Parse notes
Sponsored
The industry now has a peer-reviewed risk framework for autonomous, tool-using AI agents. In this live AMA-style webinar [4] on Wed. 1/28, engage with CHRIS HUGHES, STEVE WILSON, MICHAEL BARGURY, AND KAYLA UNDERKOFFLER - security experts who helped shape the new OWASP standard.
READY TO GO DEEPER? Get certified with Zenity's _Learning Lab_ series, Foundations of AI Security, What, Why, and How [5], and equip yourself with the necessary tools to ADOPT SECURE AI AT SCALE.
Claude Cowork is a new general-purpose agent now available in research preview. It is vulnerable to indirect prompt injection via uploaded files and can be abused to exfiltrate sensitive documents. This attack exploits a previously reported, unremediated vulnerability in the Claude sandbox that allows network connections to the Claude API.
Grubhub has confirmed that an unarmed threat actor accessed its systems and stole data. While Grubhub has not confirmed the identity of the threat actor, sources have reported that the ShinyHunters group is extorting the company. The threat actor is reportedly extorting the company to prevent the leak of data from an older Salesforce instance and to prevent the theft of data from the company's current Zendesk platform.
A phishing campaign delivered via WhatsApp targeted Iranian activists, academics, government officials, and business leaders across the Middle East, stealing Gmail credentials with 2FA codes, hijacking WhatsApp accounts via malicious QR codes, and attempting to exfiltrate location data, photos, and audio recordings. An exposed attacker server revealed 850+ records affecting fewer than 50 confirmed victims, with infrastructure registered as early as August 2025 using DuckDNS for domain masking. Security researchers noted hallmarks consistent with IRGC-linked spearphishing, though financial motivations have not been ruled out. Users should avoid clicking unsolicited WhatsApp links and regularly audit linked devices.
Prepared statements are a standard recommendation to solve most SQL injection issues. This post demonstrates a technique discovered while working on a pentest for manipulating prepared statements in JavaScript applications using the mysql or mysql2 package. The packages convert arrays and JSON objects to SQL fragments by default, which could allow an attacker to perform SQL injection.
Prompt injection prompts are akin to 0days and should not be published. Prompt injection prompts that are not customer-specific should be shared because attackers already have access to prompt injection strings, so the benefit to defenders of seeing real-world threats outweighs the risks.
The Shai-Hulud worm demonstrated how attackers weaponize self-hosted GitHub Actions runners as persistent backdoors by installing rogue runners on compromised machines and using GitHub Discussions as a command-and-control channel via intentionally vulnerable workflows with command injection. The technique exploited the RUNNER_TRACKING_ID=0 environment variable to bypass process cleanup and achieve persistence, while all traffic flowed to github.com, evading traditional network defenses. Security teams should audit runner inventories for unauthorized registrations, implement ephemeral runners, restrict self-hosted runners to private repositories only, and deploy runtime detection for persistence techniques.
This repository contains a collection of 10 MCP challenges reproduced from real CVEs and public incident reports.
sigdream provides a sigreturn-oriented programming-based sleep obfuscation library that encrypts PT_LOAD segments and the heap.
Tangled is a phishing platform that weaponizes iCalendar rendering features in Microsoft Outlook and Gmail to automatically add spoofed meeting invites to targets' calendars without user interaction. The tool automates the delivery of social engineering campaigns and runs as Docker containers, with a web-based dashboard for managing phishing operations. Red teams can use this to test an organization's susceptibility to calendar-based phishing attacks that bypass traditional email security controls.
npm has announced a new release strategy called staged publishing to protect against future compromises in the wake of 2025's Shai-Hulud supply chain compromises. Staged publishing will complement npm's previous credentials safety efforts by requiring new project releases to be manually approved via an MFA-verified maintainer. Package maintainers have expressed a need for more registry-level protections after npm's chaotic removal of classic tokens.
Researchers from Wiz discovered a vulnerability in the way CodeBuild CI pipelines handled build triggers. This vulnerability could have been exploited to take over AWS repositories, including the AWS JavaScript SDK, which powers the AWS console. AWS immediately took steps to remediate the vulnerability before any exploitation occurred.
A security researcher chained multiple vulnerabilities in Facebook's JavaScript SDK to achieve account takeover in the Facebook mobile app, exploiting Math.random() for callback identifier generation, DOM XSS via unsanitized SVG injection in the Customer Chat plugin, and X-Frame-Options bypass in mobile webviews. The attack reconstructed the PRNG state by forcing plugin iframe reinitializations and observing leaked window.name values, enabling prediction of security-critical callback identifiers. Meta awarded a $66,000 bounty and fixed the vulnerability in December 2023.
Ukrainian and German authorities have identified Black Basta's alleged leader as Oleg Nefedov, a 35-year-old Russian national with suspected FSB/GRU ties.
Microsoft released emergency out-of-band updates for Windows 10, Windows 11, and Windows Server to fix credential prompt failures blocking Cloud PC sessions and shutdown issues on Secure Launch-enabled devices caused by the January 2026 Patch Tuesday updates.
Organizations should immediately disable NTLMv1 and enforce NTLMv2-only authentication.