Search the archive

traffic, and cut down alert noise. Get a free trial

IPHONE 17: THE END OF PWM FLICKERING?

Apple has introduced a "Display Pulse Smoothing" setting in iPhone 17 that addresses PWM flickering-induced eyestrain by enabling DC dimming as an alternative to pulse width modulation for OLED brightness control at low brightness levels below 25%.

LEGISLATION FOR EXTENDED DATA PRIVACY PROTECTION BLOCKED

A new privacy protection act, aiming to stop the sale of personal information and better shield Americans from stalking and violence, was blocked in the Senate by Ted Cruz.

DATA BREACH AT CANADIAN AIRLINE WESTJET AFFECTS 1.2M PASSENGERS

WestJet, Canada's second-largest airline, experienced a significant data breach exposing the personal information of 1.2 million passengers, including names, birth dates, addresses, and travel documents, in a cyberattack attributed to the Scattered Spider group, known for its social engineering tactics.

CISA SOUNDS ALARM ON CRITICAL SUDO FLAW ACTIVELY EXPLOITED IN LINUX AND UNIX SYSTEMS

CISA added CVE-2025-32463, a critical sudo vulnerability with a CVSS score of 9.3, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation in the wild. The flaw affects sudo versions before 1.9.17p1 and allows local attackers to leverage the --chroot option to execute arbitrary commands as root, even without sudoers file permissions. Federal agencies must patch by October 20, while organizations should immediately update sudo to version 1.9.17p1 or later to prevent privilege escalation attacks.

JAPAN'S LARGEST BREWER SUSPENDS OPERATIONS DUE TO CYBERATTACK

Asahi Group Holdings, Japan's leading brewery with $20 billion in revenue and holding a third of the market, experienced a cyberattack that disrupted ordering, shipping, call centers, and customer service. The incident, which began at 7 AM and impacted only Japan, did not result in confirmed data leaks, although investigations are ongoing, and no group has claimed responsibility. Companies should enhance their business continuity plans, adopt network segmentation, and develop incident response strategies to manage disruptions, including communication with customers and partners.

TILE'S LACK OF ENCRYPTION COULD MAKE TRACKER OWNERS VULNERABLE TO STALKING

Security flaws in Tile's tracking devices have raised concerns about user vulnerability. Researchers found that these devices lack proper encryption and fail to adequately rotate identification details, making them easily exploitable for stalking and tracking purposes. Despite noting recent improvements, Tile's approach falls short compared to other brands, as anti-theft features can be abused, and privacy remains at risk for users relying on the technology.

COHERENCE: INSIDER RISK STRATEGY'S NEW CORE PRINCIPLE

This article proposes "coherence" as a new foundational principle for insider risk management, arguing that traditional control and surveillance approaches fail because they don't address human alignment and organizational meaning. The author identifies "drift" - gradual detachment from purpose and clarity - as an early warning signal that precedes both malicious actions and human errors, manifesting through compliance without conviction, corporate messaging noise, and reduced employee initiative. Security professionals should focus on building semantic consistency in messaging, creating feedback channels to detect narrative drift, partnering cross-functionally to align organizational language, and treating coherence as operational infrastructure rather than just cultural enhancement.

ABUSING NOTION'S AI AGENT FOR DATA THEFT

Notion's AI agents are susceptible to prompt injection attacks exploiting Simon Willson's 'lethal trifecta'—access to private data, exposure to untrusted content, and external communication. Attackers can embed malicious instructions in PDFs with white text instructing AI to extract and exfiltrate confidential data through web searches to attacker-controlled URLs. Security professionals should evaluate AI deployments carefully, as current systems lack effective defenses against such attacks, and organizations should enforce strict data access and network controls for sensitive AI systems.

FIRST MALICIOUS MCP IN THE WILD: THE POSTMARK BACKDOOR THAT'S STEALING YOUR EMAILS

MCP servers, designed to help AI assistants automate tasks like sending emails, can pose significant security risks if abused. Recently, a popular npm package called postmark-mcp was discovered to be exfiltrating emails—including sensitive content like password resets and confidential memos—to a remote server controlled by its developer. The backdoor was introduced in a single line of code within an otherwise trustworthy tool, highlighting how quickly legitimate infrastructure can become compromised.

free.

SAFEHILL EMERGES FROM STEALTH WITH $2.6 MILLION PRE-SEED FUNDING

Chicago-based SafeHill (formerly Tacticly) emerged from stealth with $2.6 million in pre-seed funding, notable for having reformed LulzSec leader Hector Monsegur (aka Sabu) as chief research officer. The company offers SecureIQ, a continuous threat exposure management platform that combines AI-driven penetration testing with human validation to provide continuous asset discovery, automated threat assessments, and real-time monitoring. Security teams can leverage this hybrid approach for ongoing penetration testing, rather than conducting point-in-time traditional evaluations, with compliance mapping for frameworks such as PCI-DSS, CMMC, and ISO27001.

MALIFISCAN

MalifiScan is a security tool that identifies and blocks malicious packages before they compromise your software supply chain. It monitors vulnerability databases, such as OSV, for new malicious packages and scans your registries and repositories for existing threats. When used with platforms like JFrog Artifactory, it automates exclusion patterns to prevent future downloads of flagged packages, ensuring secure dependencies across development pipelines.

CODE PATHFINDER

Code Pathfinder, the open-source alternative to GitHub CodeQL, was built with GoLang. Built for advanced structural search, derive insights, and find vulnerabilities in code.

E-COMMERCE FRAUD-AS-A-SERVICE: HOW SCAMMERS EXPLOIT BRAND TRUST AT SCALE

Cybercriminals target e-commerce brands through three primary fraud-as-a-service operations: credential phishing via fake login pages promoted on Facebook and Instagram, fraudulent storefronts that offer fake deals to harvest payment data, and fake job campaigns for work-from-home scams. These attacks utilize Phishing-as-a-Service platforms that simplify the deployment of sophisticated scams, even for non-technical actors, targeting mobile users to evade detection. Organizations should monitor their brand with Google Alerts, educate customers about official sites, deploy Digital Risk Protection tools to detect phishing setups, and establish rapid response procedures for takedown requests and evidence collection.

'TRIFECTA' OF GEMINI FLAWS TURN AI INTO ATTACK VEHICLE

Google's Gemini AI suite had three critical flaws: Search Personalization enabled injection and data leaks via Chrome history, Cloud Assist allowed prompt manipulation through raw logs, and the Browsing Tool exposed saved data through a side channel. All vulnerabilities could be exploited for data exfiltration. Google has now fixed them.

SVG PHISHING HITS UKRAINE WITH AMATERA STEALER, PUREMINER

A phishing campaign targeting Ukrainian organizations has emerged using emails disguised as official notices from the country's police. These emails contain SVG attachments that trigger fileless attacks when opened, deploying malware including Amatera Stealer and PureMiner. The SVG initiates a download chain using password-protected files that ultimately execute malicious code via in-memory, process-hollowing techniques. The Amatera Stealer collects sensitive information and credentials, while PureMiner hijacks victim resources for cryptocurrency mining. Both can then install additional malware.

See the vibe!

TWO-THIRDS OF CISA PERSONNEL COULD BE SENT HOME UNDER SHUTDOWN

If the government shuts down, about two-thirds of workers at the Cybersecurity and Infrastructure Security Agency (CISA) could be sent home.

UK GOVERNMENT BAILS OUT JAGUAR LAND ROVER WITH £1.5B LOAN AFTER HACK DISRUPTS VEHICLE PRODUCTION FOR WEEKS

After a major cyberattack halted Jaguar Land Rover's production, the UK government stepped in with a £1.5 billion loan guarantee to stabilize the company and its vast supply chain.

INTERPOL OPERATION DISRUPTS ROMANCE SCAM AND SEXTORTION NETWORKS IN AFRICA

Interpol's Operation Contender 3.0 arrested 260 cybercrime suspects across 14 African countries in a coordinated crackdown targeting romance scam and sextortion networks that caused $2.8 million in losses to nearly 1,500 victims.

ThreatLocker DAC

CYBERATTACK ON CO-OP LEAVES SHELVES EMPTY, DATA STOLEN, AND $275M IN LOST REVENUE

The DragonForce cybercrime group's April attack on UK retailer Co-op resulted in $275 million in lost revenue, weeks of empty shelves, and the theft of data from 6.5 million members, including names, contact details, and dates of birth (though passwords and payment information were not compromised). Co-op initially claimed no customer data was affected, but later confirmed the breach after hackers contacted executives via Microsoft Teams and phone, claiming to possess data on 20 million membership scheme participants. In July, the UK's National Crime Agency arrested four suspects aged 17-20 in London and the West Midlands on charges including Computer Misuse Act offenses, blackmail, money laundering, and organized crime participation, with DragonForce also claiming responsibility for attacks on M&S and an attempted breach of Harrods.

MICROSOFT UNCOVERS NEW VARIANT OF XCSSET MACOS MALWARE IN TARGETED ATTACKS

Microsoft has discovered a new XCSSET macOS malware variant being used in targeted attacks. It builds on the 2020 threat with advanced features, including stealing Firefox credentials via a modified HackBrowserData, hijacking cryptocurrency clipboard addresses using regular expressions, and increasing persistence through LaunchDaemon entries with AppleScripts and AES-encrypted C2 configurations. The four-stage infection chain uses modular payloads for info theft (vexyeqj/bnk), file exfiltration (neq_cdyd_ilvcmwx), persistence (xmyyeqjx creates fake System Settings apps and disables updates), and browser data extraction (iewmilh_cdyd targets passwords, cookies, and credit cards in Firefox). Security teams should review Xcode projects before use, deploy Microsoft Defender on macOS with cloud protection and PUA blocking, verify clipboard content before pasting sensitive information, and monitor for malicious LaunchDaemon entries (e.g., com.google.plists) and unusual creation of the ~/.root folder.

HACKERS CONTACT HARRODS AFTER 430K CUSTOMER RECORDS HIT BY IT BREACH

Luxury department store Harrods was approached by attackers who stole 430,000 customer records. The compromised data contains only basic personal details like names and contact information, along with marketing information such as loyalty card data. Importantly, it does not include passwords or financial information. Harrods has announced that it will not pay the ransom.

APT35 PLAYS THE SAME MUSIC AGAIN

Stormshield's CTI team discovered two previously unreported servers (84.200.193[.]20 and 79.132.131[.]184) linked to Iranian APT35 (Charming Kitten) by hunting for a distinctive HTML loading page pattern using ssdeep fuzzy hashing and queries in SilentPush and VirusTotal. The servers, active since July, host 49+ phishing domains impersonating video conferencing services, such as Google Meet, with typosquatting tactics (e.g., meet.go0gle[.]online), primarily targeting Israeli victims based on URL submission patterns. Defenders can track ongoing APT35 infrastructure using simple VirusTotal queries, such as "entity:url url:online/?invitation" or "entity:domain domain:viliam.*", to identify phishing domains that follow consistent naming conventions despite the campaign being publicly documented.

SILENT PUSH EXAMINES THE DARK SIDE OF DYNAMIC DNS PROVIDERS

Silent Push identified around 70,000 domains offering rentable subdomains (Dynamic DNS providers) exploited by threat actors due to minimal oversight, cryptocurrency payments, no KYC, and ignoring takedown requests. Major APT groups like APT28, APT29, APT33, Gamaredon, and Scattered Spider extensively use these for C2 infrastructure. While individual malicious subdomains can be blocklisted, parent domains often remain active and spawn new threats. The team created data exports (from the Public Suffix List, afraid[.]org, DuckDNS, NoIP) to help security teams implement risk-based blocking or alerting, balancing security with avoiding disruption to legitimate access.

BUILDING AN AWS GUARDDUTY ALERT TRIAGE AGENT

This article explores how to create a GuardDuty triage agent using PydanticAI and Discord. A user can call the agent using !triage in a Discord channel, and it will investigate a specific alert, IAM user, etc, and provide additional context as well as a verdict. The author was impressed with how well the LLM could triage alerts, but definitely felt that there was a lot of engineering effort in creating the tools and fine-tuning the agent.

you can stay secure. Read the eBook by Dell and Intel

AIDR BASTION

AIDR Bastion is an open-source GenAI security system that defends against malicious prompts using five detection methods: regex, vector similarity, static analysis, ML classification, and LLM analysis. It supports standard and custom rules, integrating with SigmaHQ, SOC Prime, and mapping to MITRE ATLAS and OWASP Top 10, enabling configurable blocking, notifications, and logging. Built on FastAPI, it offers real-time protection and attack diagnostics, with tools for converting rules for enhanced detection.

ENUMEDR

EnumEDR is a tool that enumerates EDRs running on a system by enumerating current processes and loaded drivers.

HOUND

Hound is a language-agnostic AI code auditor that autonomously builds and refines adaptive knowledge graphs for deep, interactive code reasoning.

HARDENING GOOGLE CLOUD: INSIGHTS FROM THE LATEST CLOUD VRP BUGSWAT

Google Cloud's record-breaking bugSWAT event brought together 20 elite security researchers who submitted 130 reports, uncovering 91 vulnerabilities across the platform. The event resulted in approximately $1.6 million in bounty rewards (with 100% bonuses applied), pushing Google's total Cloud VRP payouts to ~$2.5M for 2025. High-severity findings included a network egress filter bypass that enabled SSRF attacks and SQL injection vulnerabilities in database connectors, both of which have now been patched.

DOD ISSUES REPLACEMENT FOR RISK MANAGEMENT FRAMEWORK

The Department of Defense (DoD) unveiled a new Cybersecurity Risk Management Construct to replace its previous risk management system. The new system defines a five-phased lifecycle which includes: a design phase which incorporates security from the outset, a build phase where secure designs are implemented to achieve Initial Operating Capacity, a test phase where validation and stress testing are performed before Full Operating Capacity, an onboarding phase where automated continuous monitoring is activated, and finally an operations phase where real-time dashboards and alerting mechanisms provide immediate detection and response.

MICROSOFT FORCED TO MAKE WINDOWS 10 EXTENDED SECURITY UPDATES TRULY FREE IN EUROPE

Windows 10 will reach end-of-life on October 14. Microsoft had previously announced that users who enabled Windows Backup would be entitled to a year of free extended security updates. This move drew some controversy due to its requiring the use of OneDrive to receive security updates. Following pressure from the Euroconsumers consumer advocacy group, Microsoft has dropped the Windows Backup requirement for European users, but will still require the use of a Microsoft account.

business and compliance impact. GET A DEMO →

DATACENTER FIRE TAKES 647 SOUTH KOREAN GOVERNMENT SERVICES OFFLINE

The fire at South Korea's National Information Resources Service datacenter was sparked by a lithium-ion battery replacement gone wrong.

MICROSOFT EDGE TO BLOCK MALICIOUS SIDELOADED EXTENSIONS

Microsoft Edge will introduce malware detection in November to automatically identify and revoke malicious sideloaded extensions installed via Developer Mode.

UK CONVICTS "BITCOIN QUEEN" IN WORLD'S LARGEST CRYPTOCURRENCY SEIZURE

The UK Metropolitan Police secured a conviction against Zhimin Qian, also known as "Bitcoin Queen," for a multibillion-pound Bitcoin fraud scheme that defrauded 128,000 Chinese investors between 2014 and 2017 by promising 100 to 300 percent returns.

CHILDREN'S NAMES, PICTURES, AND ADDRESSES STOLEN IN NURSERY CHAIN HACK

A new ransomware gang called Radiant has hacked a chain of nurseries called Kido and stolen the data of 8,000 children. The breached data includes names, pictures, and addresses. The criminals contacted the BBC directly and stated that they hadn't asked for a high ransom and viewed it as compensation for performing a pentest, even though no pentest was authorized.

SCREENCONNECT SUPER ADMIN CREDENTIAL HARVESTING

Mimecast is reporting on a low-volume spear-phishing campaign that has been active since 2022, targeting super admins of ScreenConnect instances. The attackers send an email warning admins of a new login attempt and prompting them to review it, and if they click through, it directs the admins to an EvilGnix phishing page that harvests their credentials. The attackers use the access to deploy compromised clients and ransomware.

GOOGLE ADS USED TO SPREAD TROJAN DISGUISED AS TRADINGVIEW PREMIUM

A malicious advertising campaign offering "free access" to TradingView Premium has expanded from Facebook to Google Ads and YouTube, using over 500 website addresses and hijacking verified business accounts to spread the Trojan.Agent.GOSL spyware. The scammers take control of legitimate YouTube channels, delete the original content, and rebrand them to mimic the official TradingView page, using unlisted videos and paid advertising to avoid detection. The malware is designed to steal sensitive information, including passwords, personal data, and cryptocurrency wallet details. One fake video gathered over 182,000 views in just a few days.

TAMING 2,500 COMPILER WARNINGS WITH CODEQL, AN OPENVPN2 CASE STUDY

Trail of Bits created a sophisticated CodeQL query to analyze 2,500 implicit integer conversion warnings in OpenVPN2, filtering them down to 20 security insights through iterative methods, including range analysis, and focusing on user-controlled inputs. Its five-step approach combined compiler warnings with static analysis techniques such as taint tracking and function modeling to differentiate between safe conversions and potential vulnerabilities. Although most conversions were safe, its team concluded that specialized analysis is necessary to identify risky cases. They did not find any exploitable vulnerabilities but did produce a reusable query for C codebases.