Parse notes
Sponsored
SOC efficiency is the most valuable currency in cybersecurity [5] - but ESG research has found that 55% of security teams take hours just to confirm if an alert is real [6]. This gives attackers plenty of time to move laterally through your network.
A .NET Framework design flaw, dubbed SOAPwn, allows attackers to weaponize WSDL-based SOAP client proxies to write arbitrary files or redirect SOAP requests to attacker-controlled locations. This can enable NTLM credential capture and remote code execution via web shells or malicious scripts. Impacted enterprise products include Barracuda Service Center RMM and Ivanti EPM, which have begun shipping security fixes.
A Mirai variant named Broadside is actively compromising maritime logistics systems by exploiting a vulnerability in TBK digital video recorder (DVR) devices. Broadside uses a custom C2 protocol, a unique “Magic Header,” and aggressively kills competing malware. Beyond DDoS capabilities, it can harvest system credentials, posing an elevated risk to operational technology environments.
A phishing campaign uncovered by Kaspersky and Huntress is abusing Google ads to lure macOS users searching for troubleshooting tips. The ads lead to public ChatGPT and Grok “shared conversations” posing as legitimate guides, but instead push victims to download the AMOS infostealer.
Kaitai Struct enables describing binary file formats in a declarative YAML-based language and automatically generating parsers in many languages, which is very useful for reverse engineering, malware analysis, and protocol or firmware research. This example walks through designing a dummy KAISTDE binary format, manually serializing and parsing it in C and Python, then expressing the same structure in a .ksy spec so the Kaitai compiler can emit a robust parser and visualizations.
During re:Invent 2025, AWS announced Lambda Managed Instances, which enable Lambda functions to run on AWS-managed EC2 instances. AWS prevents users from attaching instance roles to these instances, unlike other managed instances. EKS-managed nodes do not allow direct instance access via tools like SSM or EC2 Instance Connect. The instances run AWS' container-optimized Linux distribution, Bottlerocket OS, and execute Lambda functions as containerd containers.
01flip is a new Rust-based ransomware family (tracked as CL-CRI-1036) that targets critical infrastructure in the Asia-Pacific region, leveraging Rust's cross-compilation capabilities to support both Windows and Linux platforms. Attackers exploited CVE-2019-11580 for initial access, deployed Sliver C2 framework for lateral movement, and used AES-128-CBC with RSA-2048 encryption while demanding one bitcoin ransom, with subsequent data leaks appearing on dark web forums. Organizations should monitor for Rust-based malware signatures, patch internet-facing applications against known vulnerabilities, and implement detection for cross-platform ransomware that uses low-level API calls and string obfuscation techniques to evade traditional security controls.
Sponsored
“Thought leaders” are confident about non-human identities, but can they predict what this landscape will look like in 12 months? Not reliably...
Equixly provides an AI-powered API security testing platform that continuously probes APIs like a virtual hacker to uncover technical and business-logic vulnerabilities across the SDLC, integrating into CI/CD pipelines to automate penetration testing and guide remediation.
SentryPeer is a fraud detection tool that tracks bad actors' attempted calls by saving their IP addresses and dialed numbers.
Fil-C is a memory-safe implementation of the C and C++ programming languages that can compile and run a lot of software with zero or minimal changes.
Ransomware attacks are hitting major Japanese companies and government bodies, forcing factories, retailers, and service providers offline for months. Many Japanese organizations depend on older systems and complex supply chains, so recovery is slow and costly.
Microsoft launched Offline Mode for OneDrive Business customers in April 2024, which allows users to continue using the web version of OneDrive while offline. This works by downloading file metadata and running a SharePoint web server locally. This post introduces an update to the OneDriveExplorer, which can parse the cache used for offline mode.
Semgrep tested Claude Code with Sonnet 4 and OpenAI Codex with GPT5's ability to detect IDOR vulnerabilities in code with four levels of increasing difficulty, from no authorization to implicit authorization through middleware. In total, the models identified 15 real, previously unknown vulnerabilities and 93 false positives, with Sonnet 4 performing best. In its test with a generic prompt, Semgrep found that the models could detect some simpler IDOR vulnerabilities but failed in more complex cases.
Sponsored
Enterprise-grade security at an SMB-ready price point? Not impossible anymore: Microsoft's new Defender and Purview add-ons work at a scale
Cybersecurity insurer Coalition announced that it will start offering coverage for certain deepfake incidents, including those that lead to reputational harm.
Advent of Hacks is a GitHub repository with a list of free cybersecurity holiday events, CTFs, and Advent challenges.
Chrome Root Program and CA/Browser Forum adopted Ballots SC-080, SC-090, and SC-091 to sunset 11 legacy Domain Control Validation methods relying on email, phone, fax, postal mail, and reverse DNS lookups by March 2028, pushing Certificate Authorities toward automated, cryptographically verifiable ACME-based validation to prevent fraudulent certificate issuance.