Search the archive

Watch the webinar now.

MAJOR EUROPEAN HEALTHCARE NETWORK DISCLOSES SECURITY BREACH

AMEOS Group, an operator of a Central European healthcare network, suffered a security breach that may have exposed customer, employee, and partner information. In response to the breach, AMEOS has shut down all IT systems and terminated all external and internal network connections while it responds to the incident. AMEOS has stated that it doesn't currently have evidence of any data being leaked, but it is continuing to investigate.

3.5M RECORDS EXPOSED IN AUSTRALIAN GLOBAL FASHION BRAND DATA BREACH

Jeremiah Fowler discovered an unprotected, unencrypted, and publicly exposed database containing over 3.5 million PDFs belonging to the Australian fashion brand SABO. The files contain PII, including names, physical addresses, email addresses, phone numbers, and other personal information corresponding to retail and corporate customers. Some of the PDFs contain multiple orders, suggesting that the number of affected individuals may be higher than 3.5 million.

US NUCLEAR WEAPONS AGENCY REPORTEDLY BREACHED IN MICROSOFT SHAREPOINT ATTACKS

Chinese government-affiliated hackers exploited a Microsoft SharePoint vulnerability affecting 50+ organizations, including the National Nuclear Security Administration. The zero-day flaw enables remote access to on-premises SharePoint versions, allowing attackers to steal documents and sensitive information.

MYTHIC C2 WITH EARLYBIRD INJECTION AND DEFENDER EVASION

This post walks through a demo setup of the Mythic C2 framework that uses redirectors to disguise itself as legitimate WordPress traffic. The redirectors use a legitimately registered domain and certificates and use Nginx to offer WordPress as a front end, as well as an api subdomain that forwards traffic to the C2 server and a dl subdomain that disguises payloads as font files. The setup also utilizes the EarlyBird Injection technique, where the loader executes code before the target process is fully initialized, both in its loader and through string obfuscation to employ evasion during installation. The post concludes with a discussion of further enhancements, such as ensuring domain age before weaponizing it and detection mechanisms for this setup.

WHAT TO KNOW ABOUT TOOLSHELL, THE SHAREPOINT THREAT UNDER MASS EXPLOITATION

A critical SharePoint vulnerability (CVE-2025-53770), dubbed "ToolShell," is being mass-exploited by Chinese government groups, affecting over 400 systems, including the US National Nuclear Security Administration. The flaw allows unauthenticated remote code execution, credential theft, and data exfiltration. Microsoft patched it on Saturday, but it is being exploited on any company that has not updated their SharePoint.

CHOOSING THE VPN THAT'S RIGHT FOR YOU

VPNs mainly serve two purposes: bypassing internet censorship and remote access to corporate networks, despite being marketed as security tools. They hide your IP and encrypt traffic, but don't ensure anonymity (Tor is better), don't fully secure public Wi-Fi (most traffic is HTTPS), and shift data from your ISP to the VPN provider. When choosing one, review the provider's business model, data practices, encryption protocols (prefer OpenVPN or WireGuard), and verify claims through third-party audits.

Register now and discover how to safeguard every M&A stage.

GOLEM

golem automates C/C++ vulnerability scans by combining Semgrep rule scans, LLVM call-graph and CFG slicing, and AI-driven context analysis to flag potential security issues, generate graph artifacts, and produce a detailed, prioritized audit report.

FARADAY

Faraday is an open-source vulnerability management platform designed to centralize vulnerability data and automate scanners.

LUMO AI (PRODUCT LAUNCH)

Proton's Lumo AI uses open-source models, zero-access encryption, and doesn't train on user data, emphasizing privacy-focused development.

CLOROX ACCUSES IT PROVIDER IN LAWSUIT OF GIVING HACKERS EMPLOYEE PASSWORDS

Clorox sued Cognizant over a 2023 cyberattack by Scattered Spider hackers, claiming that Cognizant staff had given away employee passwords when asked by phone without proper verification. The breach caused $380 million in damages. Cognizant disputes responsibility, saying it only provided limited help desk services, not cybersecurity management.

UK TO BAN RANSOMWARE PAYMENTS BY PUBLIC SECTOR ORGANIZATIONS

The UK government proposes banning public sector organizations (NHS, councils, and schools) and critical infrastructure from paying ransomware criminals, aiming to make them less attractive targets. The Cyber Resilience Bill will impose daily fines of £100,000 for security failures. Private companies must still report their intentions to pay ransoms to authorities.

CHINA INTRODUCES NATIONAL CYBER ID AMID PRIVACY CONCERNS

China has launched a voluntary national online ID service aimed at centralizing citizen identity verification and reducing the collection of private company data. While officials claim it enhances privacy, critics argue that it strengthens government surveillance capabilities, as authorities can revoke digital certificates and effectively erase users' entire online presence.

👉 Register now

GENEA IVF CONFIRMS SENSITIVE PATIENT HEALTH INFORMATION ON DARK WEB

Australian IVF giant Genea has confirmed that, following a February data breach, stolen patient health information was posted on the dark web.

BRAVE BLOCKS WINDOWS RECALL FROM SCREENSHOTTING YOUR BROWSING ACTIVITY

Brave Browser will block Windows Recall from screenshotting browsing activity by default using Microsoft's SetInputScope API with the IS_PRIVATE scope, joining Signal in proactively preventing the controversial feature from capturing sensitive user data.

TRUMP AI PLAN PUSHES CRITICAL INFRASTRUCTURE TO USE AI FOR CYBER DEFENSE

Trump's new AI Action Plan encourages critical infrastructure to adopt AI for cyber defense while acknowledging the vulnerabilities of AI systems, but offers no new funding and adopts a deregulatory approach that critics say prioritizes innovation over safety.

EXPRESSVPN BUG LEAKED USER IPS IN REMOTE DESKTOP SESSIONS

A security researcher reported a vulnerability in ExpressVPN's Windows client that caused Remote Desktop Protocol (RDP) traffic to bypass the VPN, which could lead to exposing the user's IP. ExpressVPN patched the bug, confirmed that it only impacted RDP traffic, and stated that it was introduced by debug code that was accidentally included in production builds.

HONG KONG INVESTIGATES LOUIS VUITTON DATA LEAK AFFECTING 419K CUSTOMERS

Hong Kong's privacy watchdog announced that it is investigating a data leak affecting 419,000 customers of the Hong Kong branch of Louis Vuitton. The leaked data may have included names, phone numbers, passport details, addresses, email addresses, shopping history, and product preferences, but did not include payment information.

COYOTE TROJAN FIRST TO USE MICROSOFT UI AUTOMATION IN BANK ATTACKS

The Coyote banking Trojan is notable for being the first malware to utilize Microsoft's UI Automation (UIA) framework, transitioning from a proof-of-concept to actively targeting Brazilian banking and cryptocurrency users. It exploits UIA to steal credentials from browsers and can manipulate UI elements, such as address bars, to redirect victims to phishing sites, thereby complicating detection efforts. Akamai recommends monitoring for the presence of UIAutomationCore.dll in unknown processes and scanning for interactions with UIA named pipes as early indicators of infection.

THE CYBER DECEPTION MATURITY MODEL: WHERE DOES YOUR ORGANIZATION STAND?

This post divides cyber deception into 5 levels: pre-deception, where an organization does not employ cyber deception; experimental, where an organization deploys simple deception that only succeeds at catching automated scanners; operational, where an organization can catch human threats; strategic, where an organization's deception resources mimic authentic resources and mimic high-value targets; and optimized, where deception goes beyond detection and shapes adversary behavior. Each level includes key metrics to track as well as steps to advance to the next level.

CLOUD LOGGING FOR SECURITY AND BEYOND

This is a guide on cloud logging best practices for AWS, Azure, and Google Cloud. It emphasizes the importance of balancing security, compliance, and cost when selecting logging strategies. The guide distinguishes between control plane logging (default for management) and data plane logging (which requires manual activation for service activities), categorizing logs into audit, compute, network, secrets, storage, database, and Kubernetes types. Organizations should prioritize logging based on business, regulatory, and security needs, avoiding the costly "log everything" approach.

COMMON MISTAKES IN USING CVSS

Don't rely solely on CVSS scores for prioritizing vulnerabilities, as only 17% of critical ones are exploited, while attackers target lower scores. Organizations should implement Risk-Based Vulnerability Management (RBVM) that includes threat intelligence, asset importance, business context, and metrics like EPSS. Research shows EPSS prioritization targets 3% of vulnerabilities with 65% effectiveness, unlike CVSS, which requires 57% coverage for similar results, with only 4% effectiveness.

control. Get an exclusive preview and join the waitlist.

JSON CRACK

JSON Crack is a visualization application that transforms various data formats (JSON, CSV, XML, etc) into interactive graphs.

FLOWABLE'S SUMMER 2025 UPDATE INTRODUCES GROUNDBREAKING AGENTIC AI CAPABILITIES

Flowable released version 2025.1 on July 22 with AI capabilities, including four agent types: Utility, Document, Knowledge, and Orchestrator. It now supports integrations with AWS Bedrock, Azure Foundry, and Salesforce Agentforce, and features dynamic autonomy for agents switching between AI help and deterministic workflows based on task complexity. The enterprise 'AI button' enables real-time summaries, automated customer communication, and autonomous task completion.

WAF DETECTOR

WAF Detector is a fast Rust tool that detects and tests web firewalls and CDNs. It works with CloudFlare, AWS WAF, Akamai, Fastly, and Vercel.

RING DENIES BREACH AFTER USERS REPORT SUSPICIOUS LOGINS

Many Ring users reported suspicious login activity on their devices on May 28, raising concerns of a hack. Last week, Ring clarified on its Facebook page that a bug caused all previous logins to appear as if they occurred on May 28. However, some users remain doubtful, noting login attempts from unfamiliar countries and devices.

WINDOWS 11 GETS NEW BLACK SCREEN OF DEATH, AUTO RECOVERY TOOL

As part of Microsoft's Windows Resiliency Effort, it updated the Blue Screen of Death (BSOD) to a black screen showing only the stop code and fault info for easier troubleshooting. The company also announced a Quick Machine Recovery feature that checks Windows Update for fixes when a boot issue occurs.

CONTRACT LAPSE LEAVES CRITICAL INFRASTRUCTURE CYBERSECURITY SENSOR DATA UNANALYZED AT NATIONAL LAB

Critical infrastructure cybersecurity sensor data remains unanalyzed after the DHS contract with Lawrence Livermore National Laboratory ended this weekend, leaving the CyberSentry program unfunded. The program monitors threats in operational technology networks at power plants and factories, but the lab can't process the data without government funds. This occurs amid broader Trump administration budget cuts to CISA and expired threat hunting contracts.

MICROSOFT SHAREPOINT TOOLSHELL ATTACKS LINKED TO CHINESE HACKERS

Chinese government-linked hackers exploited a Microsoft SharePoint zero-day vulnerability chain dubbed "ToolShell" to breach at least 54 organizations worldwide, prompting Microsoft to release emergency patches and CISA to add the flaw to its Known Exploited Vulnerability catalog.

DELL SAYS DATA LEAKED BY HACKERS IS FAKE

Dell got hit by the WorldLeaks ransomware group and leaked 1.3TB of data, but it claims it's mostly fake demo data from an isolated testing environment, not real customer info.

CISCO: MAXIMUM-SEVERITY ISE RCE FLAWS NOW EXPLOITED IN ATTACKS

Three critical unauthenticated RCE vulnerabilities in Cisco ISE (CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337) are now being actively exploited in the wild, requiring immediate patching to ISE 3.3 Patch 7 or 3.4 Patch 2.

Watch now →

WATCH OUT, ANOTHER MAX-SEVERITY, MAKE-ME-ROOT CISCO BUG ON THE LOOSE

Cisco patched a critical 10/10 severity bug (CVE-2025-20337) in its Identity Services Engine. The bug allowed unauthenticated remote attackers to execute arbitrary code with root privileges. Due to insufficient input validation, the vulnerability affects ISE releases 3.3 and 3.4. No workarounds exist. Immediate patching is essential, as exploits are expected soon.

UAP CONFIRMS RANSOMWARE ATTACK, PERSONAL DATA AND EMAIL CORRESPONDENCE EXPOSED

Clive Palmer's United Australia Party (UAP) posted a notice on its website that it suffered a data breach due to a ransomware attack. The party has stated that any individual who has interacted with the party may have had their data exposed, but it cannot conclusively determine which individuals were affected or what data was stolen. The stolen data may include email addresses, phone numbers, identity records, banking records, employment history, and any emails or attachments sent to or received from the party.

NEW TELEMESSAGE SGNL FLAW IS ACTIVELY BEING EXPLOITED BY ATTACKERS

TeleMessage SGNL, a Signal clone used by US government agencies, has an exposed /heapdump endpoint (CVE-2025-48927) that dumps 150MB memory snapshots containing usernames, passwords, and session data with no authentication required. Attackers are actively exploiting this flaw - CISA added it to the KEV catalog on July 14 and mandated federal agencies patch or stop using the software by July 22. Over 11 IPs have directly targeted this vulnerability, while 2,000+ IPs have scanned Spring Boot Actuator endpoints in the past 90 days, indicating widespread reconnaissance activity.

THE LINUXSYS CRYPTOMINER

This post dives into Linuxsys, a cryptominer exploiting CVE-2021-41773 in a long-running campaign since 2021. Attackers use compromised legitimate websites for stealthy malware distribution and evasion, and the vulnerability remains actively exploited with dozens of daily attempts.

WHY IS PREVENTATIVE SECURITY SO DIFFICULT?

Security teams should shift from endless vulnerability scanning and detection to preventative tools that stop issues at the source, like using supply chain security tools instead of just identifying vulnerabilities after deployment. Most security vendors focus on data collection and pattern detection rather than systemic prevention, leaving organizations to fix the identified problems manually. The strategy requires getting engineering teams to adopt preventative controls early in development workflows, rather than overwhelming them with vulnerability reports and SLAs that force reactive responses.

AUTOMATED FUNCTION ID DATABASE GENERATION IN GHIDRA ON WINDOWS

This post demonstrates how to automate function identification in stripped Windows binaries using Ghidra's Function ID databases, which work similarly to IDA Pro's FLIRT signatures to match known library functions against decompiled code. The approach involves extracting object files from static libraries (.lib files), importing them into Ghidra projects, and generating function signature databases that automatically rename generic function labels with actual library function names like OpenSSL functions. This technique significantly accelerates reverse engineering by eliminating manual function analysis, allowing security researchers to focus on vulnerability discovery rather than spending time identifying what each function does.

DOTENVX

Powered up dotenv that reduces the blast radius of secrets by splitting secrets management into two distinct components: an encrypted secrets file and a separate decryption key.

ICOUNTER (PRODUCT LAUNCH)

The iCOUNTER platform can act as an early warning system that identifies threats specific to the customer and its ecosystem, while also providing intelligence that enables rapid containment and recovery after an attack has taken place.

LINWINPWN

linWinPwn is a bash script that wraps a collection of Active Directory tools for enumeration, vulnerability checks, object modifications, and password dumping.

GOOGLE FINDS CUSTOM BACKDOOR BEING INSTALLED ON SONICWALL NETWORK DEVICES

Hackers (UNC6148) are compromising end-of-life SonicWall Secure Mobile Access appliances using leaked administrator credentials. The attackers install "Overstep" backdoor malware that deletes log entries, hindering forensic investigation, which means the attack method and vulnerabilities exploited remain unknown.