Parse notes
Sponsored
Set it and forget it? Not when it comes to securing Google Workspace. Configuration drift, admin sprawl, and risky integrations creep in over time, opening up security gaps that attackers love to exploit. This checklist from Nudge Security [5] will help you catch common mistakes and keep your security tight.
Extortion group ShinyHunters stole roughly 14 million records from Panera Bread by compromising a Microsoft Entra SSO code, then leaked a 760GB archive after failed ransom demands. The dump includes 5.1 million unique customer email addresses, along with names, addresses, and phone numbers, creating significant downstream risk of phishing, credential stuffing, and identity-based attacks that can extend far beyond Panera's ecosystem.
Researchers at Socket Security identified a new set of compromised packages on the OpenVSX marketplace that appear to be infected with the GlassWorm malware. The malware targets macOS users and harvests data from browsers, wallet extensions and wallet apps, macOS keychains, Apple Notes databases, Safari cookies, developer secrets, and documents from the local filesystem. The researchers note that the extensions operated legitimately for two years prior to infection, so it is possible that the developer was compromised.
A security researcher discovered a vulnerability in Instagram that exposed links to private photos and captions in the HTML source code of some private profiles. The researcher found that, in their testing, 28% of the accounts they created or had access to exhibited this issue. Meta responded to the researcher, stating that the issue was caused by a CDN caching problem and has been fixed, but the researcher contends that it's a backend authorization issue.
Job seekers looking to transition to cybersecurity should begin by identifying the role that is right for them, finding a career mentor to guide them, joining learning communities, and developing the required skills. They should then build their online presence and experience by volunteering with the security team at their current job, telling their network about their career transition, building an online portfolio, and polishing their LinkedIn profile. Finally, it's time to apply for the job and prepare for interviews.
Self-replicating “prompt worms” are emerging as a serious security risk as OpenClaw's autonomous AI agents interact on Moltbook, install unvetted skills, and access private data. Researchers have already found hidden prompt-injection attacks, leaked API keys, and misconfigured databases that could allow attackers to silently execute malicious instructions. With more capable local models coming, today's OpenClaw ecosystem looks like a high-stakes dry run for much larger, harder-to-stop AI agent outbreaks.
This post shares results from a 60-day audit of Outline's open-source wiki, uncovering seven vulnerabilities ranging from SSRF and CSRF to insecure design and an IDOR in event logging. The authors highlight strong baseline security in Outline's API design, but also note that subtle framework behaviors and outdated dependencies led to real-world issues, including a potential admin account takeover. One finding was uniquely caught by an AI security platform, yet most AI-reported issues were persuasive false positives that consumed 40 hours of validation. The conclusion emphasizes that AI tools are promising assistants, but human expertise remains essential for high‑quality security reviews.
GhostKatz extracts LSASS credentials directly from physical memory by abusing signed vulnerable kernel drivers with `MmMapIoSpace` read primitives, bypassing traditional user-mode detection mechanisms like EDR hooks on LSASS. Designed as a modular Cobalt Strike BOF, it currently ships with exploits for Toshiba TPwSav and TechPowerUp ThrottleStop drivers and supports extensibility for custom driver research via `utils.c`. Tested across Windows 10, Server 2012 R2 through 2022, the tool supports both logonpasswords and wdigest credential dumping modes, though operators should note the inherent BSOD risk when leveraging vulnerable kernel drivers in production environments.
RapidFort provides an automated software supply chain security platform that analyzes and hardens containers, eliminates unused and vulnerable components, and delivers curated, near-zero-CVE base images to reduce attack surface before production deployment.
OpenMalleableC2 is a framework-agnostic library that implements Cobalt Strike's Malleable C2 profile for HTTP transformations.
Cryptographer Matthew Green analyzes a class action lawsuit alleging Meta can secretly read all WhatsApp messages, concluding the claims lack solid evidence and that mass-scale decryption backdoors would be detectable through reverse engineering of the closed-source client app. While acknowledging legitimate privacy concerns around WhatsApp's metadata collection, backup encryption complexity, and new AI-powered "Private Processing" features, Green argues these known limitations are far removed from the deliberate universal plaintext access alleged in the complaint. Security professionals who remain uncomfortable trusting WhatsApp's closed-source implementation are advised to use Signal, which offers open-source code and reproducible builds for independent verification.
Docker patched a critical “DockerDash” vulnerability in its Ask Gordon AI assistant that allowed attackers to hide malicious instructions in Docker image metadata labels, leading to remote code execution and data theft via MCP tools. The flaw exploited meta-context injection and breached trust boundaries among the AI, MCP gateway, and local tools, and is fixed in Docker Desktop 4.50.0.
In 2019, two Coalfire consultants, legally hired to test an Iowa courthouse's security, were arrested for burglary after a county sheriff overrode officers who had verified their contract. Their prosecution dragged on for months, damaging careers and client relationships, until Dallas County agreed to a $600,000 settlement seven years later.
Sponsored
AuditBoard's free virtual event features risk experts from EY, Kimberly-Clark, and OpenAI. Get up to 4 free CPE credits as you learn
APT28 is actively exploiting CVE-2026-21509, a Microsoft Office security feature-bypass zero-day, in phishing campaigns targeting Ukrainian government agencies and EU organizations.
Coinbase confirmed an insider breach in December 2025, where a contractor improperly accessed data of approximately 30 customers.
GitHub is exploring options, including disabling pull requests and requiring AI disclosure, after open-source maintainers reported that the vast majority of AI-generated contributions are low-quality work that increases review burden and erodes community trust.