A new flaw in ServiceNow, named Count(er) Strike, allows users to view restricted data by counting records without full access. It was identified by Varonis Threat Labs in February under CVE-2025-3648. The vulnerability is particularly relevant for configurations with misconfigured or overly permissive ACLs. While ServiceNow introduced new access control frameworks in the latest versions, administrators are advised to review their tables to ensure data security.
This post demonstrates how to utilize AWS IAM Access Analyzer to audit external access, followed by further fine-tuning with Last Access Data to identify unused permissions. Policies can then be refined by using CloudTrail to view the actual API calls made by a role and feeding those into the IAM Policy Simulator to determine the minimum required permissions. Least privilege reviews can be automated using Lambda, and real-time detection can be enabled using CloudTrail with EventBridge.
Fog Security conducted a comprehensive investigation to identify all the various AWS ARN formats and discovered nearly 2,000 different ARNs supported by AWS IAM. While most ARNs follow a standard format of `arn:partition:service:region:account-id:resource-id`, some omit the account-id, some require a namespace, and there are other inconsistencies and duplication. Fog released a searchable listing of all ARNs as well as JSONs of all ARN formats and all service prefixes.
This research reveals a 20-year-old NTFS vulnerability (CVE-2025-49689) that can be exploited via crafted Virtual Hard Disk (VHD) files, causing an integer overflow during mounting. Malicious VHDs bypass Log File Service (LFS) validation, enabling out-of-bounds memory reads and kernel-level code execution through pointer hijacking and IO_RING primitives. It shows how legacy filesystem code remains a target, especially with modern file formats used in phishing campaigns.
Sponsored
Watch on-demand technical sessions from the recent Datadog Detect [11] virtual event, covering:
The Tradecraft Garden is a collection of projects centered around the development of position-independent DLL loaders.
MongoDB's Kingfisher is an open-source secret scanning tool built in Rust that actively validates discovered secrets against external APIs and cloud services in real-time to eliminate false positives. Unlike other scanners that simply flag potential secrets, Kingfisher uses advanced pattern matching with Hyperscan, multi-language parsing with Tree-sitter, and dynamic validation to confirm whether detected credentials are active and pose security risks. The tool runs on-premises to keep data local, supports 700+ detection rules across cloud platforms, and outperforms tools like TruffleHog and GitLeaks in MongoDB's benchmarks.
Researchers have released proof-of-concept (PoC) exploits for the critical CitrixBleed2 vulnerability in Citrix NetScaler that can be used to steal user session tokens. The vulnerability is caused by the use of the sprints function along with a format string containing the “%.*s” format string. Citrix denies active exploitation, but security researcher Kevin Beaumont and ReliaQuest argue that they have seen evidence of exploitation.
Huntress has announced a collaboration with Microsoft to help organizations better leverage existing Microsoft security tools, such as Defender for Endpoint and Microsoft 365 licenses, through seamless integration with Huntress' EDR, ITDR, SIEM, and security awareness training capabilities. The partnership addresses the gap where over 300 million organizations use Microsoft's ecosystem but struggle to fully utilize available security features due to limited resources and expertise. Huntress provides 24/7 SOC services to maximize the value of existing Microsoft security investments, particularly targeting businesses that lack in-house cybersecurity expertise.
Bitcoin Depot suffered a data breach that exposed personal information of nearly 27,000 customers. The breach included data like names, addresses, and driver's license numbers.
Microsoft has confirmed that Windows Server Update Services (WSUS) is not syncing with Microsoft Update, stopping updates from being deployed.
A hacking group called DoNot APT, linked to India, targeted a European foreign ministry with malware named LoptikMod, using fake emails to steal sensitive data while evading detection.
Nippon Steel Solutions, a Japanese IT company, experienced a data breach resulting from hackers exploiting a zero-day vulnerability.
takes a different approach with direct client-to-server connections.
Sponsored
Traditional VPNs create a single point of failure that gives threat
Ballad Health issued a notice that its electronic print and mailing provider, Renkim, detected suspicious data on its networks. Renkim believes that data, which includes full names, contact information, client name, client account number, dates of service, and in some cases, Social Security Numbers, may have been stolen.
A popular Chrome color picker extension with 100,000+ downloads and Google's verified badge secretly hijacks browsers, tracks user activity, and creates backdoors. It's part of "RedDirection," a campaign involving 18 malicious extensions that infected 2.3 million users.
Anatsa banking malware targeted North American users through a malicious "Document Viewer" app on the Google Play Store that was downloaded 90,000 times. The Trojan, disguised as a PDF, updates displays with fake maintenance notices during banking app access while stealing credentials through overlays and keylogging.
Attackers can exploit Supabase's Model Context Protocol (MCP) to leak SQL databases by embedding malicious commands in support messages. Developers using AI assistants like Cursor to review tickets can unintentionally execute SQL queries with elevated privileges, bypassing security. LLMs can't distinguish between user data and instructions, enabling crafted messages to trigger unauthorized database access and data exfiltration through the support interface.
Google's Android Advanced Protection now integrates with Chrome to enhance security for high-risk users, such as journalists and officials. It provides three key features: enforcing HTTPS everywhere, full site isolation on devices with 4GB+ RAM to prevent data leaks, and disabling JavaScript optimizations that are often exploited in V8 security bugs. These options, which have performance trade-offs, can be enabled by enterprises and users through Chrome's privacy settings and policies outside of Advanced Protection.
Wiz developed a small language model based on Llama 3.2 1B to detect secrets in code. It utilized Claude Sonnet 3.7 to create a training dataset of secrets based on scans of public GitHub repositories. It then fine-tuned Llama 3.2 1B using Low-Rank Adaptation (LoRA) and quantization, achieving an 82% recall rate and an 85% precision rate on commercial CPUs.
Sponsored
Buyers won't run a full audit in early conversations — but they'll ask a few foundational questions to understand how seriously you take security, surface red flags, and save time later. Download the PDF [11] to stay prepared. Want to always have good answers? Explore
COMmander is a .NET tool to enrich defensive telemetry around RPC and COM. It uses a simple configuration file with rules to filter events and sends alerts when matches are found.
Pastoralist is a CLI tool for managing Node Package Manager (NPM) package.json overrides (or resolutions) with ease. It keeps track of which dependency overrides are needed and removes ones that are no longer used. With Pastoralist, you only need to run a simple command to keep your project's dependencies clean and up-to-date.
A repository with Cursor Security Rules that improve security in development workflows and AI agent interactions by enforcing safe coding practices, limiting sensitive operations, and reducing risks in AI-assisted software development.
OpenAI has implemented stricter security measures to prevent information leaks and poaching. The new measures include “information tenting” policies that limit access to sensitive algorithms and new products, isolating proprietary technology in offline computers, implementing biometric access controls for office areas, and a “deny-by-default” internet policy where explicit approval is required for external connections. OpenAI reportedly also increased physical security at data centers and expanded its cybersecurity personnel.
The SatanLock ransomware group, which was first identified in early April, has announced that it will shut down and leak all stolen data. In a report by Check Point in May, it was highlighted that more than 65% of SatanLock's victims had already appeared on leak sites run by other ransomware groups, suggesting that the group might be attempting to “reclaim” already compromised networks. SatanLock did not provide any reason for its sudden closure but has removed all victim listings from its .onion site.
Shellter, a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers were using its Shellter Elite product in attacks after a customer leaked a copy of the software. Shellter has stated that it released updates that would not reach the “malicious customer” to combat the misuse. The leaked copy was first discovered by Elastic Security Labs, who discovered that multiple threat actors had been abusing Shellter Elite v11.0 to deploy infostealers.
Scattered Spider uses domains that mimic corporate portals and employs sophisticated social engineering and MFA fatigue to launch its attacks.
The State Department issued a warning to all US embassies after discovering AI-powered impersonators posing as Secretary of State Marco Rubio contacted foreign ministers, a US senator, and a governor via text, Signal, and voicemail messages.
M&S revealed that cybercriminals used advanced social engineering tactics to impersonate an employee and manipulate Tata Consultancy Services into resetting a password, resulting in a DragonForce ransomware attack that encrypted VMware ESXi servers and exfiltrated around 150GB of data, though the company declined to confirm if the ransom was paid.
A politically motivated hacker recently breached Columbia University's systems, locking students out of their coursework, email accounts, and video conferencing services. The hacker also stole around 460GB of data, some of which they provided to Bloomberg to showcase that the university employed discriminatory admissions practices. The data includes the Social Security Numbers of students, faculty, staff, applicants, and their families, as well as university ID numbers, citizenship status, admissions decisions, and the program to which they applied.
Thousands of vulnerabilities were discovered in the Schengen Information System II (SIS II), which is used by EU border agencies to track illegal migrants and suspected criminals. An audit by the European Data Protection Supervisor (EDPS) found that the system contained an excessive amount of accounts with administrative privileges, was vulnerable to hacker overload and unauthorized access, and that 69 external employees had access without proper clearance. The EDPS found no evidence of a breach but warned that a breach could be catastrophic.
The HHS Centers for Medicare and Medicaid Services (CMS) was recently alerted that Medicare.gov accounts had been created for 103K individuals without their knowledge. The investigation determined that the accounts were created using information gathered from external sources. The unknown threat actor could use their access to view the user's Medicare beneficiary ID, coverage start date, birth date, and zip code.
DeepSpecter exposed a five-year data breach involving Uffizio's GPS fleet management platform, leaking sensitive data from police, ambulances, and critical infrastructure across 12 countries. Despite claims of GDPR compliance and CVE disclosure, the exposure persisted through global resellers, underscoring that regulatory compliance alone does not provide adequate security protection.
AWS IAM Roles Anywhere is a method for authenticating to AWS using certificates signed by a configured trust anchor. By default, the Roles Anywhere policy does not include any conditions, and any role attached to it could be assumed by any request signed by any trust anchor in that region. Unit 42 recommends specifying an ARN using conditions in the default policy, utilizing ACM-PCA for the trust anchor, and adhering to the principle of least privilege.
2025.07.08·unit42.paloaltonetworks.com·12 min read·TLDR InfoSec Attackers exploit AWS EventBridge's cross-account features using six MITRE ATT&CK attack patterns: establishing persistent backdoors via check-in events, creating bidirectional command and control channels, conducting reconnaissance by capturing all events, exfiltrating data in small chunks disguised as telemetry, lateral movement exploiting trust relationships, and exploiting vulnerable Lambda functions for unintended AWS API calls. These bypass traditional controls and evade detection because EventBridge PutEvents API calls aren't logged in CloudTrail. Defenses include Service Control Policies, specific event patterns, input validation, and monitoring CloudWatch for unusual activities.
Sponsored
Cloud data protection is messier than ever, and most DSPM tools are just throwing more alerts without giving you an actionable way to address risks. Learn how Fortra [11] can protect your organization's sensitive data thanks to its unique architecture, which combines data protection (DLP, network access) with discovery and classification.
RepoAudit is a repo-level bug detector for general bugs. Currently, it supports the detection of diverse bug types (such as Null Pointer Dereference, Memory Leak, and Use After Free) in multiple programming languages (including C/C++, Java, Python, and Go).
An IDA plugin that helps decompile Objective-C code by removing superfluous runtime calls related to ARC.
Caracal is a Rust-based implementation of eBPF techniques. It can hide target BPF programs and maps, making them invisible to tools like bpftop and bpftool. Additionally, it can conceal processes, rendering them undetectable by commands such as ps, top, and ls /proc, and is resistant to certain brute-force methods for uncovering them.
DragonForce and RansomHub, two major ransomware groups behind attacks on UK retailers like M&S and Harrods, are engaged in a turf war that could increase cyber risks for companies. The conflict began after DragonForce rebranded as a "cartel" and attacked RansomHub's site, potentially leading to double extortion of victims.
Identity-based cyberattacks increased 156% due to advanced phishing kits such as Tycoon 2FA and info-stealing malware. Phishing-as-a-service platforms, which cost $200-$300 monthly, make sophisticated attacks accessible, now comprising 59% of security investigations, often resulting in business email compromise (BEC) and ransomware.
Brazilian police have arrested João Roque, an employee of C&M, for allegedly selling his credentials to hackers. This breach facilitated a cyberattack that diverted $100 million from Brazil's PIX payment system and impacted several financial institutions with fake transactions in a single night. Authorities have since frozen $50 million in assets and are pursuing four more suspects.
The makers of Call of Duty: World War 2 took the PC game offline after reports of hackers taking over players' computers during matches.
AT&T has agreed to pay $177 million to settle lawsuits related to two major data breaches in 2019 and 2024, which exposed the personal and call data of millions of current and former customers.
Qantas suffered a cyberattack that exposed the data of 6 million customers, with police investigating and the attackers seeking extortion.