Parse notes
Sponsored
If you're: >> fighting machine-speed attacks with manual triage, >> playing whack-a-mole with code reviews [5], or >> struggling to keep track of what agents are doing, then this is the summit for you. Join virtually on November 4th [6]and learn how to defend with frontline intel, agents, and governance from Google Cloud, Mandiant, and Wiz.
A 16-year-old buffer overflow in TianoCore EDK2's PXE Base Code driver (CVE-2026-97631, CVSS 9.5), the reference UEFI code behind most server firmware, allowed an attacker to send an oversized ICMP error during network boot and execute ring 0 code before Secure Boot and the TPM chain of trust loaded. An AMI pull request leaked the fix months ahead of a January coordinated disclosure, although exploitation required local network access and per-model address tuning. Defenders should request patched firmware from their UEFI vendors, disable PXE boot where feasible, and monitor network boot segments for anomalous ICMP traffic.
The Federal Election Commission (FEC) reported an outage in its filing system due to a cyberattack. The outage does not impact voting, just how campaigns report new funds flowing in. The FEC has not released details on whether any data was compromised.
Sony Network Communications disclosed that an unauthorized party accessed 2.5M records from its So-net member database, which supports its internet access service. The records included full names, phone numbers, email addresses, user IDs, dates of birth, gender, and Internet connection IDs. Additionally, it exposed 54K email addresses and account passwords from several email services.
TrendAI examined three attacker infrastructures targeting Japan, documenting autonomous attacks, AI-assisted planning, and suspected AI-written tools. CyberStrikeAI coordinated 44 agents against at least 19 organizations. Another operator scanned 6,000 Japanese IPs and stole hundreds of thousands of records through default credentials. A third used recovered VPN credentials to enter corporate networks. Evidence came from exposed attacker files. Victim-side confirmation remains incomplete.
Anchorage Digital and Turnkey ran the open-source VisualSign transaction parser inside AWS Nitro Enclaves, where each parsed result was signed with an ephemeral P-256 key and bundled with a Nitro attestation document whose PCRs wallets checked against reproducible builds. The design let wallets prove that unmodified, audited code decoded a transaction, removing blind trust in crypto transaction signing by providing verifiable attestation rather than relying solely on network identity or operator trust. The open-source awsnitroverifier Go library handles certificate-chain and PCR validation, which any organization can use to verify their services running in AWS Nitro.
Logs are structured records of security events in formats such as JSON, CSV, Syslog, and Windows Event Logs. Security engineers need to apply transformations to event logs to normalize the various formats and fields, making the data uniform for correlation and composite detections.
Snort Intrusion Prevention System 3 features improvements and new features resulting in enhanced performance, faster processing, improved scalability for your network, and a range of 200+ plugins so users can create a custom setup for their network.
Infisical manages secrets, encryption keys, digital certificates, and privileged access across cloud and on-premises infrastructure. Its Agent Vault inserts credentials through a proxy, keeping them from AI agents.
CREBench is a benchmark for evaluating LLM performance in cryptographic binary reverse engineering. CREBench evaluates models over algorithm identification, key (IV) extraction, wrapper-level code reimplementation, and flag recovery.
Causal Security's Cipher found four EPICS Base vulnerabilities in three hours and 49 minutes. One critical integer overflow, rated CVSS 9.8, could enable remote code execution. Three high-severity flaws permit crashes, memory corruption, or information disclosure. Exploitation requires network access to vulnerable EPICS services. EPICS controls equipment including particle accelerators and fusion experiments.
Skyw4lker targets US manufacturing, technology, and healthcare organizations through device code phishing. Password-protected contracts or proposals send victims through Google Sites into legitimate Microsoft authentication flows. Completing attacker-initiated authorization gives attackers Microsoft 365 tokens. ANY.RUN identified obfuscated JavaScript and a PHP backend tracking victim sessions, IP addresses, and geolocation, and the backend repeatedly polls for authentication completion.
Thieves have stolen over $100 million in data center equipment since June. They compromise freight accounts through malicious links, then bid on shipments using hijacked identities, and those with fake licenses get accomplices hired as drivers. Two thefts involved ramming security escorts' vehicles. One $10 million shipment disappeared after its tracking coordinates were apparently spoofed.
Sponsored
Think CTFs or bug bounties, but for AI agents. Find ways to make them break their rules, climb the leaderboard, and win cash.
Bank of America emailed customers warning against sharing banking credentials with AI assistants or other outside services, as sharing credentials can expose accounts to unauthorized transactions, fraud-triggered lockouts, or password leaks through assistant vulnerabilities.
The UK's latest budget commits the government to consulting next year on where liability for cyber breaches should sit, its first formal step toward holding software vendors accountable for insecure products, alongside £154 million for AI-driven cyber defenses that includes a £70 million NCSC vulnerability exposure centre.
NIST finalized its roadmap for phasing out quantum-vulnerable public-key algorithms in favor of its PQC standards, backing a June executive order that requires federal high-value systems to adopt PQC key establishment by 2030 and signatures by 2031.