Parse notes
Hacktivist group “Department of Peace” claims to have breached a DHS tech‑procurement office, leaking ICE contract records involving over 6,000 vendors, including major defense and surveillance firms. The data exposes contract values and detailed contact information, sharpening doxxing, targeting, and supply‑chain risks for companies embedded in the US immigration enforcement infrastructure.
Madison Square Garden has confirmed a data breach linked to the 2025 Oracle E-Business Suite campaign, in which Cl0p exploited vulnerabilities in a third-party-hosted instance. Over 210GB of personal information, including names and Social Security numbers, was stolen. Notifications are being sent to individuals affected by the breach.
Google's March 2026 Android security update patches 129 vulnerabilities, the highest monthly count since April 2018, including an actively exploited Qualcomm zero-day (CVE-2026-21385) affecting 234 chipsets. Google's Threat Analysis Group reported a high-severity memory-corruption flaw in an open-source Qualcomm display component in December, and fixes were made available to OEMs in January. Android device users should apply security updates as they become available from their device manufacturers.
Using passkeys' WebAuthn PRF (Pseudo-Random Function) extension to derive encryption keys for E2EE (End-to-End Encrypted) data dangerously couples data availability to authentication credentials, dramatically increasing the “blast radius” of routine credential loss or deletion. Common password-manager UIs don't clearly communicate that deleting a passkey may permanently orphan encrypted backups, so users can recover their account via other methods yet still be unable to decrypt or restore their data—effectively a self-inflicted, irreversible data-loss scenario. If you must use PRF, add prominent up-front warnings and support documentation, and push credential managers to show explicit deletion warnings for PRF-enabled passkeys.
A long‑standing TOCTOU flaw in Node.js ClientRequest.path allows attackers to bypass CRLF validation by mutating the path after construction but before _implicitHeader() serializes the request line, enabling header injection, body injection, and full HTTP request splitting across popular proxy and HTTP client libraries with roughly 160M+ weekly downloads. Tracing the original CVE‑2018‑12116 fix pinpoints the remaining design gap, demonstrates practical exploits against common proxy patterns, and contrasts vulnerable libraries with those whose architectures naturally close the window. Node.js considers this out of scope for its threat model, shifting responsibility to library authors and application developers, who are urged to re‑validate paths, avoid exposing raw ClientRequest objects before flushing, and audit code where user input flows into req.path or proxyReq.path during this critical window.
Kerberos TGT requests emit Windows Events with the Id 4768 and include a wealth of information about the request. The user can compare the request flags against those commonly set by tools such as Metasploit, those included in IoCs from malware campaigns, or those that differ from an established baseline to identify suspicious activity. This post includes a breakdown of the flags and a KQL query for hunting suspicious ones.
Sponsored
Writing code can be stressful—but not half as stressful as a surprise security meltdown. Inject optimism and calm into the developer scrum with Microsoft Azure [11]. Unified security across code and cloud environments and built-in DDoS protection mean you've got less cause for concern—and a clear mind for innovation. Help
AWS Security Hub Extended introduces a unified, full‑stack security plan that bundles AWS-native detections with curated partner tools across endpoints, identity, email, data, network, browser, cloud, AI, and SecOps. It standardizes findings via OCSF, centralizes them in Security Hub, and offers pay‑as‑you‑go procurement with AWS as seller of record.
Digibastion is an open-source Web3 security platform that centralizes threat intel, OpSec assessments, best-practice checklists, and tooling to help protect crypto users from phishing, scams, and technical risks.
Safety for Agents (Sage) is a lightweight agent detection and response layer for AI agents that guards commands, files, and web requests.
This is a technical primer on how elliptic curve cryptography works. ECC's security comes from the one-way nature of scalar multiplication, rather than from the hardness of the Elliptic Curve Discrete Logarithm Problem, while enabling much smaller keys than RSA for comparable security. The post walks through the mechanics behind point addition, finite-field arithmetic, ECDH, ECDSA, and ECIES, and highlights a key operational risk: reused ECDSA nonces can leak private keys. For security professionals, the actionable takeaway is to prefer well-vetted modern curves and implementations, ensure strong nonce handling and key generation, and remember ECC remains efficient and widely deployed today but is not post-quantum safe.
Multiple major Pakistani news channels, including Geo News, ARY News, and Samaa TV, had their satellite feeds hijacked on March 1 to display anti-military messages during peak Ramadan viewing hours. Attackers compromised the PakSat satellite beams and live feeds. The breach triggered retaliatory cyberattacks from a group called Pakistan Cyber Force against Indian media outlets. Authorities are investigating the coordinated incident, which also reportedly affected websites across 19 countries through unauthorized Google ad campaigns.
Researchers from StepSecurity have uncovered an automated hacking bot, dubbed “hackerbot-claw,” which claims to have scanned over 47k repositories for security vulnerabilities but has actually exploited vulnerabilities to compromise 6 popular open-source projects. The compromised projects include repositories from DataDog, Microsoft, and Aqua Security. Aqua Security renamed and made Trivy private after the bot fully compromised it.
Sponsored
Microsoft Azure autoscales when traffic spikes—adjusting capacity automatically so you can skip the scramble. With more global regions than any other cloud provider, you've always got room to grow. Scale
Chrome is rolling out Merkle Tree Certificates and a dedicated quantum‑resistant root store to make HTTPS post‑quantum safe without bloating TLS handshakes.
A serious vulnerability in the OpenClaw AI assistant enabled attackers to take control of agents through malicious websites by exploiting unsecured localhost WebSocket connections and unlimited password brute-force attempts, but it has been fixed in version 2026.2.25.
A Florida woman was sentenced to 22 months in prison and fined $50,000 for trafficking tens of thousands of stolen Microsoft COA labels, extracting product keys, and selling them in bulk to customers worldwide, in a scheme totaling over $5 million.