Parse notes
Sponsored
On March 18, Huntress [5] hosts _declassified [6], a live, raw intel drop on the dark economy of cybercrime, where John Hammond joins YourTuber Jim Browning to show you exactly what cybercriminal organizations look like.
Truffle Security discovered that enabling the Gemini API on a Google Cloud project silently grants existing API keys, including those publicly embedded in client-side JavaScript for services like Maps and Firebase, access to sensitive Gemini endpoints (CWE-1188, CWE-269). A scan of the November 2025 Common Crawl dataset identified 2,863 live Google API keys vulnerable to this privilege escalation, affecting major financial institutions, security companies, and Google itself. Organizations should audit all GCP projects for the Generative Language API, restrict or rotate any unrestricted or publicly exposed keys, and verify that no Gemini-capable keys are embedded in client-side code or public repositories.
Microsoft discovered Trojanized Next.js repositories linked to North Korea's Lazarus APT that deliver backdoors through fake job-recruitment coding challenges, achieving RCE and persistent C2 access on developer machines. The repositories exploit VS Code workspace automation via malicious .vscode/tasks.json files or embed obfuscated loaders in build assets that fetch attacker-controlled JavaScript at runtime. Security teams should enforce strict IDE trust policies, monitor for anomalous Node.js outbound connections, and treat developer workflows as a privileged attack surface.
Hackers have abused a max‑severity 10.0 flaw in Cisco Catalyst SD‑WAN gear since at least 2023 to gain top‑level access, maintain stealthy persistence, and spy on or steal data from large enterprises and critical infrastructure worldwide. Governments, including the US, UK, Canada, Australia, and New Zealand, warn of global targeting.
InfoGuard researchers demonstrated that Palo Alto's Cortex XDR Live Terminal feature can be abused as a pre-installed, EDR-trusted C2 channel, offering command execution, file transfer, and evasion capabilities through traffic that blends natively into enterprise network flows. The attack exploits a trivial URL validation flaw in cortex-xdr-payload.exe and the absence of mutual authentication or cryptographic command signing, allowing attackers to redirect connections to their own infrastructure via cross-tenant hijacking or a custom WebSocket server. Defenders should monitor for cortex-xdr-payload.exe spawned by any parent process other than cyserver.exe, while Palo Alto's claimed fix in versions 8.7-8.9 was not confirmed effective as of February.
AirSnitch exploits low-level Wi-Fi behavior to bypass client isolation, enabling bidirectional MitM from any SSID on the same AP against popular consumer and enterprise gear. Attackers can steal cookies, credentials, and RADIUS secrets, pivot between guest and corporate networks, and poison DNS, challenging assumptions about guest Wi-Fi safety and pushing networks toward stricter zero‑trust segmentation and careful AP/VLAN design.
In January 2026, the FBI-led seizure of the RAMP forum dismantled a central hub for ransomware coordination but mainly shattered trust and pushed actors into more fragmented spaces, such as the closed, pay-to-enter T1erOne and the open forum Rehub. Competing narratives about leaked RAMP data and possible insider abuse have reinforced fears of honeypots, driving a shift toward smaller, tightly vetted communities and parallel use of low-barrier platforms.
Sponsored
...And only 21% of serious LLM vulnerabilities are actually resolved, the lowest among all pentest types. Cobalt [13] combed data from 16,000 LLM pentests and the results are not pretty. They indicate that most teams are prioritizing quick fixes over complex problem solving.
AutoPiff is a semantic analysis engine that automates the detection of security-relevant changes in Windows kernel driver patches using 58 YAML-based rules across 22 vulnerability categories, including use-after-free fixes, bounds check additions, and IOCTL input validation. The framework runs as a Karton microservice pipeline integrating Ghidra decompilation, function matching, call-graph reachability analysis, and exploitability scoring to reduce manual driver pair analysis from 4-12 hours to under 5 minutes. Designed for silent patch detection and 1-day vulnerability research, it tracks 50+ dangerous API sinks and alerts on high-scoring findings via Telegram.
Gambit Security's AI-powered resilience platform, Balens, maps environments, security products, and backups to uncover gaps, validate recovery paths in real-time, and ensure business continuity against ransomware and disruptions.
A project dedicated to teaching beginners and non-tech-savvy people about digital privacy and cybersecurity.
A developer's .online domain was suspended via serverHold by registry operator Radix after Google Safe Browsing flagged the site, with no prior notification or grace period. The suspension created a Catch-22 where Google required DNS-based domain verification to review the flag, but the registry refused to reactivate DNS until Google removed it. The incident highlights the risks of non-.com TLDs with aggressive abuse policies and reinforces the importance of pre-registering domains in Google Search Console and adding uptime monitoring even for simple landing pages.
Google Threat Intelligence disrupted UNC2814, a China-linked espionage group that compromised 53 victims across 42 countries by targeting telecoms and government organizations with a novel backdoor called Gridtide that abuses Google Sheets API for C2 communication. The group, tracked since 2017, escalated privileges via SSH lateral movement and deployed SoftEther VPN Bridge for persistent encrypted connections, with infrastructure dating back to July 2018. Google terminated all attacker-controlled Cloud Projects, disabled known infrastructure, and revoked the Sheets API access used for C2 operations.
IBM X-Force data shows high volumes of unauthenticated vulnerabilities and a surge in infostealer‑driven credential theft, including hundreds of thousands of stolen ChatGPT logins. Attackers use AI and agentic systems to expand blast radius, pivot through supply chains, and blur criminal and nation‑state tradecraft.
Sponsored
Tech stack complexity is out of control, and the last thing you need is a bigger ‘stack'. Microsoft Azure gives you a unified view of applications, cloud resources, and AI—so you can ship more software
The US Treasury sanctioned Russian exploit broker Operation Zero and its founder Sergey Zelenyuk for acquiring at least eight stolen US government cyber tools from an insider and selling them to unauthorized buyers, marking the first-ever action under the Protecting American Intellectual Property Act.
Linux kernel maintainers have proposed replacing the aging PGP web of trust with a decentralized identity layer built on W3C DIDs and verifiable credentials.
Anthropic's Cowork desktop app has added scheduled task automation for Claude, enabling recurring workflows like morning briefings and weekly report generation, though security professionals should carefully scope the system access granted to the agent.