Cross-Site WebSocket Hijacking is a vulnerability that arises from WebSockets being unprotected by the Same Origin Policy, allowing malicious sites to connect to targeted sites impersonating the user. Modern browsers have implemented security features that make CSWSH harder to exploit, such as Chrome's SameSite=Lax default cookie and Firefox's Total Cookie Protection. However, proper Origin validation during the server-side WebSocket handshake is the most reliable defense, as browser settings can change, and Chrome still permits CSWSH under certain conditions.
This post shows how to use AI to create a timeline of the April 2025 Marks & Spencer cybersecurity incident, which impacted contactless payments and click-and-collect services, ultimately escalating to a suspension of online orders by April 25. The timeline details the progression from initial reports on April 19th to April 26th, documenting customer experiences, official communications, and media coverage with timestamps. Although M&S has not confirmed the nature of the attack, the company's response involved taking processes offline and consulting cybersecurity experts, causing operational disruptions across over 1,000 stores and a temporary 5% drop in their share price.
ARMO researchers exposed a critical security gap where Linux runtime security tools fail to detect malware using the io_uring interface. Their proof-of-concept rootkit, "Curing," bypasses traditional system call monitoring, affecting tools such as Falco and Microsoft Defender. While some vendors have implemented fixes, most security solutions remain vulnerable to this evasion technique.
With Drata, GRC is a growth enabler. Automate governance, risk and compliance with access to 25+ frameworks & 300+ integrations. Eliminate manual security reviews and speed up vendor assessments. Build trust faster with real-time monitoring and AI-powered automation. Join leading companies like Superhuman, Notion and Kandji, who have transformed their GRC programs with Drata: schedule a live demo today [12].
Cloud Snitch is a tool inspired by Little Snitch for macOS that visualizes AWS account activity with a focus on security and exploration. It's able to map activities, filter by AWS region, principal, IP addresses, etc, and also highlight any errors in prominent colors so that issues can be surfaced more easily.
Jericho enables organizations to run AI Agent-based, hyper-realistic, personalized attack simulations to train employees to identify real-world threats, track their progress, and escalate difficulty and rewards based on completion.
North Korean APT Lazarus targeted six South Korean organizations in finance, IT, semiconductors, software, and telecommunications through Operation SyncHole. They employed watering hole attacks and exploited zero-day vulnerabilities in security software, targeting Cross EX and Innorix Agent for online banking and government sites. The attack utilized malware such as ThreatNeedle, wAgent, SignBT, and CopperHedge for reconnaissance and access maintenance, while Lazarus further developed tools to evade detection.
The anti-piracy campaign "You Wouldn't Steal a Car" appears to have used XBand Rough, a knockoff of the FF Confidential font. This ironic discovery highlights the complex nature of typeface copyright law, where typeface designs have limited protection but font files can be copyrighted as software.
In coordination with US authorities and third parties, Okta has tracked the behaviors and usage of GenAI by DPRK workers. Okta found that North Korean workers are utilizing GenAI tools at all stages in the process, from drafting resumes, to deepfake interviews, and even utilizing GenAI to maintain multiple jobs at the same time.
The FBI is seeking help to identify the Chinese Salt Typhoon hackers who breached U.S. and global telecom providers, accessing the private communications of government officials.
Yale New Haven Health System reported a major data breach affecting 5.5 million patients following a March 8 hack. Compromised information may include names, addresses, Social Security numbers, and medical record numbers. The health system has offered credit monitoring services and faces multiple lawsuits alleging negligence in data protection.
Blue Shield reported a data breach affecting 4.7 million members due to a misconfiguration of Google Analytics between April 2021 and January 2024. Protected health information, including insurance details, medical claims, and patient information, was inadvertently shared with Google Ads, though no Social Security numbers were exposed. Blue Shield has since implemented safeguards to prevent similar incidents from occurring.
Figma's security team developed an endpoint security strategy that emphasizes device quarantine, allowlisting, and access controls for improved usability and security. They implemented the Endpoint Security Baseline (ESB) using OSQuery to identify security risks, placing devices in quarantine if threats are detected until they can be resolved. Figma also deployed Santa for application allowlisting and Opal for just-in-time access to SaaS applications.
AWS Private CA is a service that allows an organization to issue certificates via ACM without the need for a public certificate, which may disclose sensitive services. However, certificates generated via the console default to a 13-month validity period. In contrast, certificates generated using the SDK or CLI are more flexible, but they do not include certificate expiration notices. The solution in this post leverages Lambda functions to periodically generate a report of certificates and notify via email and Security Hub of any certificates that are expiring within 30 days.
Runtime reachability enables security teams to prioritize vulnerabilities that require immediate attention. It includes network reachability, package-loaded reachability, and function execution reachability. Package-loaded reachability may prioritize false positives, while network reachability might de-prioritize vulnerabilities in non-internet-accessible systems. Function execution reachability is the most robust but requires a (C)ADR.
Augur scours the internet to identify early signs of malicious intent (e.g., infrastructure setup), profiles attacker behavior, and creates blocklists to protect customers' environments.
Vex2pdf converts CycloneDX JSON docs to PDF reports. It was designed to work with VEX reports but can also generate PDFs for standard Bill of Materials (BoMs).
The privacy group noyb filed a GDPR complaint against Ubisoft in Austria for requiring online connections for single-player games, specifically Far Cry Primal. Its investigation revealed data being transmitted to Google, Amazon, and Datadog servers. noyb seeks penalties of up to €92 million and plans to target other gaming companies with similar practices.
Microsoft's Secure Future Initiative progress report highlights significant security improvements, with 92% of employees using phishing-resistant multifactor authentication. The company has prioritized security across all operations, standardized development pipelines, and created a UX Toolkit to reduce user-targeted attacks. This overhaul follows criticism of Microsoft's security culture after the Storm-0558 breach in 2023.
According to Verizon's 2025 Data Breach Incident Report, the company observed a 47% increase in the rate of ransomware detected in data breaches. Verizon has observed a decrease in the average payout and the percentage of organizations that paid ransoms, but also noted that small-to-medium-sized businesses were particularly hard hit. It also stated that exploited vulnerabilities, serving as an initial access vector for breaches, surged over the past year, primarily due to attackers exploiting zero-day exploits in edge devices and VPNs.
Microsoft is offering up to $30,000 for finding Critical or Important AI vulnerabilities, as defined by the Microsoft Vulnerability Severity Classification for AI Systems, reproducible on a product or service listed in the In Scope Services and Products.
SessionShark is a phishing kit that facilitates the theft of Office 365 credentials by circumventing multi-factor authentication through deceptive login pages and real-time notifications via Telegram.
Abilene, Texas, suffered a cyberattack that caused server outages. Officials disconnected affected systems and hired cybersecurity experts. Emergency services remain operational, while card payment systems at government offices are currently unavailable. A complete recovery is expected to take several weeks.
SK Telecom detected a malware attack targeting customer USIM data in mid-April. The company quickly isolated affected systems, notified authorities, and implemented security measures to prevent USIM swaps and suspicious authentication attempts. No data has appeared on the dark web, and no group has claimed responsibility for the incident.
Google has fixed a privilege escalation vulnerability impacting the Cloud Composer 2 managed workflow orchestration service. Cloud Composer allows any user with edit permissions to install a package from PyPi, which is then installed by Cloud Build. Prior to this fix, Cloud Build used the highly privileged default Cloud Build service account. An attacker could install a malicious PyPi package that exfiltrates the sensitive Cloud Build credentials.
Security researcher Sharon Brizinov earned $64,000 by discovering secrets in deleted GitHub repository files. His research highlighted how Git retains copies of all files in its commit history, even after they are deleted from the working directory. Completely removing sensitive files requires specific tools, such as git filter-branch or git-filter-repo, as Git maintains references in its object storage for several weeks before performing garbage collection.
MCPs offer a standardized way for LLMs to interact with various tools, which can significantly aid SecOps teams in leveraging disparate security tools for investigations. AI Agents can currently perform specialized automations to complete tasks that require minimal human intervention, whereas MCPs can facilitate flexible workflows guided by humans. In the future, we may see vendors create more MCPs for their tooling, as well as a convergence between agents and MCPs.
Attackers can exploit AWS CodeBuild and GitHub for persistent access after compromising an AWS account. They can modify an IAM role's trust policy to allow CodeBuild to assume it, link CodeBuild to an attacker-controlled GitHub repository, and create GitHub Actions workflows that execute commands using the permissions of the assumed role. This technique is more discreet than creating new IAM users with admin privileges, as the activity appears as legitimate CodeBuild operations from AWS infrastructure IPs, not external ones.
Terra uses AI agents for continuous web app pen testing tailored for an organization's environment and that adapts in real-time and autonomously runs tests when new vulnerabilities are discovered.
Bugfish-nuke is a Windows tool for emergency privacy that instantly deletes sensitive data and active logins to protect information during unexpected searches or warrantless seizures.
Google has abandoned plans to replace third-party cookies with its Privacy Sandbox initiative after years of development struggles. Initially proposed in 2019, the company's alternatives, like FLoC and Topics API, faced criticism and delays. Google will now maintain cookie support indefinitely while continuing to develop privacy features for Incognito.
North Korean hackers are targeting cryptocurrency organizations to generate funds amid international sanctions. Google's Mandiant identified multiple threat groups using custom malware tools across Windows, Linux, and macOS to infiltrate Web3 companies and steal large amounts of TRON.
AI red teaming company SplxAI chose to publish its own testing after OpenAI failed to publish a safety report for GPT-4.1 as it did for 4.0. SplxAI used the same prompts from its 4.0 testing to simulate a financial advisor and evaluate its safety in 11 categories across 1,000 simulated tests. GPT-4.1 performed 3x worse than GPT-4.0. Following OpenAI's guidance that 4.1 may require more explicit prompting, the SplxAI team developed a 1,400-word prompt over 5 hours of iterating that performed better than their initial prompt.
Healthcare organizations in the US, including AOA, DaVita, and Bell Ambulance, were hit by ransomware attacks in 2025, affecting over 245,000 individuals and compromising sensitive patient data.
Russian hackers are employing social engineering tactics, including impersonation and the use of messaging apps, to access Microsoft 365 accounts belonging to individuals and organizations associated with Ukraine.
With servers scattered across on-prem datacenters, various clouds, and who-knows-where-else, the old "castle-and-moat" approach needs a serious refresh.