Parse notes
Nissan has confirmed that data belonging to approximately 21k customers was breached via a data breach at Red Hat in September. The breached data includes full names, physical and email addresses, phone numbers, and sales data for some customers who purchased or received services at Nissan in Fukuoka, Japan.
France's postal service, La Poste, suffered a widespread DDoS attack that disabled all IT systems for over twelve hours, affecting the website, mobile app, Digiposte digital document service, and digital ID services. The attack also disrupted La Poste's banking subsidiary Banque Postale's online services, though over-the-counter operations and payment processing remained functional. The timing raised concerns about potential Christmas delivery disruptions, with no timeline provided for service restoration.
A ransomware-linked campaign exploited zero-day flaws in Oracle E-Business Suite to access University of Phoenix systems, leading to data theft affecting nearly 3.5 million people. Exposed data includes names, dates of birth, Social Security numbers, and bank account details, though no leak has yet appeared online.
Red teamers traditionally must manually configure C2 redirector proxy rules by reviewing profiles and adding User-Agent strings and HTTP endpoints to configuration files, requiring updates whenever the C2 profile changes. The author developed caddy-c2, a Caddy web server module that automatically parses Cobalt Strike profiles using goMalleable to extract User-Agents and URI paths, then dynamically routes legitimate C2 traffic without manual rule configuration. The module simplifies redirector deployment by eliminating the need to manually sync proxy configurations with C2 profile changes, though current support is limited to Cobalt Strike, with plans to expand to frameworks such as Mythic and Havoc.
Mintlify lets customers write pages in MDX, but processes that content in a way that allows attackers to run arbitrary JavaScript on the server during build. This means an attacker can take over the build environment, poison cached pages, and inject malicious scripts into many companies' docs, including big names like Discord and Vercel. Because some docs were served from the same domain or path as real apps, those scripts could steal auth tokens or perform actions as logged-in users.
LinkedIn modernized its SAST pipeline by building custom GitHub Actions workflows using CodeQL and Semgrep that deviated from paved paths to accommodate complex internal build processes, implementing dynamic rule filtering, SARIF enrichment, and extensive metrics instrumentation across tens of thousands of repositories. The team deployed a "stub workflow" approach combined with a Drift Management System that daily checks repository compliance and automatically commits workflow files, ensuring consistent security coverage while allowing centralized updates without touching individual repos. LinkedIn implemented "blocking mode" enforcement via GitHub Repository Rulesets requiring SARIF submission and zero high-risk vulnerabilities before PR merges, protected by multi-level kill switches (organization/repo/language/tool/rule-specific) and fail-safe mechanisms that upload blank SARIFs to unblock developers during scanning failures while triggering oncall alerts.
CLR-Unhook is a native C++ utility that bypasses EDR/AV hooks in the .NET Common Language Runtime by restoring the original nLoadImage function implementation.
Mandiant released GoStringUngarbler, a Python tool that deobfuscates strings in Go binaries protected by garble's literal transformation flag, supporting Windows PE and Linux ELF executables compiled with Garble v0.11.0-v0.13.0 and Go v1.21-v1.23. The tool identifies decrypting subroutines via regex pattern matching, emulates them using the Unicorn emulator to extract plaintext strings, and patches the binary by replacing obfuscation routines with stubs that directly reference the decrypted content. Security analysts can use this to accelerate malware analysis of garble-obfuscated Go samples, though it only works when garble's "-literals" flag was used during compilation.
Gambit Cyber provides an AI-native, risk-centric continuous threat exposure management platform called KnightGuard. It uses coordinated AI agents to help enterprises continuously identify, validate, prioritize, and remediate cyber risks across CTI, SecOps, and IT operations.
The libxml2 library temporarily lost its sole volunteer maintainer, Nick Wellnhofer, after years of unpaid security work, creating a critical risk for GNOME, web browsers, and countless projects depending on this XML/XSLT processing library. Wellnhofer experienced burnout from companies that sent security reports, expecting immediate CVE responses and patches, with no financial compensation beyond a single Google donation, while providing no code contributions or test cases. Two new maintainers have assumed responsibility, but the incident highlights the unsustainable model in which commercial software relies on unpaid volunteers to maintain critical infrastructure components.
Security market analyst James Berthoty predicts that supply chain and AI tooling will dominate the market in 2026. Berthoty predicts that the following critical product capabilities will be essential: supply chain malware detection, AI vulnerability remediation and prioritization, AI visibility, guardrails, testing, AI based detections, and SOC augmenters. Teams should also have runtime function level reachability (ADR), developer endpoint security, and realtime AI threat modeling and design review on their radar.
OpenAI acknowledges that prompt injection attacks in AI browsers like ChatGPT Atlas are a long-term, unsolved security risk, similar to social engineering on the web. The company is layering defenses, including an LLM-based automated attacker that repeatedly probes Atlas in simulation to discover new attack strategies, tighten protections, and enforce user confirmations. Experts still question whether the current agentic browser value justifies their elevated risk.
Amazon blocked over 1,800 job applications from suspected North Korean agents since April 2024.
Pirate preservation group Anna's Archive scraped 256 million Spotify track records and 86 million audio files through unauthorised data collection.
ServiceNow is acquiring Armis, a nine-year-old cybersecurity company focused on securing critical infrastructure for Fortune 500s and governments, in an all-cash $7.75 billion deal.