Parse notes
Sponsored
ThreatLocker's annual Zero Trust World [4] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
A breach of Mixpanel's analytics platform exposed OpenAI API user metadata, including names, emails, location data, internal user/org IDs, and browser information. No passwords, API keys, chat logs, or payment data were compromised, and ChatGPT users were unaffected. OpenAI immediately removed Mixpanel from production and notified impacted users. It is conducting a broader vendor security audit. This incident highlights third-party vendor risk. Organizations should inventory analytics tools that receive user data, enforce data minimization policies with vendors, have API users enable MFA, and monitor for targeted phishing using the exposed metadata.
Ransomware operators hit the Asahi Group in late September, crippling Japanese operations and exposing data on around 2 million people, including customers, employees, and their families. Personal information such as names, addresses, phone numbers, emails, birth dates, and gender was accessed, but no credit card data was involved.
Gainsight is investigating a breach involving its Salesforce-connected app, working with Mandiant and relying heavily on Salesforce logs to understand which customers were affected and how attackers used compromised OAuth tokens. The company insists that only a small number of customers saw data impact. Google Threat Intelligence has flagged hundreds of potentially affected Salesforce instances.
Threat intelligence focuses on understanding the external threat landscape, while threat hunting proactively investigates internal systems for threats that have evaded automated defenses through hypothesis-driven analysis and behavioral anomaly detection. The two functions create a feedback loop: intelligence provides IOCs, TTPs, and focus areas to guide hunting hypotheses, while hunting discoveries enrich intelligence with validated internal findings. Security teams should integrate both by using threat intelligence to prioritize hunting efforts via MITRE ATT&CK TTP mapping, embedding intelligence feeds into SIEM/EDR for automated IOC correlation, and establishing workflows that link hunting results to strategic and tactical intelligence products.
Syntax confusion arises when different components, such as browsers, proxies, frameworks, or libraries, parse the same input in conflicting ways, letting attackers bypass filters or change behaviour. By abusing alternate syntaxes, an attacker can slip dangerous characters or paths past validation and turn limited issues like SSRF or cache quirks into powerful primitives such as stored XSS or arbitrary file access.
Sponsored
Traditional pentests take weeks or more. With XBOW Lightspeed Pentest On-Demand [10] you can launch a test in minutes. Get your compliance report in 5 business days, including proof-of-exploit findings, and stay audit-ready. Try it yourself to see why XBOW is ranked #1 on the HackerOne World Leaderboard with 1,092+ zero-day vulnerabilities
A fully searchable, client-side guide to 88+ tools across 15 categories for pentesters and red teamers.
GoDefender is a Go-based security toolkit that detects and defends against debugging, virtualization, and DLL injection attacks to hinder reverse engineering efforts. It provides virtualization detection, anti-debugging via API monitoring and critical function patching, and DLL injection prevention using Binary Image Signature Mitigation Policy to block non-Microsoft binaries.
Infisical is an open-source secrets management platform that features a dashboard, client SDKs for fetching secrets, an API, and integrations with several platforms, like Kubernetes and Terraform.
Socket Threat Research exposed North Korea's Contagious Interview operation, which added 197 malicious npm packages since October, using a GitHub-Vercel-npm delivery chain to distribute OtterCookie malware targeting blockchain and Web3 developers through fake job interviews. The malware performs comprehensive data theft. Security teams should treat npm installs as remote code execution, implement network egress controls on CI/CD systems, require code review for GitHub templates, and deploy real-time package scanning to detect behaviors like import-time loaders and eval on network responses before malware executes.
A 15-year-old in Jordan known as "Rey" was allegedly identified as a key administrator of Scattered LAPSUS$ Hunters after operational security failures. The group, which merged tactics from Scattered Spider, LAPSUS$, and ShinyHunters, conducted high-impact attacks against Jaguar Land Rover, Schneider Electric, Telefonica, and other major organizations using stolen Salesforce data, insider recruitment, and ALPHV/BlackCat ransomware variants. The group vigorously denied the allegations in a detailed Telegram response, offering 10 BTC to anyone who could prove Rey's identity with evidence. Rey himself claims he's been cooperating with law enforcement since June and is attempting to exit the cybercrime community.
A 2023 ransomware attack on Comhairle nan Eilean Siar forced the Western Isles council to rebuild multiple core systems, leaving some finance and revenue platforms still not fully restored two years later. The incident has cost around £950,000, created large data gaps and backlogs, and left staff under intense, prolonged pressure.
Microsoft Teams' cross-tenant guest chat feature (MC1182004) bypasses all Defender for Office 365 protections when users accept external tenant invitations.
Microsoft will implement a strengthened Content Security Policy for Entra ID by October 2026 that blocks external script injection and cross-site scripting attacks.
The Contagious Interview campaign targets Mac users through fake LinkedIn job postings that lure victims to fraudulent assessment websites.