Search the archive

No pitch, no pressure. Start here →

(You'll also get an instant tour [4] of the full Permiso Platform.)

SALESFORCE TAGS 5 CVES AFTER SAAS SECURITY PROBE UNCOVERS MISCONFIG RISKS

Salesforce assigned 5 CVEs after a security report revealed 20+ configuration weaknesses in Flexcards, Data Mappers, and core components. These vulnerabilities could expose customers to unauthorized access and session hijacking. 16 other flaws were classified as customer misconfigurations. Admins have been urged to review and secure configurations to prevent exploitation.

MIRAI BOTNETS EXPLOITING WAZUH SECURITY PLATFORM VULNERABILITY

Researchers from Akamai are warning of two Mirai botnet campaigns exploiting a remote code execution vulnerability in the open-source security platform Wazuh. The first campaign has been active since March and uses a malicious shell script to download the Mirai payload. The second campaign seems to be targeting Italian-speaking users.

ZERO-CLICK AI DATA LEAK FLAW UNCOVERED IN MICROSOFT 365 COPILOT

Researchers from AIM Labs discovered an attack against Microsoft 365 Copilot, an AI assistant built into Office apps, that allowed for the leaking of sensitive data. The attack involved embedding a hidden prompt in an email which bypasses Microsoft's cross-prompt injection attack classifier because it is phrased as text to a human. Later when the user requests Copilot's RAG engine to retrieve data from the email, the prompt is interpreted and injected into the LLM.

THE FIVE SECURITY PRINCIPLES DRIVING OPEN SOURCE SECURITY APPS AT SCALE

AI has revolutionized cybersecurity innovation, enabling startups to develop products and rapidly disrupt legacy providers. However, a paradox exists between fostering innovation and managing security vulnerabilities and compliance costs. Successful startups embed governance strategically, automate security with AI, contribute purpose-built tools, and prioritize community building for long-term advantage.

A BIT MORE ON TWITTER/X'S NEW ENCRYPTED MESSAGING

X's XChat messaging protocol uses flawed end-to-end encryption. It lacks forward secrecy, and stores user private keys on X's servers using Juicebox protocol across three software-based servers (not HSMs). This allows X to potentially decrypt messages for internal purposes or legal compulsion, making XChat's encryption largely ineffective against surveillance.

COMPLEX NPM ATTACK USES 7+ LAYERS OF OBFUSCATION TO SPREAD PULSAR RAT

Researchers from Veracode detected a malicious NPM package called “solders” which uses a post-install hook to run the malicious lib.js file without user interaction. The lib.js file obfuscates the first layer using JavaScript type coercion to build up the strings from Japanese Unicode. The decoded string then uses hex encoding, array shuffling, and binary array encoding to build a base64 encoded PowerShell script that downloads a batch script that utilizes string reordering, 3DES encryption, and steganography.

MAZE (PRODUCT LAUNCH)

Maze is building technology that models the workflow of an experienced analyst, where each agent ingests telemetry from a customer's public cloud accounts, reproduces the steps an attacker would take to move laterally, and then either closes the gap automatically or flags a concise set of exploitable weaknesses.

MCP FOR SECURITY

MCP for Security: A collection of Model Context Protocol servers for popular security tools like SQLMap, FFUF, NMAP, Masscan, and more. Integrate security testing and penetration testing into AI workflows.

CLAWS

Claws is a static analysis tool for GitHub Actions modeled after Rubocop.

THE 18-POINT SECRETS MANAGEMENT CHECKLIST

A roadmap from Hashicorp on how an organization can mature in its secrets management process. The guide is broken up into the adopting stage, where secrets management is first integrated; the standardizing stage, where automatic secrets rotation and compliance are introduced; and the scaling stage, where operations are scaled up and more services like PKI are managed. Each stage is broken up into three categories with actionable checklist items.

SMARTATTACK USES SMARTWATCHES TO STEAL DATA FROM AIR-GAPPED SYSTEMS

SmartAttack is a new method that uses smartwatches to steal data from air-gapped computers secretly using ultrasonic sound. The attack needs malware on the computer and a nearby smartwatch to receive hidden audio signals. Experts suggest banning smartwatches and removing computer speakers from secure areas to stop this.

THE EVOLUTION OF LINUX BINARIES IN TARGETED CLOUD OPERATIONS

Unit 42 researchers identified five actively evolving Linux ELF malware families (NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidPour) that threat actors are adapting to target cloud infrastructure, with cloud-based security alerts increasing 388% in 2024. These malware strains use techniques like dynamic linker hijacking and SSH daemon injection to achieve persistence, command and control, and data exfiltration in Linux-based cloud environments that comprise 70-90% of cloud computing instances. Palo Alto Networks' new machine learning detection module successfully identified 92% of tested ELF malware samples, demonstrating the effectiveness of ML-based approaches for detecting these evolving cloud threats.

INTERPOL DISMANTLES 20,000+ MALICIOUS IPS LINKED TO 69 MALWARE VARIANTS IN OPERATION SECURE

INTERPOL conducted a global operation across 26 countries to shut down over 20,000 malicious IPs associated with 69 types of data-stealing malware, resulting in the arrest of 32 suspects and the seizure of servers and data.

HACKERS TARGET RECRUITERS, POSING AS JOB SEEKERS AND SENDING MALICIOUS RESUMES

Hackers are deceiving recruiters by masquerading as job seekers and submitting fake resumes that contain harmful files, which can compromise a company's system when opened.

40,000 SECURITY CAMERAS EXPOSED TO REMOTE HACKING

Over 40,000 security cameras globally are accessible online, enabling hackers to potentially view or exploit live footage, particularly in homes and offices where security is often weak or non-existent.

Watch the video (03:13 minutes)

NEARLY 300K CRASH RECORDS STOLEN FROM TEXAS TRANSPORTATION DEPARTMENT

The Texas Department of Transportation is notifying the impacted individuals of a data breach of its Crash Reports Information System (CRIS). The breached data includes full names, addresses, driver's license numbers, license plate numbers, and car insurance policy numbers. An attacker obtained the data via a compromised account.

SENSITIVE INFORMATION STOLEN IN SENSATA RANSOMWARE ATTACK

Sensata Technologies confirmed hackers stole sensitive employee data during a March-April ransomware attack. The stolen information includes Social Security numbers, financial details, and health insurance data.

FOUND IN THE WILD: 2 SECURE BOOT EXPLOITS. MICROSOFT IS PATCHING ONLY 1 OF THEM

Researchers discovered two Secure Boot bypass exploits affecting 50+ device makers. Microsoft patched CVE-2025-3052 (DT Research firmware tool vulnerability) but left CVE-2025-47827 (IGEL Linux OS flaw) unpatched. Both allow attackers with physical access to install pre-boot malware, defeating Secure Boot's core security purpose against "evil maid" attacks.

GARTNER: HOW SECURITY TEAMS CAN TURN HYPE INTO OPPORTUNITY

At Gartner's Security Summit, analysts advised harnessing AI and cybersecurity hype constructively rather than letting it drive hasty decisions. They recommended using protection level agreements and outcome-driven metrics for fact-based security conversations with executives. Security teams must develop AI literacy while protecting organizational AI investments from emerging threats.

NEW PROCESS INJECTION CLASS: THE CONTEXT-ONLY ATTACK SURFACE

Most process injection techniques typically begin by allocating memory, writing to that memory, and then executing it. However, the researchers in this post explored the possibility of process injection while only using the execution step. The researchers first achieved their goal by dropping a malicious DLL and then executing it by abusing that LoadLibraryA automatically appends “.dll” to strings that are passed to it. The researchers then took this one step further and used CreateRemoteThread with SetThreadContext and NTCreateThread to execute code in a remote process without needing to write a DLL to disk.

HIGH LEVERAGE SECURITY DECISIONS

This post presents a list of security decisions that can be made early in a startup's lifecycle to enhance long-term security while providing the most value early on. The list includes organizational security and IAM-related decisions such as choosing an Identity Provider, adopting security keys, and using a Mobile Device Management (MDM) solution. The list also includes architectural decisions like adopting Infrastructure as Code and using managed infrastructure where possible.

CONTAINERIZATION

The Containerization package allows applications to use Linux containers. Containerization is written in Swift and uses Virtualization.framework on Apple silicon.

SWIMLANE (PRODUCT LAUNCH)

Swimlane's platform leverages agentic AI and automation to resolve security, IT/OT operations, and compliance issues.

CLAUDE-C2

Claude-C2 provides an MCP server to communicate with a C2 server.

M&S ONLINE ORDERING SYSTEM OPERATIONAL 46 DAYS AFTER CYBER SHUTDOWN

Marks & Spencer has partially restored online orders following an April cyberattack, with select fashion ranges now available in England, Scotland, and Wales. Services remain limited - no Northern Ireland delivery, Click & Collect, or next-day options.

RESEARCHERS UNCOVER POSSIBLE IPHONE SPYWARE CAMPAIGN INSIDE US

Researchers from iVerify detected behavior indicative of tampering and spyware in iPhones belonging to high-value targets in an EU member state's government, US political campaigns, media organizations, and an AI company. The hackers targeted the individuals via the “Nickname” feature in iOS, which sends a notification whenever someone's iCloud photo or name changes. Apple has fixed the vulnerability being used and claimed that it has uncovered no evidence of exploitation.

BRUTEFORCING THE PHONE NUMBER OF ANY GOOGLE USER

CONNECTWISE ROTATING CODE SIGNING CERTIFICATES OVER SECURITY CONCERNS

ConnectWise is updating digital certificates for key software to address security concerns - users must install these updates by June 13 to avoid potential issues.

MICROSOFT OUTLOOK TO BLOCK MORE RISKY ATTACHMENTS USED IN ATTACKS

Starting next month, Microsoft will expand the types of blocked attachments in Outlook Web and the new Outlook for Windows to improve security by preventing potentially harmful files from being sent or received.

LET THEM EAT JUNK FOOD: MAJOR ORGANIC SUPPLIER TO WHOLE FOODS, WALMART, HIT BY CYBERATTACK

United Natural Foods disclosed a cyberattack on June 5 that disrupted operations and order fulfillment. The company activated incident response protocols and took systems offline. This follows similar recent attacks on grocery chains in the UK.

HACKER TARGETS OTHER HACKERS AND GAMERS WITH BACKDOORED GITHUB CODE

Sophos detected a campaign in which an attacker uses GitHub repositories with hidden backdoors to target other hackers and gamers. The repositories use various loaders to deploy various payloads, such as info-stealers and remote access trojans (RATs). Many of the fake repositories are designed to target other hackers, but some also use game cheats, mod tools, and fake exploits as lures.

MISCONFIGURED HMIS EXPOSE US WATER SYSTEM TO ANYONE WITH A BROWSER

While conducting a routine scan of industrial-control hosts, Censys researchers discovered an uncommon TLS certificate configuration that led to the discovery of a browser-based HMI platform. These internet-exposed platforms could be used to view and control water systems without authentication. Censys sent a bulk notification to the EPA, and the number of systems that were either read-only or fully controllable was reduced from 300 to 20.

EKS VS GKE - SECURITY

An in-depth comparison of security features in EKS and GKE. The post breaks down features by Identity and Access Management (IAM), controlling network traffic, configuration/posture management, vulnerability/supply-chain management, and runtime threat detection.

FOLLOW THE SMOKE | CHINA-NEXUS THREAT ACTORS HAMMER AT THE DOORS OF TOP TIER TARGETS

SentinelOne observed and countered Chinese cyberespionage operations targeting the company in 2024-2025, including PurpleHaze reconnaissance and a ShadowPad intrusion via a hardware logistics partner, but SentinelOne wasn't compromised. The broader campaigns targeted 70+ organizations globally, including government, media, and cybersecurity vendors.

OPEN-SOURCE TOOLKIT OF AN IVANTI CSA ATTACKER

In late 2024, Ivanti released advisories for vulnerabilities in its Cloud Services Appliance (CSA) product, which were discovered to be part of an exploit chain against the products. In this post, Synacktiv researchers break down three of the open-source tools they observed used by attackers in post-exploitation activities on these devices and provide YARA rules to detect them. The attacker planted Suo5 after the initial compromise as a webshell to be used on an internet-facing Exchange server. The attacker then established persistence using the iox tunnel and attempted lateral movement using atexec.py to gain remote code execution via Task Scheduler.

GUARDZ (PRODUCT LAUNCH)

Guardz continuously monitors organizations' internal and external digital footprint to provide real-time protection. From a single dashboard, administrators can immediately take action when necessary.

BUGFISH NUKE

Bugfish Nuke is a powerful emergency data deletion tool for Windows designed to help you quickly and securely erase sensitive files, user data, and system traces.

ADELEGINATOR

ADeleginator is a tool for finding insecure trustee and resource delegations in Active Directory environments.

GOOGLE FIXES BUG THAT COULD REVEAL USERS' PRIVATE PHONE NUMBERS

A security researcher discovered a Google bug that allowed attackers to reveal any account's private recovery phone number in under 20 minutes without owner notification. The exploit bypassed anti-bot protections through automated brute-force attacks. Google confirmed the fix after the researcher disclosed the vulnerability in April. It paid a $5,000 bounty and found no confirmed exploits occurred.

EXPLAINER FOR LOCAL NETWORK ACCESS

The Chrome Secure Web and Network team has drafted a proposal to require explicit permission for a site to access devices on the local network. This proposal seeks to address a common attack vector in which an attacker can use a CSRF vulnerability to attack a local device such as a printer. The proposal would require any request that seeks to access a more private IP space (such as public to private or private to loop back) to obtain a new “Local Network Access” permission from the user via a prompt.

LINUX FOUNDATION UNVEILS DECENTRALIZED WORDPRESS PLUGIN MANAGER

The Linux Foundation has launched the FAIR Package Manager, a new way to manage WordPress plugins and themes. It was created after a major conflict between WordPress companies Automattic and WP Engine. This tool gives developers more control by offering a decentralized and secure plugin system.

OPENAI BANS CHATGPT ACCOUNTS LINKED TO RUSSIAN, CHINESE CYBER OPS

OpenAI banned ChatGPT accounts associated with hackers in Russia and China who exploited the AI for cyberattacks, malware creation, and disinformation, while successfully mitigating the threats with partner assistance.

TRUMP CYBERSECURITY EXECUTIVE ORDER TARGETS DIGITAL IDENTITY, SANCTIONS POLICIES

President Trump issued an executive order altering previous cybersecurity regulations by eliminating support for digital IDs in public benefits, modifying the government's software, AI, and encryption approaches, and restricting cyber sanctions to foreign threats only.

MALICIOUS NPM PACKAGES POSING AS UTILITIES DELETE PROJECT DIRECTORIES

Two fake npm packages pretended to be useful tools but deleted all files in project folders instead.

📥 Download the 2025 Global Threat Intelligence Report