Parse notes
Sponsored
Attackers couldn't have chosen a better moment to strike Fastly [4]: As major customers shifted tens of petabytes of traffic to Fastly due to another provider's outage, several advanced DDoS attacks were unleashed on our platform…yet there was no end-user disruption.
Google patched two Chrome vulnerabilities exploitable via malicious web pages: a use-after-free in WebGPU (CVE-2025-14765) that enabled heap corruption, and an out-of-bounds read/write in the V8 JavaScript engine (CVE-2025-14766). Both flaws affect Chrome's 3.4 billion users and require no user interaction beyond visiting a crafted site. Update to version 143.0.7499.146 or later immediately.
Richmond Behavioral Health Authority in Virginia was hit by a ransomware attack in late September that encrypted parts of its network and revealed data on more than 113,000 individuals, including names, Social Security numbers, passport information, and financial and health details. Victims are advised to monitor their accounts and credit reports closely, as the ransomware group Qilin claims to have leaked 192 GB of stolen data.
Hewlett Packard Enterprise has patched a critical remote code execution vulnerability in HPE OneView, tracked as CVE-2025-37164 with a maximum CVSS score of 10.0, that allows unauthenticated attackers to execute code remotely. The flaw affects all versions before 11.00, making prompt patching essential to prevent exploitation.
A recent Raspberry Pi attack attempt on a French ferry highlights how rogue devices with cellular modems can bypass traditional network monitoring by creating their own internet connection from inside the perimeter. Analysts estimate 50% of enterprises remain vulnerable to similar physical attacks due to unsecured Ethernet ports and inadequate device authentication. Organizations should disable unused ports by default, implement 802.1X authentication, deploy physical layer fingerprinting tools, and monitor for external infrastructure connections when unknown devices appear.
Unit 42 analyzed the upgraded Mario encryptor used by the RansomHouse ransomware, which evolved from simple single-pass encryption to a two-factor scheme that uses both primary and secondary keys, with chunked file processing. The RaaS operation, tracked as Jolly Scorpius, specifically targets VMware ESXi infrastructure, using the MrAgent deployment tool to encrypt multiple virtual machines simultaneously. The enhanced encryption methodology, with non-linear file processing and dynamic chunk sizing, significantly complicates static analysis and decryption for defenders.
CVE-2025-55182, also known as React2Shell, is a critical remote code execution vulnerability in React Server Components and frameworks such as Next.js that allows attackers to execute arbitrary code with a single malicious HTTP request on vulnerable servers. Default configurations are affected and reliable public exploits exist. Attackers can gain initial access without authentication and then deploy tools such as reverse shells, RATs, cryptominers, and credential harvesters across Windows and Linux environments.
Sponsored
Security folks say genAI threats are a top concern, but few have the LLM and AI-powered security testing they need to address this novel risk. Cobalt's State of LLM Security Report 2025 [11] lays out the key LLM vulnerabilities, along with concrete recommendations for security
Datadog released an open-source dataset of over 17,000 malicious npm and PyPI packages identified through their GuardDog tool, categorized by ecosystem and whether they were compromised legitimate packages or published with malicious intent.
Wirebrowser is an open-source debugging and interception toolkit built on Chrome DevTools Protocol that combines network manipulation, API testing, and deep JavaScript memory inspection. Key features include Live Object Search for runtime patching of JS objects and Origin Trace (BDHS) for identifying user-land functions responsible for object creation or mutation through automated heap snapshots.
Verisoul provides an all‑in‑one fraud prevention platform that detects and blocks fake accounts and bots across the entire user lifecycle using device fingerprinting, behavioral analysis, and AI‑driven risk scoring to protect platforms from AI‑powered abuse and payment fraud.
A developer's Umami analytics container was exploited via CVE-2025-66478, a Next.js React Server Components deserialization flaw, resulting in Monero cryptominers running undetected for 10 days. Container isolation prevented the compromise from spreading because the container ran as non-root with no volume mounts or privileged access. The incident highlights the importance of knowing your dependencies' underlying frameworks and properly configuring container security boundaries.
UK healthcare tech firm DXS International has reported a cyberattack on its office servers serving NHS England. Services will remain operational while the scope of any data theft is under investigation. A ransomware group called DevMan claims to have stolen 300 GB of data. Authorities, including the UK Information Commissioner's Office and law enforcement, have been notified.
Anthropic's Claude models outperform rival LLMs on jailbreak resistance, prompt injection defenses, and limiting harmful or misleading outputs. While most vendors show mediocre and slow safety progress, Claude 4.x scores around 75–80% on jailbreak tests and nearly perfect on harmful content refusal, largely because Anthropic bakes safety alignment deeply into the training process instead of adding it as a final layer.
France arrested a 22-year-old suspect after BreachForums administrator "Indra" claimed responsibility for breaching the Interior Ministry and allegedly accessing criminal records, wanted persons databases, and Interpol systems containing over 16 million records.
The Arcanum Prompt Injection Taxonomy provides a structured taxonomy of prompt injection attacks, categorizing different types of attacks intents, techniques, and evasions.
The FBI, working with German and Finnish authorities, seized cryptocurrency exchange E-Note and indicted Russian national Mykhalio Petrovich Chudnovets for laundering over $70 million for ransomware operators since 2017.