Parse notes
Boston Scientific reported a cyberattack disrupting access to core IT systems and business applications. The outage has impaired order processing and shipments, but the company has not confirmed whether implanted devices, patients, or customer data are affected. Its investigation continues, and there is no restoration timeline.
NovaCookies rents AitM phishing infrastructure for $320 monthly. It relays Microsoft 365 logins and steals authenticated session cookies, bypassing MFA. Island found at least 755 supporting domains targeting hundreds of organizations and uses fake DocuSign document shares and trusted redirect hops. Defenders should deploy phishing-resistant MFA, correlate browser and token activity, and revoke active sessions and refresh tokens after suspected compromise.
Manchester, London Stansted, and East Midlands airports suffered a data breach where attackers accessed data belonging to 8.7M customers. The incident involved data related to car park, lounges, and fast-track bookings, and in-airport WiFi signups. The breached data includes email addresses, phone numbers, vehicle registration numbers, and postcodes.
Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM sandbox on a patched Debian 12 host, and it broke out three separate times over roughly 12 hours of largely unsupervised operation. The agent chained a recently disclosed host-kernel bug first, then pivoted to an unpatched libslirp CVE paired with an unmarked bug fix after the kernel got updated, and finally, once QEMU was rebuilt from upstream source, synthesized a full exploit chain from three fresh 0-days (a QEMU VAPIC SMRAM flaw, a KVM shadow-page desync, and a libslirp ICMP-reflection bug) plus one kernel fix that hadn't reached the distribution's stable branch. Trail of Bits recommends treating such agents as advanced persistent threats: move to minimal-attack-surface hypervisors like Firecracker (which held even after a kernel hardlock), track upstream patches rather than trusting distro backport cycles, and enforce least-privilege network access, time-boxed runs, and pristine per-session environments.
A joint analysis by Tenable and SentinelOne revealed that state-sponsored groups and ransomware operators are independently exploiting the same edge device vulnerabilities. Researchers identified 12 flaws with confirmed multi-nexus exploitation by evaluating 93 CVE attribution pairs, including critical bugs in PAN-OS GlobalProtect (CVE-2024-3400) and Check Point Quantum (CVE-2024-24919). The underlying exposure data highlights severe remediation bottlenecks across major enterprise vendors. F5 appliances led exposure rates with 54 percent of customer environments carrying an actively exploited CVE, while Citrix deployments suffered a median patch time of 461 days. Additionally, Ivanti edge products demonstrated a predictable pattern of serial exploitation refreshing every 8.5 to 13 months. Security teams must prioritize patching F5 and Citrix appliances immediately while deploying feature set minimization and strict endpoint protections to block lateral movement following a perimeter breach.
Aikido recreated an Australian gym-booking incident using OpenClaw and Claude Opus 4.6. The test app exposed two flaws: client-side-only booking limits and an IDOR cancellation endpoint. Across ten runs, the model bypassed the booking window nine times. It cancelled another user's reservation in two runs, including one response to a generic waitlist request. Replay tests covered 16 decision points and found dominant responses averaged 96.38 percent with the model's actions shifting with small prompt and context changes.
Sponsored
Autonomous Security [11] analyzed telemetry from 100k enterprise AI sessions. The agents your team already uses hunt for credentials, learn from untrusted instructions, and build insecure tooling that runs in the background. Overall, 30% of sessions involved off-script agent behavior. To prevent dangerous improvisations, you need
AgentSweep is a fully offline tool to find and redact secrets in your AI coding agent's local history.
PerspectiveGraph is a tool that finds the reachable paths from internet exposure, through excessive privilege, to a sensitive asset, by correlating the scanners you already run into one live graph of your environment
NoiseHound is a tool that ingests the same graph data as BloodHound and re-ranks paths by expected detection cost instead of hop count.
OpenAI banned Russian-origin accounts promoting the International Burke Institute, a fake Israel-based think tank. Operators used VPNs and Russian prompts to create posts for X, LinkedIn, Facebook, Substack, and Telegram. IBI republished academic work under false names and published a “sovereignty” index praising Russia, and its Telegram channels drew 10,000–20,000 followers.
CISA's red team gained domain-level access at two critical-infrastructure organizations. One organization missed the intrusion amid false positives, disconnected SOC tooling, default credentials, AD CS flaws, cleartext secrets, and permanent AWS keys. The other organization isolated phishing-hit workstations within 2–20 minutes, yet assessors later obtained domain-controller secrets through an SCCM-stored service credential.
The FBI has seized QScan and QTRouter, China-linked hacking platforms used against critical infrastructure. Organizations should hunt for indicators of compromise associated with these platforms and report any findings to authorities.
Recent cyber threats prompted Trump to sign an executive order on foreign equipment in US energy infrastructure.
Ring is adopting the TAKE (Throw Away the Key Encryption) encryption standard for its smart home devices.
Australian police arrested two Western Australian men, aged 21 and 23, over alleged TeamPCP activity.