windows, macOS, and Linux. Unlike web or mobile apps, desktop applications operate with significant system access, which demands specialized security controls. DASVS aims to provide clear, actionable verification rules and is being extended with guides and automated assessment tools to help organizations strengthen desktop application protection.
Google enabled Quick Share interoperability with AirDrop starting with Pixel 10, using Rust for the core communication layer to eliminate memory-safety vulnerabilities in wireless protocol data parsing—a historically common attack surface. The implementation uses direct peer-to-peer connections without server routing. It underwent internal threat modeling plus independent penetration testing by NetSPI, and was validated as "notably stronger" than other industry implementations with no information leakage. For cross-platform development, Rust's compile-time memory safety guarantees make it ideal for parsing untrusted data from external sources, and Google's approach demonstrates how memory-safe languages can secure interoperability layers between disparate platforms without sacrificing performance.
A practice VM designed for learning malware development through CTF-style challenges. Exercises include OS enumeration, shellcode injection into target processes, and IAT hooking techniques.
Vijil helps organizations develop secure, reliable AI agents by providing a platform for testing, hardening, and monitoring agents against risks such as prompt injection. It offers modular agent templates, compliance, and runtime protection for confidential deployments.
XSSRecon is a powerful tool designed to help security researchers and penetration testers identify reflected XSS vulnerabilities in web applications. It automates testing URL parameters for the reflection of a test payload and further checks how special characters are handled.
The FBI reported over 5,100 account takeover complaints since January, with attackers impersonating bank staff via calls, texts, and emails to harvest credentials and MFA/OTP codes, then wiring funds to cryptocurrency wallets. Attackers employed SEO poisoning to push phishing sites mimicking financial institutions to the top of search results. Some used dual-impersonation tactics to claim fraudulent transactions and direct victims to fake law enforcement. Defenders should train users to access banking sites via bookmarks rather than search results, and organizations should monitor for brand impersonation in search ads.
Malicious AI tools like WormGPT 4 and the free KawaiiGPT are making it easier for cybercriminals to generate malware and phishing messages and to automate parts of attacks. While the code requires some human adjustment to evade detection, these "Dark LLMs" significantly lower the barriers to entry for cyberattacks and social engineering.
Threat actors are using commercial spyware and remote access trojans to target WhatsApp and Signal users. Attacks involve phishing, malicious QR codes, and impersonated apps. They are focusing on high-value individuals worldwide.
Tor has replaced its old encryption algorithm with a new, stronger one called Counter Galois Onion (CGO) to improve user security and privacy.
A cyberattack has forced three London councils, Kensington and Chelsea, Westminster, and Hammersmith & Fulham, to shut down networks and activate emergency plans.
CVE-2025-12816 is a high-severity ASN.1 validation flaw in node-forge versions 1.3.1 and earlier (26M weekly NPM downloads) that allows attackers to craft malformed data.