Parse notes
Sponsored
Most "AI for security" tools don't actually make your workflows faster or easier. Sumo Logic's Dojo AI [4] is a different beast, deploying specialized agents that work together to triage alerts, explain what triggered them, and write queries for you.
The Everest ransomware group claimed to have breached Nissan Motor Corporation, posting screenshots on their dark web leak site showing directory structures with 900GB of allegedly stolen data, including dealership information, financial records, and operational documentation in .csv, .txt, .pgp, and .xls formats. The group issued a five-day deadline before public release, continuing their aggressive 2025-2026 campaign that has targeted ASUS, Chrysler, AT&T, and other major organizations. This marks Nissan's third significant security incident in recent years, following the Qilin ransomware attack on its design subsidiary and the 2023 breach affecting over 100,000 individuals.
Hackers broke into Spanish utility Endesa's commercial systems and accessed customer data of over 20 million customers, including identification details, national ID numbers, contract information, and IBAN payment data. The company says passwords were not exposed, operations remain normal, and extra security measures and monitoring are in place.
An unknown threat actor has claimed to have stolen a trove of Target's internal source code and documentation and is selling it on dark web marketplaces. After BleepingComputer contacted Target for comment, the files were taken offline, and Target's Git server became inaccessible from the internet. Multiple Target employees have confirmed that the source code samples are legitimate.
OAuth in Microsoft Entra creates complex webs of apps, permissions, and identities that are hard to reason about with tables alone, so modelling everything as a graph reveals abuse paths such as impersonation and long‑lived access that would otherwise stay hidden. OID-See uses Microsoft Graph to map service principals, delegated scopes, app roles, ownership, assignments, and reply URLs into a graph-backed analysis. It then layers scoring and enrichment to highlight risky apps, misleading Microsoft-shaped metadata, and dangerous patterns like broad reachability, wildcard redirects, and stale credentials.
EventBridge JSONs can become very complex quickly. AWS provides very little documentation to help parse them. Fields at the same level of the JSON are ANDed together, whereas values in an array are ORed together. If a user wants to apply an OR to two fields, they can use the $or operator. However, users should be careful when nesting $ors, as each branch gets expanded into additional sub-patterns that can become contradictory or complex to debug. This post also covers other operators and how to combine them to develop complex Boolean logic.
Claude for Healthcare enables Pro and Max subscribers in the US to connect health records via HealthEx, Function, and upcoming Apple Health/Android Health Connect integrations for medical history summarization and test result explanations. The implementation features privacy-by-design controls allowing users to manage data sharing permissions, with health data explicitly excluded from model training. Anthropic's Acceptable Use Policy requires qualified professional review of outputs for high-risk healthcare decisions, acknowledging AI limitations in medical contexts.
This GitHub repository contains a collection of 150+ tools and resources that can be useful for red teaming activities. Some of the tools may be specifically designed for red teaming, while others are more general-purpose and can be adapted for use in a red teaming context.
Check Point Research identified an upgraded GoBruteforcer campaign targeting cryptocurrency and blockchain project databases, exploiting weak credentials spread via AI-generated server-deployment tutorials and legacy XAMPP stacks that expose FTP and phpMyAdmin interfaces. The Golang-based botnet features an obfuscated IRC bot, dynamic credential lists that include crypto-focused usernames, and a module that queries TRON blockchain addresses for non-zero balances. Separately, GreyNoise observed 80,469 sessions over 11 days from threat actors systematically probing 73+ LLM endpoints across major AI providers, hunting for misconfigured proxy servers that leak API access.
A Dutch man was sentenced to seven years in prison for hacking port logistics systems in the Netherlands and Belgium to support cocaine smuggling operations. He used malware delivered via USB sticks, with help from an insider, to gain remote access, steal data, and intercept communications.
Dutch authorities have arrested a 33-year-old Dutch suspect at Schiphol Airport, accusing him and two linked companies of running AVCheck, a major counter-antivirus platform that lets criminals test and fine-tune malware against multiple security products. AVCheck, dismantled in May 2025 during Operation Endgame, allegedly helped attackers perfect campaigns by identifying which targets and defenses were easiest to evade.
CalPrivacy fined Datamasters $45,000 and banned the unregistered data broker from selling Californians' personal information after it traded hundreds of millions of records containing sensitive health data.
A 24-year-old Tennessee man, Nicholas Moore, repeatedly accessed the US Supreme Court's electronic filing system without authorization over 25 days between August and October 2023, obtaining unspecified information from a protected computer.
Microsoft's January 2026 Patch Tuesday addressed 112 vulnerabilities, including CVE-2026-20805, an actively exploited information disclosure zero-day in Desktop Window Manager (CVSS 5.5) that CISA added to its KEV catalog.