Parse notes
Sponsored
Security teams drown in noise: you triage 100 findings, maybe 10 matter, and you lose trust. Meanwhile, devs end up context-switching into code they haven't touched in weeks.
Apple patched CVE-2026-20700, an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor) discovered by Google's Threat Analysis Group, which was exploited in targeted attacks against specific individuals running iOS versions before iOS 26, marking the first Apple zero-day patched in 2026. The flaw, chained with two previously patched vulnerabilities (CVE-2025-14174 and CVE-2025-43529), affects iPhone 11 and later, iPad, Mac, Apple TV, Apple Watch, and Vision Pro devices. Fixes are available in iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.
CVE-2026-20841 (CVSS 8.8) is a command injection flaw in Microsoft's updated Notepad (versions 11.0.0 to 11.2509). The vulnerability arises because the Markdown handler does not validate link content before execution, allowing attackers to execute remote code when users open a malicious .md file and click an embedded link. Public proof-of-concept exploits exist, and the vulnerability is actively being exploited, granting attackers full permission to execute code. Microsoft addressed this issue in Notepad build 11.2510+ on February 10. Users are advised to disable Markdown and link previews when unnecessary.
A May 2025 cyberattack on ApolloMD exposed PII and PHI for 626,540 people associated with affiliated physicians and practices, including diagnoses, treatment details, insurance data, and, in some cases, Social Security numbers. Notifications began in September 2025, with free credit monitoring offered, and Qilin ransomware actors later claimed responsibility on their leak site.
A financial services organization transitioned from annual compliance-driven pentesting to weekly continuous validation, revealing that a single read-only AWS credential enabled 39 distinct attack paths, including full account compromise in under 10 minutes and access to over 100,000 sensitive files. The shift to frequent automated testing reduced mean time to remediate from months to days, with the team completing roughly 40 pentests in eight months and uncovering previously invisible risks, including overly permissive SMB shares, IAM privilege escalation paths, and a critical PAN-OS vulnerability (CVE-2025-0108). The case study demonstrates how continuous validation transforms security programs from point-in-time compliance exercises into operational exposure management, where findings are prioritized by proven exploitability and mapped to real threat actor TTPs like Scattered Spider.
Lotus Blossom compromised the Notepad++ hosting infrastructure between June and December 2025, hijacking the update server to selectively serve malicious installers to targets across government, telecom, and critical infrastructure sectors in Southeast Asia, South America, the US, and Europe. The attack delivered two infection chains — a Lua script injection variant deploying Cobalt Strike beacons and a DLL sideloading variant using a renamed Bitdefender component to load the Chrysalis backdoor with Warbird-protected evasion techniques. Users should manually update to Notepad++ v8.9.1 or later, which includes certificate and signature verification for downloaded installers.
This is the first post in a series using BishopFox's BadPods, which features a variety of pod manifests with varying levels of misconfiguration, to investigate the protections included in different cloud providers' managed Kubernetes offerings. This series includes the most permissive pod manifest, which the author uses to trivially escape the pod via a mounted host path and then further escalate privileges within the account by stealing IAM credentials from IMDS.
BinaryAudit is an open-source benchmark from Quesma for evaluating AI agents' ability to detect backdoors in stripped binary executables using reverse engineering tools like Ghidra and Radare2. The benchmark tests models against backdoored versions of lighttpd, dnsmasq, Dropbear, and Sozu, with Claude Opus 4.6 leading at 49% detection but hampered by a 22% false positive rate across clean binaries. Results highlight that while AI-assisted binary analysis is becoming accessible to non-specialists, high false positive rates and inability to trace data flow through complex binaries make it unsuitable for production malware detection today.
Nucleus provides an exposure management orchestration platform that ingests data from 200+ security and asset tools, normalizes and correlates vulnerabilities with threat intel and business context to prioritize and remediate risk across environments.
Dotenv is a zero-dependency module that loads environment variables from a .env file into process.env, storing configuration in the environment and separating from code while following the Twelve-Factor App methodology.
The Kimwolf IoT botnet accidentally disrupted the I2P anonymity network after attempting to register 700,000 infected devices as nodes — a Sybil attack that overwhelmed the roughly 15,000-20,000 node network — while seeking takedown-resistant C2 infrastructure. The botmasters, who admitted to the disruption on Discord, have been experimenting with both I2P and Tor as fallback command-and-control channels after security companies and network operators intensified efforts to combat the botnet. I2P is currently operating at roughly half capacity as stability fixes roll out, while Kimwolf's overall numbers have reportedly dropped by more than 600,000 infected systems following internal operator disputes and operational errors.
Microsoft has shipped emergency fixes for several actively exploited Windows and Office zero-days that enable one-click remote code execution and SmartScreen bypasses across all supported Windows versions. Attackers can silently run high-privilege malware, enabling ransomware and espionage campaigns. Admins and end users are urged to patch immediately and treat malicious links and Office files as high risk.
Google's threat team details how North Korean group UNC2970 and others weaponize Gemini for OSINT-driven target profiling, tailored phishing, vulnerability analysis, and exploit debugging, blurring the line between research and reconnaissance. Attackers also use Gemini's API in HONESTCUE malware, AI-built COINBAIT phishing kits, and large-scale model extraction attempts that clone Gemini's behavior via high-volume prompt queries.
Law enforcement crippled Lumma Stealer's infrastructure in 2025, but the infostealer has rapidly rebuilt and is spreading again using persuasive “ClickFix” fake CAPTCHA prompts that trick users into running commands in Windows Terminal, loading CastleLoader in memory, then Lumma.
Google Cloud Security conducted a five-month security audit of Intel's Trust Domain Extensions and discovered five vulnerabilities.
Russia is escalating its crackdown on independent messaging platforms by attempting to fully block WhatsApp and throttling Telegram.