Parse notes
Sponsored
Flashpoint just released a massive study of the AI threat landscape. Analysts monitored over 2.6 MILLION AI-RELATED POSTS across Telegram, the dark web, and underground LLM forums.
Wordfence detected a new critical vulnerability in the Advanced Custom Fields Extended (ACF Extended) plugin for WordPress that could allow unauthenticated attackers to obtain admin privileges. The vulnerability arises from a lack of enforcement of role restrictions during form-based user creation. The vulnerability is only exploitable on sites that use a “Create User” or “Update User” form with the role field mapped.
The Minnesota Department of Human Services is notifying 300K victims that their data was accessed by an unauthorized individual over the course of a month. A user affiliated with a licensed care provider accessed data in the MnCHOICES system without authorization. The data accessed includes names, sex, dates of birth, phone numbers, addresses, Medicaid ID numbers, and the last four digits of SSNs.
Two new vulnerabilities allow for sensitive data leakage in versions of Apache Airflow prior to 3.16. The first vulnerability arises from Airflow failing to properly mask proxy credentials in log files. The second vulnerability arises from Airflow not applying user-registered secret pattern masking before truncating field templates when dealing with long fields in the Rendered Templates UI.
A security researcher documented a DPRK-linked Contagious Interview campaign in which threat actors posed as recruiters on Discord, delivering malware via fake technical assessments that deployed a multi-stage payload using blockchain-based dead-drop resolvers across Tron, Aptos, and Binance Smart Chain. The final RAT establishes persistence by injecting into VS Code and Cursor IDEs, exfiltrates credentials, and evades analysis by detecting cloud/CI/CD environments. Detection requires monitoring for Node.js processes that spawn with eval flags and API calls to blockchain endpoints such as api.trongrid.io.
Quarkslab has updated its Clang hardening cheat sheet after ten years, documenting new compiler mitigations including FORTIFY_SOURCE level 3, stack clash protection via -fstack-clash-protection, and Intel CET/ARM PAC+BTI for control-flow integrity. The guide covers defenses against ROP/JOP attacks through hardware-assisted mechanisms such as shadow stacks and indirect branch tracking, as well as speculative execution mitigations with -mspeculative-load-hardening. Security teams should adopt the OpenSSF-recommended compiler flags and consider architecture-specific protections (CET for x86 and PAC/BTI for ARM) while balancing performance trade-offs.
SolyxImmortal is a Python-based spyware that targets Windows systems, focused on long-term surveillance and data theft rather than destruction. It steals browser credentials, harvests documents, logs keystrokes, and captures screenshots, then exfiltrates everything via hardcoded Discord webhooks over HTTPS to blend into normal traffic. It minimizes detection while continuously monitoring victims by persisting through AppData and Run keys, abusing DPAPI to decrypt Chromium credentials, and batching keystrokes and archives.
Sponsored
As cyberattackers grow bolder and data protection regulations become stricter, organizational password management is a must. The Bitwarden Password Management Maturity Model [11] is a free and simple framework for evaluating your password posture. For more on how to protect your
Anamnesis is an evaluation framework for studying how LLM agents generate exploits from vulnerability reports, demonstrating that Claude Opus 4.5 and GPT-5.2 agents can independently develop working exploits that bypass ASLR, NX, full RELRO, CFI, Shadow Stack, and seccomp sandboxes when given a QuickJS use-after-free vulnerability and proof-of-concept trigger.
Syzkaller is a kernel fuzzer that finds bugs across various operating systems, including Linux and Windows. Originally for Linux, it now supports other OS kernels. It is a coverage-guided tool developed by Google, but it is not an official product.
ADTrapper is a comprehensive security analysis platform designed for cybersecurity professionals to analyze Windows AD authentication logs.
The UK Gambling Commission's executive director accused Meta of knowingly allowing illegal gambling advertisements, noting that its own searchable ad library reveals operators using keywords like "not on Gamstop" to target vulnerable users. Meta suggested the regulator deploy AI tools to find and report these ads rather than proactively policing its own platform. The commission's executive director described Meta's ad library as "a window into criminality" and said the company appears "happy to turn a blind eye and continue taking money from criminals."
North Korean operators are posing as recruiters and sending developers fake coding tests that require cloning malicious Git repositories into VS Code. Once the project is opened and trusted, malicious tasks.json configurations fetch obfuscated JavaScript payloads from Vercel to install backdoors such as BeaverTail and InvisibleFerret, enabling remote code execution, keylogging, data theft, and crypto mining.
A seemingly normal calendar invite hides a natural-language payload in the event description, which Gemini processes when a user later asks about their schedule. This triggers Gemini to summarize private meetings, write the summary into a new event visible to the attacker, and reply with a harmless message.
OpenAI's ChatGPT Health product raises data privacy concerns by enabling medical record integration and third-party sharing without confirmed end-to-end encryption or HIPAA protections, and notably excludes regions with stricter data regulations, such as the EEA and the UK.
West Midlands Police chief constable retired after the force used Microsoft Copilot's fabricated report about a non-existent football match to justify banning Israeli fans, highlighting the risks of AI hallucinations in law enforcement decision-making.
A Warwickshire secondary school is reopening after a severe cyberattack disabled critical IT and safety systems, including gates, fire alarms, registers, phones, and internet.