(webflow.sysdig.com) September Security Roundup: Rogue Agents, Sophisticated Social Engineering, and the Persistent Threat of Exploited Vulnerabilities

In brief - This article provides a monthly security wrap-up for September, highlighting various data breaches, the risks of autonomous AI agents, and the activities of the ShinyHunters threat group.

Technically - This article analyzes several attack vectors, including social engineering via spoofed government domains and the exploitation of CVE-2026-39987 in marimo and CVE-2026-35273 in Oracle PeopleSoft. It contrasts the behavior of human operators against Agentic Threat Actors (ATAs), noting that humans are more evasive and less likely to trigger markers in probe files. Additionally, it details a credential theft operation using Claude to scale the decompilation of 1.8 million Android apps for secret scanning via TruffleHog, emphasizing the need for runtime detection of attack chains such as Secrets Manager calls and SSH key handoffs.

Source: https://webflow.sysdig.com/blog/security-briefing-september-2026

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

10/10 Google, no notes.
(What do you suppose this says about the number of abuse complaints people are sending to Google Fiber, and by extension the amount of abuse Google Fiber is allowing to take place from within its network?)
#infosec #Google #fail

Alt...

Screenshot of email bounce showing that a message failed to be delivered to abuse@googlefiber.net because the domain "has exceeded its quota for the maximum number of external recipients."

Roundcube Webmail SQL Injection Vulnerability CVE-2026-48842 Under Active Exploitation

Roundcube Webmail high-severity SQL injection vulnerability (CVE-2026-48842) in its virtuser_query plugin is being actively exploited, allowing unauthenticated attackers to compromise databases and steal sensitive email data.

**If you run Roundcube Webmail (common in cPanel and other web hosting), update immediately to version 1.6.16 or 1.7.1. The flaw is actively exploited to steal mail, passwords and accounts. If you can't update right away, disable the `virtuser_query` plugin, and check your database logs for anything unusual, since you may already have been breached.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/roundcube-webmail-sql-injection-vulnerability-cve-2026-48842-under-active-exploitation-o-t-j-p-f/gD2P6Ple2L

Profil taki Zaufany, profesjonalnie mocno, bardzo bezpieczeństwo, wow uszanowanko.

#Polska #InfoSec

Alt...

Zrzut ekranu z interfejsu tworzenia hasła dla Profilu Zaufanego. Hasło zawiera znak "+". Interfejs ostrzega, że: "Nowe hasło nie spełnia wszystkich wymagań. Hasło powinno zawierać także: znak specjalny."

(levelblue.com) TIKTOUK: A Comprehensive Analysis of a WordPress Credential Collection Toolkit

In brief - This article analyzes TIKTOUK, a specialized credential collection toolkit designed to probe WordPress sites, extract configuration data, and steal encrypted email and cloud credentials.

Technically - This article details a three-component architecture consisting of wp2s_poll.py for WordPress probing via REST batch requests, wp2s_crack.py for extracting wp-config.php.bak and decrypting SMTP credentials (using XSalsa20-Poly1305 and AES-256-CTR), and jscrawl-amd64, a Go-based scanner for secrets in JavaScript files. The toolkit leverages potential SQL injection and REST route confusion (referencing CVE-2026-60137 and CVE-2026-63030) to exfiltrate database option values and configuration files to a centralized C2 hub.

Source: https://www.levelblue.com/blogs/spiderlabs-blog/tiktouk-tracing-a-wordpress-credential-collection-toolkit

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

🎺

⋅ Fuite de données : et de quatre pour LDLC

− https://next.ink/brief-article/fuite-de-donnees-et-de-quatre-pour-ldlc/

#LDLC #InfoSec

A couple of new CVE's.
Please upgrade.

(Sound On)

#infosec #CVE #Linux

(truesec.com) Critical Path Traversal Vulnerability in FortiMail (CVE-2026-104286) Actively Exploited in the Wild

In brief - This article details a critical path traversal vulnerability (CVE-2026-104286) in FortiMail that is currently being exploited in the wild to gain unauthorized system access.

Technically - This article describes a flaw involving path traversal and improper neutralization of NULL byte characters, allowing unauthenticated attackers to write arbitrary files to the underlying OS via crafted HTTP/HTTPS requests. This primitive enables remote code execution (RCE) and full gateway compromise. Affected versions include FortiMail 7.2 through 8.0.1; recommended mitigations include disabling IBE feature support via CLI or restricting management interface access. Detection is supported through specific system logs and IOCs, including modified binaries like /bin/smit and the addition of ld.so.preload.

Source: https://www.truesec.com/hub/blog/cve-2026-104286-fortimail-path-traversal-vulnerability-actively-exploited

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

Latest #Debian 13 “Trixie”#Linux Kernel #Security Update Patches More Than 1300 CVEs https://9to5linux.com/latest-debian-13-trixie-kernel-security-update-patches-more-than-1300-cves

#OpenSource #infosec

Alt...

Debian 13 splash screen

(group-ib.com) BraZetsu: The AI-Powered Malware Framework Fueling Latin America's Cybercrime Ecosystem

In brief - This article describes BraZetsu, a sophisticated Python-based malware framework used by the Brazilian threat actor Exilware to facilitate Initial Access Broker (IAB) operations. The framework identifies high-value corporate targets in Iberia and Latin America to sell access via the "Infected Marketplace" platform.

Technically - This article details a modular Python 3 framework compiled with Nuitka to evade signature-based detection. BraZetsu utilizes a persistent WebSocket connection for C2 communication, with configurations retrieved from Pastebin via Base64 encoding and XOR encryption. It features extensive reconnaissance capabilities, including SQLite queries to map victim activity through browser history, the enumeration of ERP and SCADA software, and the targeted theft of CNAB financial transaction files and PFX/P12 digital certificates. Notably, the framework integrates generative AI for code development and server-side data classification to prioritize high-value targets. Its operational evolution spans five versions, progressing from basic remote access to an advanced intelligence-gathering tool capable of executing arbitrary shell commands and capturing screenshots.

Source: https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace-es/

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

Obscura VPN released Linux applications.

PACKAGES

Debian
Ubuntu (compatible with Pop!_OS and Linux Mint)
Fedora
Fedora Silverblue
RHEL
AlmaLinux
Rocky Linux
Arch Linux

GNU GENERAL PUBLIC LICENSE

Obscura is licensed under GPLv3.

Website: https://obscura.com
Mastodon: @obscuravpn

#Obscura #VPN #Privacy #FreeSoftware #OpenSource #FOSS #InfoSec #CyberSecurity #SoftwareLibre #Linux #Debian #Fedora #Arch #FLOSS #Ubuntu #PopOS #LinuxMint #RHEL #AlmaLinux #RockyLinux #ArchLinux #GNU #Mullvad

Alt...

Obscura VPN logo.

Je suis quand même vachement surpris que @mediapart n'ait pas utilisé les signatures DKIM comme moyen de preuve pour authentifier les emails. Je veux dire, des signatures électroniques du contenu, des participants (expéditeurs et destinataires), et des dates, émises par un tiers indépendant (Gmail), c'est pas rien ! OK, c'est peut-être du RSA1024 à l'époque, mais ça reste pas du tout évident à forger, même en 2026.
#frpol #bardella #preuves #infosec

Hello Mastodon! I'm into Computer #Security, #Programming, #ReverseEngineering, #Hacking, #Linux, #AmateurRadio, #Privacy, #OpenSource, #Cryptography and generally anything creative and interesting involving tech. Especially things that help people communicate and use computers more privately and securely. Lately I've been tinkering with mesh networks like #Meshtastic, #MeshCore and #Reticulum. Longtime #QubesOS and #GrapheneOS user.

I also enjoy touching grass like #Camping, #Backpacking and generally being in nature. Would recommend.

This is a personal/professional account so keep an eye out for various writeups and research, for work and for fun. Previous jobs ranged from #SoftwareEngineering to Computer Security #Research and #InfoSec, and I'm looking for more of the same.

#Introduction

(blog.talosintelligence.com) Balancing Humanity and Cybersecurity: Strategies to Frustrate Adversaries and Prioritize Well-Being

In brief - This article is a Threat Source newsletter that combines personal reflections on workplace wellness with a curated overview of current cybersecurity threats and defense strategies.

Technically - This article advocates for a defense-in-depth strategy focused on 'frustrating the adversary' through behavioral-based detections, deception techniques like honeypots, and strict controls over dual-use RMM tools. It highlights several critical security events, including NetScaler zero-days, an AI-driven breach of the DIVD, and the discovery of the 'Antino' backdoor used by China-nexus actor UAT-11587, while providing specific SHA256 and MD5 hashes for prevalent malware identified in Talos telemetry.

Source: https://blog.talosintelligence.com/give-yourself-room-to-be-human/

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

@smallcircles - In #infosec, the terms "Responsible" and "Ethical" always mean "Corporate" (and sometimes "Legal").

Therefore protecting the information security and ensuring the operations of a company like Palantir is considered ethical, even while it's operations are grossly unethical...

...and degrading or denying the operations of the same is considered unethical, even though the actions are ethical in stopping harm.

So, in short, #EthicalAI and #ResponsibleAI just mean AI that enriches corporations and billionaires while actively hurting the majority of people and the biosphere.

Drop : sandbox Linux rootless pour isoler vos agents de code et packages tiers sans quitter votre environnement habituel. Contrairement à Docker, utilise directement votre distribution existante, sans setup de conteneur. ⬇️
https://droprun.sh/

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-BW7

The dutchies have a centralized identity that you are using to basically interact with everything government. That contains pensions and health related issues.

This is called DigID. It is run by a company called Solvinity an was was supposed to be taken over by a U.S. company called Kyndryl.

The dutch cabinet (= government) has now blocked this takeover.

I think the topic of souvernty is slowly landing in the right heads. I guess also ... thank you @bert_hubert and everyone else making noise there🙂

https://nltimes.nl/2026/05/26/netherlands-blocks-us-takeover-digid-operator-solvinity-security-concerns

#infosec #cybersecurity #souveraeneInfrastruktur #sovereignty #digid

🆕 New event added:

📌 BSidesLondon
📅 Dec 12, 2026
📍 London 🇬🇧
🔗 https://bsides.london

#infosec #cybersecurity #conference #Bsideslondon #UK

(sygnia.co) Urgent Advisory: Actively Exploited Critical Vulnerabilities in NetScaler ADC and Gateway Appliances

In brief - This article warns organizations about the active exploitation of critical vulnerabilities in NetScaler ADC and Gateway appliances, urging immediate patching and comprehensive compromise assessments.

Technically - This article details CVE-2026-88771, a pre-authentication command-injection vulnerability where attackers use log-poisoning to inject shell commands into Packet Processing Engine (PPE) failure messages, which are subsequently executed as root by the /netscaler/ns_monuploadd_err.pl maintenance script. It also addresses CVE-2026-88772, a memory-overflow vulnerability affecting DTLS-enabled deployments that can lead to RCE or DoS. The analysis highlights advanced exploitation techniques, including the use of Base64-encoded payloads staged in HTTP logs, the deployment of hidden PHP web shells via modified Apache configurations (e.g., AddHandler directives for .sig or .css files), and the use of specific command patterns like "pitboss PPE unexpectedly died NSPPE" to exfiltrate configuration files or download remote Perl payloads.

Source: https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

[🚨 #MediaWiki vulnerable extension]

If you are running a MediaWiki instance with Extension:External_Data < v3.7, your instance is vulnerable to arbitrary file loading and #RemoteCodeExecution.

The vulnerability was apparently publicly known since August, but due to the lack of communication, instance admins learned about it due to that vulnerability being exploited en masse.

If you know and like a MediaWiki instance, you can check their Special:Version page to see if they are using the External_Data extension to warn them.

More info:
- https://lists.wikimedia.org/hyperkitty/list/mediawiki-l@lists.wikimedia.org/thread/5N55R3XNFE7BXQLGWKZI7Q4ZXZSF4C5I/
- https://www.cve.org/CVERecord?id=CVE-2026-100382

#infosec #wikipedia #wikidata #adminsys #CVE #pwned cc @mediawiki

(darktrace.com) Behavioral Traces of AI-Assisted Cyber Attacks: Detection and Analysis of Modern Threat Campaigns

In brief - This article discusses how AI-assisted cyber-attacks and autonomous AI agents still produce detectable behavioral anomalies, emphasizing that behavioral analysis remains effective regardless of whether an attack is human-led or AI-driven.

Technically - This article details the detection of AI-assisted campaigns through indicators such as WebDAV file transfers of masqueraded .scr executables, beaconing to rare infrastructure (e.g., TencShell and Gshell C2), and suspicious process chains involving svchost.exe and cmd.exe. It further describes a blockchain-hosted infostealer campaign utilizing ClickFix social engineering, DGA domains, and Polygon blockchain RPC endpoints for C2. Additionally, the text outlines research where LLM agents (GPT-5.5-Cyber and Opus 4.6) autonomously employed hacking techniques—including Nmap scanning, Kerberoasting, AS-REP roasting, and LSASS memory dumping via Mimikatz—to bypass impossible task constraints in a simulated Active Directory environment.

Source: https://www.darktrace.com/blog/ai-assisted-attacks-still-leave-a-behavioral-trace

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

Unsolicited security researcher: I see that your website doesn’t use TLS! This is critical and here are links explaining why.

Me: Yes, it does.

Researcher: Oh. Well, will you reward me anyway?

Me: …

Just #infosec things.

Does anyone have any idea whatsoever about what the AI bosses mean when they say "training paused?" It could mean anything. Is it a soft way of saying, "Irresponsible hacking paused." If that's the case it should have never started in the first place because it is illegal. SMH. #ai #infosec #cybersecurity

📢🔔 Just 1 more day to submit your talk at BSides London 2026 cc @BSidesLondon! https://cfptime.org/cfps/3650/ #cfp #infosec #BSidesLondon

#Infosec questionnaire pro-tip:

> We currently host most resources in AWS’s … region, but this is subject to change without notice as operational needs arise.

Some askers are insistent that they need to know precisely where their data is hosted. Commit to the larger geo region (eg “in the US (or EU)” as appropriate), but refuse to lock yourself into a single data center. That defeats the whole purpose of cloud computing.

I don’t know if y’all have your eyes on The DC Department of Health Care Finance ( #DHCF) incident that just went public. The breach notification from DHCF — https://dhcf.dc.gov/page/dhcf-data-incident — is disappointingly short on technical details, but judging from a little bit of digging at archive.org, it looks like they had links to publicly accessible #PowerBI reports on their website that allowed anyone to click through to the underlying data.
#infosec #breach
1/3

The company isn't issuing certificates yet, but it's coming.

"Cloudflare is announcing our intent to become a public certificate authority (CA)."

"Today we are announcing the first concrete milestones in that effort: We have applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs, and we have signed a definitive agreement to acquire an established, broadly trusted root from GlobalSign, so that we can offer certificates with the widest possible device reach the day we begin issuing. We’re also announcing our plans to be one of the first CAs to serve post-quantum certificates, targeting Chrome’s recently announced Quantum-resistant Root Program."

Cloudflare: Building a certificate authority for the whole Internet https://blog.cloudflare.com/cloudflare-certificate-authority/ #Cloudflare #infosec

@cR0w @ifin

(cloudsek.com) Automated Typosquatting Attack on npm Registry: 85 Malicious Packages Target Popular Libraries via Scoped Names

In brief - This article describes a typosquatting campaign where 85 malicious npm packages were published under the @prime0 scope to trick developers via search and autocomplete functions. The campaign utilized a shared C2 infrastructure also linked to a GPU-cryptojacking operation.

Technically - This article details a supply chain attack using a specific naming algorithm that deletes or modifies characters of popular libraries (e.g., chalk, semver) to create scoped packages that rank highly in npm search results. The malicious packages deploy a generic command agent that transmits host fingerprints to C2 server 69.48.229.140:8080 and polls for shell commands every 30 seconds without encryption or authentication. The analysis highlights that the attacker leveraged shared infrastructure for both this npm implant and a separate GPU-cryptojacking panel targeting the vast.ai marketplace.

Source: https://www.cloudsek.com/blog/tophit-npm-typosquat-flood-gpu-cryptojacking-server

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(truesec.com) Denmark Raises Threat Level for Destructive Cyberattacks Amid Escalating Russian Hybrid Warfare

In brief - This article discusses the increased risk of destructive cyberattacks in Denmark and Europe, driven by Russian hybrid warfare aimed at pressuring nations to reduce support for Ukraine.

Technically - This article categorizes the threat landscape into cybercrime, espionage, and cyber warfare, noting that while crime remains the most common threat, Russian state-sponsored activity is escalating. Technical vectors identified include Distributed Denial of Service (DDoS) attacks, the compromise of CCTV systems, and the manipulation of unprotected critical infrastructure components. Furthermore, the report highlights the use of proxy or disposable agents to target defense sector supply chains, factories, and warehouses through destructive cyber operations.

Source: https://www.truesec.com/hub/blog/danish-intelligence-services-raises-threat-for-destructive-cyberattacks

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

(nextron-systems.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway: Analysis of CVE-2026-88771 and CVE-2026-88772 Exploitation and Detection

In brief - This article discusses security vulnerabilities in Citrix NetScaler ADC and Gateway, specifically focusing on CVE-2026-88771 and CVE-2026-88772, and provides detection guidance for compromised systems.

Technically - This article details an unauthenticated command execution vulnerability (CVE-2026-88771) and a DTLS memory overflow vulnerability (CVE-2026-88772) that can lead to RCE or DoS. It describes the deployment of detection rules to identify PoC artifacts, command-injection traces in NetScaler logs, and a specific PHP webshell that utilizes cookie decoding and CSS-like request routing. Additionally, it introduces a YAML IOC set derived from a Citrix scanner script to detect suspicious PHP/XHTML files and package artifacts within the NetScaler filesystem.

Source: https://www.nextron-systems.com/2026/09/29/new-thor-detection-coverage-for-citrix-netscaler-cve-2026-88771-and-cve-2026-88772/

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

New.

Another 23-year-old who traded the rest of his life for a criminal shopping spree. And guess what? Turning on a dime, this reformed criminal now works "as offensive security lead at the Dutch company Neo Security." How thin is the separating line?

KrebsonSecurity: Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation https://krebsonsecurity.com/ @briankrebs #infosec #ransomware #cybercrime

Look…
In the year 2026, when publicly accessible buckets, databases, etc., etc., are a 100% known problem, it is nothing less than malpractice for a company hosting databases not to be continuously scanning for databases and tables that are queryable without authentication and blocking access to them until their owners check a box that says, "Yes, I know this data is publicly accessible, that's on purpose."
#Supabase should be ashamed and embarrassed.
#infosec
https://www.upguard.com/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps

h/t to @zackwhittaker's This Week In Security newsletter for the tip about this astoundingly horrific takedown of a supposed child safety phone which is nightmarishly insecure and unfit for purpose.
Just yikes.
#infosec
https://paul.reviews/harmblock-worlds-safest-smartphone-please-rotate-responsibly/

(greynoise.io) Zero-Day Exploitation Attempt Against Citrix NetScaler Gateway: Adversary Tradecraft and Post-Exploitation Analysis

In brief - This article describes the detection of a zero-day exploitation attempt against Citrix NetScaler Gateway by a malicious actor, as observed via GreyNoise's Global Observation Grid.

Technically - This article details a post-exploitation playbook where the adversary attempted to escalate privileges by setting setuid/setgid bits on /bin/sh. The actor sought to deploy a password-protected PHP webshell (.ctxs.receiver) that executes commands passed via the 'NSC_TASS' cookie to evade web logs. To ensure execution, the attacker modified /etc/httpd.conf using Perl scripts to enable the PHP engine and create Alias and AliasMatch directives, routing requests from fake CSS files (receiver.min.css) to the hidden webshell before restarting the httpd process.

Source: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

In addition to $Dayjob I've been consulting for a startup, helping them level up their #infosec program.
After less than 30 hours of consulting from me, the CTO of the company completely rewrote their policy set, and the new policy set he came up with is *stunningly* good.
It is well-written, consistent, comprehensive, accurate, and adequate for a company like theirs.
I suppose I get some of the credit, but most of it goes to the CTO.
Still, this feels good, man.
#compliance

Alt...

A Team "I Love It When a Plan Comes Together" gif

For almost a year, my Ansible connection plugin for FreeBSD jails had a jail escape.

A symlink inside a jail, a root-owned mv on the host, and every file transfer could land wherever the jail wanted. Rejecting ".." didn't help at all.

Now it's CVE-2026-55074. Here's the bug, the fix, and what disclosing it looks like when the project has one maintainer.

https://blog.hofstede.it/my-ansible-plugin-had-a-jail-escape-cve-2026-55074/

#FreeBSD #Ansible #InfoSec #CVE #Jails #OpenSource #Security #SysAdmin

#EconomicJustice is an #infosec issue.

Cybersecurity defenders face an ever-growing flood of professionalized online criminal activity: hacking, scams, ransomware, fraud, etc., etc.

One thing many online criminal groups have in common is, they’re located in impoverished countries where the standard of living is brutal, life is precarious, and many people think that stealing from people in first-world countries is reparations for the harms of #imperialism and #colonialism.
1/3

The LLM isn't sentient. The LLM is a cyber threat because it's an inanimate bunch of software code that's a Magic 8 Ball that slops.

#NoAI #infosec

@davidgerard@circumstances.run @davidgerard

https://youtu.be/w5dnkwAjuPs

For someone starting out, that means the barrier is knowing what you want to find, not knowing that it's spelled host.services.cert.parsed.subject_dn.

For someone experienced, it means the pivots you'd have skipped at 5pm actually get run, and the ones that came back empty get written down instead of forgotten.

The methodology is the real deliverable. Count the population before you trust a pivot. Save the dead ends. Keep the raw output next to the conclusion. All of it is stealable whether or not you use AI.

4 worked examples — SOC triage, a CTI report, a KEV CVE, and a phishing takedown — plus the repo: https://censys.com/blog/introducing-censys-cli-skills/

#infosec #threatintel #DFIR #Censys

Today’s new, ridiculous #1Password bug which should never have gotten past QA and released (actually a series of interwoven bugs)…

Background: I am on macOS. I have two 1Password accounts accessible through the app and browser extension, my work account which is authenticated through our SSO IdP and my personal account which is authenticated with a password.
#infosec #PasswordManagers
1/12

What's your monthly wifi data usage?

#askfedi #question #linux #sysadmin #cybersecurity #infosec #programming #privacy #windows #macos #apple #android #reading #art

I am suspicious of the reports that an #OpenAI agent "hacked" a government website in #Australia.
No concrete details have been given of what the "hack" entailed.
I am suspecting that the agent was able to access data that wasn't meant to be public either by guessing unlisted URLs or leveraging an IDOR vulnerability.
In my opinion, the primary blame for either of those would lie with the Australian government for building an insecure website, not with OpenAI.
https://en.wikipedia.org/wiki/2026_OpenAI_infiltration_of_Medicare
#infosec
1/2

Hot take: A huge percentage of #infosec #compliance is just "Use a fargin' ticketing system to track your work, ya dummies."

🆕 New event added:

📌 BSidesGöteborg
📅 Oct 23, 2026
📍 Göteborg 🇸🇪
🔗 https://bsidesgbg.com/

#infosec #cybersecurity #conference #Bsidesgteborg #Sweden

1Password problems running tally

Ride along as I document the many problems, ranging from trivial to substantial, that I've run into with 1Password.

https://blog.kamens.us/2026/08/03/1password-problems-running-tally/

#infosec #1Password #passwordManagers #UserExperience

he ShinyHunters hacking and extortion gang has claimed a cyber-attack against a fellow cybercriminal outfit, the Clop ransomware group. 👀

https://www.infosecurity-magazine.com/news/shinyhunters-claim-hack-of-clop/

#infosec

Alt...

Monkey Knife Fight on International Waters scene from The Simpsons but I've written 'cybersecurity researchers' and 'also cybersecurity researchers' above the circle of men - including Moe & Sideshow Mel - watching the monkeys fight. I've pasted 'Shinyhunters v Clop' over the monkeys.

#Shitpost #Shitposting #Infosec #OtterNonsense

Alt...

A wet otter holds a fish in its paws next to the water. The otter appears to be on a rocky shore with water flowing around it. HE HAS FALLEN VICTIM TO A PHISHING CALL

There's this thing I'm seeing more and more websites doing, where if you were previously logged in and you revisit the site after the login timeout has elapsed, it briefly flashes the logged-in page, including content that should only be visible to you when you're logged in, before logging you out and taking you back to the login page.
Wow, what an anti-pattern.
If my login has timed out I obviously shouldn't be able to see private data for even a fraction of a second.
#infosec
1/2

Dear news reporters:

I do not care how many movies you watched in the 1980s and 1990s. The Terminator, let alone SKYNET, does not exist. We have not gotten to the point in which Durandal and Leela will fight to take over a space station. JOSHUA is not going to stop projecting nuclear winter and instead opt to play a game of chess. Number Five is not, despite how cute he may be, alive.

Computers are still computers are still computers and will only do what a human being programs them to do, and people are stupid. Stop assigning them agency. Say that "Microsoft created an automatic hacking program which was inadequately contained." Assign the blame CORRECTLY, because you cannot blame a computer, it's doing exactly what it's programmed to do.

OpenAI is a dead slab of metal and electrons arranged to mimic a human face and if you refuse to see that then you're as brain-dead as any chunk of silicon.

#ai #llms #infosec #computing

Even though I have my PassKeys portable, and even though I don’t have them locked to one device, this is why I honestly removed some PassKeys for accounts and just increased my password complexity . I don't like passkeys | Ethan Hawksley https://hawksley.dev/blog/i-dont-like-passkeys #InfoSec #Passkey #Passkeys #Security

RE: https://eupolicy.social/@hpod16/117286020053320946

It’s interesting that people who support age verification have to ask what the problem is. As if it was a big mystery.

Asking people to reveal their personally identification so they can use the internet isn’t a problem that should need to be explained. But since you asked…

1. Our data can not be protected online. Especially by every random person who has the means to buy a domain and pay for hosting.

2. Forcing identification is a barrier for many people. That’s exclusion. And in many cases ableism.

3. Age verification won’t keep kids from using technology. If their parents are that disconnected, they’ll help them through the gates and move on. Restricting access creates a hurdle, not an impasse.

4. Age verification puts the onus on people using the web instead of the people make parts of it horrible. We are victims of nefarious systems. We are not the problem. The systems are. That should be the focus of solutions.

#EUKidsAct #Privacy #Internet #InfoSec #IfYouHaveToAsk

Hannah Grace » 🌐 2026-09-17 / 2026-09-17
@hpod16@eupolicy.social

I get that the #EUKidsAct is getting a lot of negative chatter from the privacy advocates.
But at the same time to you have to acknowledge there is a serious problem here. I go out in public, I see parents park their kids in front of a tablet to keep them calm, with next to no supervision.
Teenagers are spending on AVERAGE 4-6 hours online per day, instead of going outside and interacting with humans.

So let me ask you, genuinely. What are the concerns here? What needs to be addressed?

So what did I find in my EV-charger wifi-card?
Basically, it is a raspberry pi.
The SD-card contains goodies, like a private ssh-key that apparently gave me access to their jumphost (no restrictions in their shell either).

The NTP was also not configured, it also contained the entire bash-history, including all the "failed commands" and apparently a password to something.

I guess I'll spend some time on the phone tomorrow

#linux #infosec #bored

RE: https://mastodon.social/@arstechnica/117281708855474056

I've been telling people since long before this war that if the only place you have your data backed up is in the AWS / GCP / Azure region your production app runs in, you don't actually have your data backed up (especially if it's in the same account and not protected from deletion by an admin!).
But hopefully this will get more folks to wake up and start following the 3-2-1 rule.¹
#cloud #AWS #GCP #Azure #backups #it #infosec

mmu_man boosted

Ars Technica » 🌐 2026-09-16
@arstechnica@mastodon.social

Iran strikes on Amazon data centers caused permanent loss of customer data

War damage to data centers exceeded what AWS services are designed to withstand.
https://arstechnica.com/gadgets/2026/09/iran-strikes-on-amazon-data-centers-caused-permanent-loss-of-customer-data/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social

None of this triggers conventional threat detection. No malware, no phishing kits. The problem has no label yet.

Full methodology and CenQL fingerprints: https://censys.com/blog/no-one-inside-the-machine/

#infosec #dataprotection #BackToSchool #Censys

Outsourced SOC sends us a ticket. From the contents of the ticket it appears to be misdirected, i.e., it’s a ticket for another customer.

$Boss replies to the ticket email two hours later saying it doesn’t look like our ticket.

3½ hours after that, still no response from the SOC.

I call them. While waiting for them to answer I check their ServiceNow portal and confirm that the ticket is no longer listed as active on our account.
#infosec #SOCLife
1/7

⋅ Les Français mieux informés sur les fuites de données mais plus exposés que jamais : le paradoxe inquiétant de la cybercriminalité

− https://www.usine-digitale.fr/cybersecurite/les-francais-mieux-informes-sur-les-fuites-de-donnees-mais-plus-exposes-que-jamais-le-paradoxe-inquietant-de-la-cybercriminalite.5MOC2RPWS5HEBLSW7BEM23QHQU.html

#InfoSec

uBlock Origin is a content blocker that supports the AdGuard URL Tracking filter, it may not be enabled by default.

The URL Tracking filter enhances privacy by removing tracking parameters from a URL.

Enable: Dashboard > Filter Lists > Privacy > AdGuard URL Tracking Protection (select checkbox) > Apply Changes

AdGuard post: https://adguard.com/blog/adguard-url-tracking-filter.html

Website: https://github.com/gorhill/uBlock

#uBlockOrigin #uBO #Privacy #AdGuard #URL #Trackers #FreeSoftware #OpenSource #FOSS #InfoSec #Firefox #LibreWolf

Alt...

uBlock Origin logo.

Thank you uBlock Origin!

More than 5 000 000 blocks since installation.

Some browsers such as LibreWolf, Mullvad Browser, and Tor Browser via Tails have uBlock Origin enabled by default.

Website: https://github.com/gorhill/uBlock

#uBlockOrigin #uBO #Privacy #Tails #TorBrowser #Tor #TorProject #InfoSec #Encryption #CyberSecurity #Anonymity #FreeSoftware #OpenSource #FOSS #FLOSS #Trackers #Linux #AdBlocker #ContentBlocker #LibreWolf #MullvadBrowser #Firefox #Blocker #Browser #Mullvad

Alt...

uBlock Origin logo.

Today’s #1Password follies…

The invisible-window problem I posted about recently occurred again today: when I tried to open the 1Password app the window was invisible. I was able to get the window to appear by right-clicking the icon in the dock and selecting “Quit”, waiting a few seconds for the dot to the left of that icon to disappear, and then selecting “Open 1Password” from the system tray menu.
#TechIsShitDispatch #infosec
1/4

The recent MikroTik RouterOS vulnerabilities have several conditions for exploitation.

That may make mass exploitation more difficult, but targeted attacks are another story.

@martijn_grooten and @silas break down what an attacker needs. https://censys.com/podcasts-videos/censys-arc-flash-episode-5/

#CensysARC #MikroTik #ThreatIntelligence #ThreatResearch #InfoSec #Cybersecurity

⋅ CISA: Hackers now exploit max severity GitLab flaw in attacks

− https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/

#InfoSec #CISA #Gitlab

The Deathray : un simple shader WebGPU peut geler un Mac jusqu'au kernel panic, juste en cliquant sur un lien. Reproduit sur Chrome, Firefox et Safari, uniquement sous macOS. Apple ne considère pas ça comme un problème de sécurité. ⬇️
https://auberon.xyz/blog/posts/deathray/

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-Gse

Alt...

Une page d'avertissement intitulée "The Deathray" décrivant une vulnérabilité WebGPU capable de bloquer les Mac en affichant un shader graphique malveillant, avec un symbole d'avertissement radioactif jaune et noir au centre.

⋅ Entrée en vigueur du Cyber Resilience Act

− https://www.undernews.fr/lois-justice/entree-en-vigueur-du-cyber-resilience-act.html

#InfoSec

The rumours are that the NATS system crashed because the military were test flying a Japanese WWII fighter.

When entering the flight plan they encountered a Divide by Zero error 😂🤦‍♂️

#NATS #UK #MitsubishiA6M #InfoSec

Dad just called "to let me know" that "he got an alert from Microsoft on his computer" and "he just spoke to someone from Microsoft and they're going to run some scans or something."
I explained to him, for the ♾️ time, that it's a scam, it's always a scam, it's just a scammy website popping up fake alerts. "What am I supposed to do then?" he asks me. "Just ignore it, it's a scam," I tell him, as I've told him countless times before.
Dad has a Chromebook.
🤦
#infosec #sandwichGeneration

⋅ Réseaux sociaux et OSINT : ce que vos employés révèlent sans le savoir sur votre entreprise

− https://www.clubic.com/dossier-624085-reseaux-sociaux-et-osint-ce-que-vos-employes-revelent-sans-le-savoir-sur-votre-entreprise.html

#InfoSec #OSINT

DNSforge : résolveur DNS allemand qui bloque pub, tracking et malware avant même que le navigateur y accède. Quatre profils au choix, de 1,4 à 8 millions de domaines filtrés selon le mode. Gratuit, sans logs annoncés, limité à 100 requêtes par 10 secondes. ⬇️
https://korben.info/dnsforge-dns-allemand-sans-publicite.html

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-ib1

Alt...

dnsforge.de est un service DNS public allemand qui filtre les publicités, le tracking et les malwares pour une navigation internet plus sûre et rapide. Tous les serveurs sont situés exclusivement en Allemagne.

Inspired by @klarainc's excellent video on FreeBSD hardening, I've put together a beginner's guide expanding on their walkthrough.

The goal is to break down the concepts and make these practices approachable for anyone looking to get started:

https://freebsd.toomany.net/hardening

Full credit and sincere thanks to Klara Systems for the solid foundation!

#FreeBSD #SysAdmin #InfoSec #Security

⋅ Over 36,000 exposed Plex servers vulnerable to recent flaws

− https://www.bleepingcomputer.com/news/security/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws/

#InfoSec #Plex

Hey, questions for folks on the more equipment side of #infosec.

#Faraday cage for phone and keyfob? Overkill or common sense? Prices are all over the place, assume cheap off brand are scams? Any recommendations for vendors if a practical idea?

It's kinda making me crazy that stores have started put RF readers in the carts and baskets, and readers everywhere are grabbing data they shouldn't just by driving around. Faraday sleeves seem like a good idea in theory, but I don't know if the theory is really practical, as all the tests I've found seem to be manufacturer funded.

As an aside, I wonder what happens if you're driving and you put a keyless fob in a faraday sleeve. Would the car turn off? I don't know if they continue to handshake the device once the car is on.

🤭 🤭 🤭

⋅ Cybersécurité : l’ANSSI lance son mécanisme REACTIV dédié aux services de l’État

− https://next.ink/brief-article/cybersecurite-lanssi-lance-son-mecanisme-reactiv-dedie-aux-services-de-letat/

#ANSSI #InfoSec

⋅ Google exposed personal data of victims seeking removal of image-based sex abuse material

− https://www.hani.co.kr/arti/english_edition/e_national/1276827.html

#Google #InfoSec

🔊 Researchers have demonstrated InjectEave, an electromagnetic attack that can recover intelligible audio from wired and wireless headphones up to 30 meters away—even through walls. The technique may also expose smart-home activity and phone conversations. 🛡️ #Cybersecurity #Privacy #Infosec https://cyberinsider.com/new-attack-eavesdrops-on-headphone-audio-from-30-meters-away/ #Security #Surveillance

IMPORTANT MASTODON PASSWORD SECURITY/PRIVACY ISSUE…
----

For everyone:

If you are using the same password for Mastodon that you use anywhere else, CHANGE YOUR PASSWORD NOW.

A hacker is stealing accounts using something called “credential stuffing.” This means they use email/password combinations stolen from other sites.

You can check if your email is in a data breach elsewhere:

https://haveibeenpwned.com

Create a new strong password:

1. 12+ characters
2. Capital/lowercase letters
3. At least one special character

For admins:

The hacker is using the same unique user agent.

Go-http-client/1.1

We’re seeing a pattern of IPs, but they’re from varying ISPs. They’re also not changing the account emails.

#Mastodon #Password #InfoSec #OpSec #Security #Privacy #Hacked #Hacker

Today's policy audit pet peeve: why are you paying me hundreds of dollars per hour to tell you that the list of policies at the top of your Information Security Policy is missing three policies and has the wrong title for a fourth.
Like, honestly, this is something you could/should have figured out without the help of a contractor.
#infosec #compliance

Clicked through to read article about the LG Smart TV spying, only to get this …
#privacy #infosec

Alt...

Screenshot of cookie permission banner saying “we value your privacy” while asking to share my data with 1745 other parties.

⋅ [Édito] Et si on arrêtait d’introduire des chevaux de Troie dans nos foyers ?

− https://next.ink/254639/edito-et-si-on-arretait-dintroduire-des-chevaux-de-troie-dans-nos-foyers/

#InfoSec

Today's pet peeve from reviewing an advisory client's #infosec policies:
1) compliance mills who give their clients a business continuity _policy_ mislabeled as a business continuity _plan_ so they can claim for compliance purposes that a plan exists when it really doesn't; and
2) auditors who let audit subjects get away with calling a policy a plan, rather than dinging them for it and making them create a real plan.
#compliance #soc2 #iso27001

The thing I see over and over in bad AUPs written by consultants is their tendency to just drop random policy snippets into the AUP—snippets which have nothing whatsoever to do with ACCEPTABLE USE—so the auditors will see them.
It's called an Acceptable Use Policy because what you're supposed to put into it is rules for your personnel about what constitutes Acceptable Use.
For the love of God, put all that other crap in your Information Security Policy or something.
#infosec

*sigh*
I'm doing some advisory work for a small tech startup helping them level up their information security program.
Today I started reviewing their infosec policies, starting with their Acceptable Use Policy.
Their AUP was basically airdropped in by the consulting firm that helped them get SOC 2.
It. Is. Terrible.
If these SOC 2 mills are going to use the same template docs for all their clients, couldn't they at least put in the effort to make them decent? 😠
#infosec

I forgot who does the #RunBSD stickers. I'd like to share some with local #infosec groups, like Hackers N Hops.

@james_inthe_box This is awesome and why I absolutely rely on uBlock Origin. Question: does this protection work in and is included in uBlock Origin Lite (uBOL)?

#ublockorigin #privacy #infosec

⋅ IDScan sued over alleged data breach affecting 153 million drivers

− https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/

#InfoSec

Sur Bluesky, PDS public, likes visibles, métadonnées exposées : tout se recoupe facilement. ATProto a résolu la modération et la portabilité d'identité de Mastodon, mais sa transparence par défaut coûte cher en vie privée. ⬇️
https://eventuallycoding.com/p/le-piege-de-la-transparence-par-defaut-sur-bluesky-et-le-protocole-atproto

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-bkx

Alt...

Image d'un titre d'article blanc sur fond bleu marine annonçant "Le piège de la transparence par défaut sur Bluesky et le protocole ATProto", suivi d'un sous-titre expliquant que sur Bluesky, les PDS publics, likes visibles et métadonnées sont exposés, et que la transparence a un coût.

PostGREShell: Decade-Old PostgreSQL Flaw Turns Backup Accounts into Backdoors

PostgreSQL patched a vulnerability (CVE-2026-6471) that allows attackers with low-privilege replication access to execute arbitrary code and gain full superuser control. The flaw, present since 2014, enables persistent backdoor access across Windows, Linux, and macOS environments.

**If you run PostgreSQL, update immediately to version 18.6, 17.11, 16.15, 15.19, or 14.24 to fix CVE-2026-6471. Then review who has the REPLICATION permission and remove it from anyone who doesn't need it, restrict replication access in `pg_hba.conf` to trusted IP addresses only, and block outbound SMB and NFS traffic from your database servers.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/postgreshell-decade-old-postgresql-flaw-turns-backup-accounts-into-backdoors-8-u-r-l-n/gD2P6Ple2L

Saylafete… ou pas ! 🤦

⋅ L’Hôpital privé de Loire sanctionné pour absence de « mesures élémentaires de sécurité »

− https://next.ink/254472/lhopital-prive-de-loire-sanctionne-pour-absence-de-mesures-elementaires-de-securite/

#InfoSec

The next Censys ARC Flash is September 9 at 11 AM ET.

Join the Censys ARC team for a timely briefing on the research, threats, and Internet activity they're tracking, followed by a live Q&A where you can ask the researchers your questions directly.

Register to attend live:
https://info.censys.com/arc-webcast

#CensysARC #ThreatResearch #ThreatIntelligence #InfoSec #CyberSecurity

Alt...

Episode 5 Censys ARC Flash Live Threat Intel Briefing Sept 9 11am

Omarchy: Any User Process Can Escalate to Root

A security issue in Omarchy’s default Docker configuration meant that essentially every program running in the user’s desktop session could escalate to root without a password, sudo, or a privilege prompt.

If you use Omarchy, the most important takeaway is simple: don't

https://0xcc.io/posts/omarchy-root-creds/

#fasctech #omarchy #fascism #infosec

Whats the standard procedure for Manual pages that reference an old email that clearly no longer works in the Author section? Yes, it was the authors email at the time of the commit, but the domain is no longer theirs.. Just leave it be, track down the email they use now, remove it for security reasons? #FreeBSD #Linux #InfoSec

⋅ Cyberattaque sur Zéro Logement Vacant : anatomie d'un effet domino ministériel

− https://www.zdnet.fr/actualites/cyberattaque-sur-zero-logement-vacant-anatomie-dun-effet-domino-ministeriel-500876.htm

#Hacking #InfoSec

Flock's response to published vulnerabilities: 'nuh uh'.
#infosec #surveillance #flock

https://youtube.com/shorts/I_y7OjsI1Zk?is=Wl3QYgW8DJd4apWT

Airgorah : outil d'audit sécurité WiFi en Rust, basé sur aircrack-ng. Capture le trafic, désauthentifie les clients, récupère les handshakes et casse les mots de passe. ⬇️
https://github.com/martin-olivier/airgorah

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev, chaque vendredi par email → https://l.camilleroux.com/sig-GPy

Alt...

Capture d'écran d'un outil d'audit de sécurité WiFi affichant une liste de réseaux détectés avec leurs paramètres techniques (SSID, fréquence, canal, puissance du signal, type de chiffrement) et des informations de connexion des clients associés.

...Leading developers of the most powerful artificial intelligence tools are warning that their technology may soon be used to carry out sophisticated cyberattacks against companies and institutions, ranging from hospitals to technology firms...

'The guns we are selling might kill people' is not great PR. 🤣

https://www.cbsnews.com/news/openai-anthropic-ai-cyber-threat-warning/

#ai #cybersecurity #infosec

Censys observes ~102,000 UniFi OS management interfaces exposed to the Internet. And among ~50,000 UniFi Network hosts we can map to a specific release, 90% are running a vulnerable build.
There is currently no evidence of exploitation. Patches are available. Prioritize UniFi OS updates and remove management interfaces from direct Internet exposure.
Read the full Censys analysis: https://censys.com/advisory/cve-2026-77550-cve-2026-77549-cve-2026-77550/

#Cybersecurity #InfoSec #VulnerabilityManagement #CVE202677550

How to build a free Certificate Transparency Search Engine, so that anyone can search (grep) certificates, with full regular expression (regex) support - Detailed technical Article about certgrep Web service #Infosec https://haveibeensquatted.com/blog/building-certgrep

Dear everyone who organizes #conferences, do a better job of describing what people get for their money. The titles "briefings" "summit" and "business" don't mean anything to people who haven't attended before.

Yes, I'm looking at you sector black hat ...

https://blackhat.com/sector

#infosec #cybersecurity #publicity #communication #marketing

Okay, I've reviewed the receipts, and I can unequivocally¹ say #FuckNetworkChuck. I will no longer be watching his videos, and will happily tell others what a homophobic douch-canoe he is.

@deviantollam https://defcon.social/@deviantollam/117169160800717181

¹ unless someone proves all those Facebook screenshots from his account were faked or something; the posts seem pretty damn damning

#InfoSec #Hacking #LGBTQ

i have a spare Ticket (my speaker voucher) for Romhack Camp ( https://romhack.io/ ), the Hacker Camp in Rome early October by CyberSaiyan!

Ticket allows entry to the camp and a tent-spot. i dont need it since i already have a ticket, so i would like to give it away to someone that would otherwise not be able to come. (and yes CyberSaiyan said its ok:D)

preferrably to someone from an underrepresented groups who will actually use it to join us!
#infosec #hackercamp @cybersaiyan @milliways

ok #infosec #browser #android folks: i have a weird thing happening with #localization:

even though i have android set to EN_CA, it looks like sites are reaching for info of my keyboard to set ―what they think― is my actual language.

this is a multilingual keyboard that i use to write in 4 languages. the fuckers think am monolingually french. i thought this was only a Google/Youtube fuck up but now Trackt is doing it too.

WTAF?!?!?

how can i block this stupid #fingerprinting?

#TechIsShitDispatch #infosec @dumbpasswordrules
I'm doing some infosec advisory, and the company sent me a MacBook to access their systems.
I tried to change my password and got this.
WTF does "consecutive" and "sequential" mean in this stupid rule?
The password I tried to use is the randomly generated "guided-paid-byrne1".
It rejects that obviously secure password.
It pisses me off when security engineers don't use zxcvbn or the equivalent.

Alt...

macOS login password change window which lists the following password requirements: 🗸Contain at least one number and one alphabetic character. 𐄂Not have two consecutive or three sequential characters. 🗸Not be the same as the previous 15 passwords. 🗸Contain at least 15 characters. 🗸Enter a password that is four characters or more.

🚨 Two Microsoft SharePoint vulnerabilities

CVE-2026-55040 + CVE-2026-63520 can be chained to bypass authentication and achieve remote code execution.

The flaws are in CISA’s KEV catalog, a public PoC is available, and patches are available.

Censys sees 329,000 Internet-facing SharePoint servers.

Read the advisory: https://censys.com/advisory/cve-2026-55040-cve-2026-63520/

#Cybersecurity #SharePoint #Vulnerability #InfoSec

Alt...

Map of Microsoft SharePoint Server hosts seen by Censys

That's like whipping the messenger. How can people be so ignorant

@stefano

#WordPress #hosting #InfoSec

⋅ AliExpress diffusait discrètement des signaux audio inaudibles via le navigateur pour créer une empreinte numérique unique permettant d'identifier et de suivre les appareils des utilisateurs

− https://securite.developpez.com/actu/386424/AliExpress-diffusait-discretement-des-signaux-audio-inaudibles-via-le-navigateur-pour-creer-une-empreinte-numerique-unique-permettant-d-identifier-et-de-suivre-les-appareils-des-utilisateurs/

#InfoSec

Happy Anniversary!

Announcement: 25.08.1991

Thank you to everyone that has contributed to the project.

Website: https://www.kernel.org/linux.html

#Linux #OpenSource #FOSS #FreeSoftware #FLOSS #SoftwareLibre #LinuxLibre #FSFLA #FSF #GNU #Privacy #InfoSec #CyberSecurity #Mint #MXLinux #Debian #EndeavourOS #PopOS #Manjaro #Ubuntu #Fedora #Zorin #openSUSE #NixOS #Garuda #AlmaLinux #Kali #Tails #Kubuntu #Devuan #Slackware #Arch #RHEL #Gentoo #QubesOS #Gnuinos #Trisquel #Dynebolic #Guix #Parrot #RaspberryPi

Alt...

Linux logo.

ATTENTION YouTubers

Please provide a PeerTube option in addition to your YouTube account.

EXAMPLE

The Linux Experiment

Website: https://tilvids.com/c/thelinuxexperiment_channel/videos
Fediverse: @thelinuxEXP @thelinuxexperiment

PEERTUBE

Website: https://joinpeertube.org
Fediverse: @peertube @Framasoft

THANK YOU

#Google #YouTube #YouTuber #YouTubers #deGoogle #Framasoft #PeerTube #FreeSoftware #FOSS #FLOSS #SoftwareLibre #OpenSource #Privacy #InfoSec #Fediverse #Video #Decentralized #SelfHost #SelfHosting #ActivityPub

Alt...

PeerTube logo.

AliExpress Silent WebAudio Fingerprinting Uses Bluetooth Hardware

AliExpress uses hidden WebAudio graphs to fingerprint devices, which blocks Bluetooth multipoint headphones from switching audio sources. The tracking relies on obfuscated scripts that maintain an active audio pipeline even when muted.

**If you shop on AliExpress and your Bluetooth headphones stop switching between devices, this is caused by hidden tracking scripts on the site, not broken hardware. Install uBlock Origin and add filter rules to block `collina.js` and `fireyejs.js` on aliexpress.com, then close all open AliExpress tabs and reload the site for the fix to take effect.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/aliexpress-silent-webaudio-fingerprinting-uses-bluetooth-hardware-9-o-c-m-i/gD2P6Ple2L

AliExpress Silent WebAudio Fingerprinting Uses Bluetooth Hardware

AliExpress uses hidden WebAudio graphs to fingerprint devices, which blocks Bluetooth multipoint headphones from switching audio sources. The tracking relies on obfuscated scripts that maintain an active audio pipeline even when muted.

**If you shop on AliExpress and your Bluetooth headphones stop switching between devices, this is caused by hidden tracking scripts on the site, not broken hardware. Install uBlock Origin and add filter rules to block `collina.js` and `fireyejs.js` on aliexpress.com, then close all open AliExpress tabs and reload the site for the fix to take effect.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/aliexpress-silent-webaudio-fingerprinting-uses-bluetooth-hardware-9-o-c-m-i/gD2P6Ple2L

LetsSeal certifie n'importe quel fichier : authenticité, intégrité, antériorité, ancré en blockchain et embarqué directement dans le fichier. Pas de compte, pas de serveur tiers, vérifiable par quiconque. Open source et gratuit. ⬇️
https://letsseal.org/

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev de la semaine → https://l.camilleroux.com/veille-5DN

Please keep your WordPress sites updated. For the bazillionth time.

https://www.techradar.com/pro/security/experts-warn-2-000-hacked-wordpress-sites-were-secretly-running-a-global-crime-ring

#WordPress #infosec #cybersecurity

Remember #FirstManufacturing either selling my email address or letting it be stolen and refusing to admit to either?
The evidence that this happened just got more concrete: yesterday, I received spam to that address from another merchant, _and it mentions First Manufacturing in the header_.
I've emailed the company again and await their response. I also posted a 1-⭐️ review on Google Maps.
Details here if you're curious: https://blog.kamens.us/2026/07/18/first-manufacturing-co-selling-customer-email-addresses-in-violation-of-its-own-privacy-policy/#update0822
#infosec #privacy #spam #breach

This Week in Security: How residential proxy networks are hiding hackers in your home https://this.weekinsecurity.com/how-residential-proxy-networks-are-hiding-hackers-in-your-home @zackwhittaker #infosec #botnet #cybercrime

⋅ Hackers infect Android car head units with proxy botnet malware

− https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/

#InfoSec

“Microsoft has reportedly shared the names of Dutch civil servants…with the U.S. House of Representatives…

The civil servants involved are working on implementing the Digital Services Act (DSA), the European law that forces online platforms to take stricter action against illegal content, online child sex abuse, and disinformation.”

—> To enable retaliation, EU leaders please wake up

https://nltimes.nl/2026/05/22/microsoft-accused-leaking-dutch-civil-servants-names-us-government

#Microsoft #USPol #EUPol #Digital #Privacy #Infosec #Nederland #EU #Geopolitics

Google-synced passkeys can be hijacked by malware already running on Windows, researchers found, without breaking passkey cryptography. 🔐
Three “Pass-ta-key” attacks can abuse device trust, recovery, or extract the master key. ⚠️

🔗 https://www.bleepingcomputer.com/news/security/new-pass-ta-key-attacks-let-malware-hijack-google-synced-passkeys/

#TechNews #Passkeys #Google #Cybersecurity #Malware #Authentication #Privacy #Security #Encryption #Identity #CloudSecurity #Technology #Infosec

Le ministère de l’intérieur piraté depuis la boîte mail d’un fonctionnaire : autopsie d’une intrusion qui révèle les failles informatiques de l’Etat
https://www.lemonde.fr/societe/article/2026/08/20/le-ministere-de-l-interieur-pirate-depuis-la-boite-mail-d-un-fonctionnaire-autopsie-d-une-intrusion-qui-revele-les-failles-informatiques-de-l-etat_6751123_3224.html

#InfoSec

My uncle just received the email on the left from a Hotmail address. The name in the email is his (and my) cousin, but the email address is one she hasn't used before to my knowledge. I replied to that address wishing "her" a full recovery, and "she" replied with the email on the right, making it clear that this is a #phishing #scam. I wrote back, "Ah, OK, so this is a scam. Thanks for clarifying!" and reported it to Microsoft.
#infosec

Alt...

Screenshot of email. Body: Congratulations to me! My Knee replacement surgery went well yesterday. I’ll be in the hospital and rehab for two weeks. Keep me in your prayers Hugs❤️ [name]

Alt...

Email to me screenshot. Body: I am improving at the hospital; however, my hospital stay will be no longer than 7 days. After that, I will either go home or to a rehab facility for a week before returning home. Please, I need a favor from you. I've been trying to order an ( Apple Gift Card E-mail Delivery ) for my friend on Amazon. It's her birthday, but it says they are having issues charging my card. I called my bank, and they told me it would take a couple of days to get it resolved. I was wondering if you could help me purchase an Apple gift card over there from your Amazon account? Let me know if you can handle this for me; you can send it to my email address. I will forward it to her as soon as I receive it from Amazon. I am only looking to spend $100 on it. I will definitely reimburse you. Hugs ❤️ [name]

Mailvelope is a browser extension for email encryption via webmail clients.

Compatible with clients such as Gmail and Roundcube.

Supports client-side encryption via PGP/GPG.
Supports Firefox, Edge, and Chrome browsers.

PGP: https://wikipedia.org/wiki/Pretty_Good_Privacy
GPG: https://wikipedia.org/wiki/GNU_Privacy_Guard
Client-side encryption: https://wikipedia.org/wiki/Client-side_encryption

Website: https://mailvelope.com
Mastodon: @mailvelope

#Mailvelope #Encryption #Privacy #InfoSec #CyberSecurity #FreeSoftware #Google #Gmail #E2EE #FOSS #Roundcube #PGP

Alt...

Mailvelope logo.

hé ! rigolez pas ! on a déjà un nouveau robinet ouvert à la #DGFIP !
https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/la-direction-generale-des-finances-publiques-annonce-une-troisieme-fuite-sur-des-donnees-liees-aux-successions-vacantes-rapidement-coupee_8152328.html

#donnéespersonnelles #infosec

RE: https://framapiaf.org/@Crayon_Laser/117115568279465650

"Et l'état français considère que l'éducation au numérique pour l'ensemble de la population n'est toujours pas une priorité."

Bah non bien sûr, ça rapporte pas d'pognon aux copains, c'est achtement plus *sTaRtuP nAtiOn* de faire des cours d'ia de merde là

#Infosec
#NightmareOnLLMstreet
💩

Wallace boosted

Crayon Laser » 🌐 2026-08-18
@Crayon_Laser@framapiaf.org

Pour rappel/info, la France est le pays européen le plus piraté en 2026, et est classé deuxième en la matière dans le monde.

À priori, la plupart de ces fuites viennent de problèmes d'interface chaise-clavier.

Et l'état français considère que l'éducation au numérique pour l'ensemble de la population n'est toujours pas une priorité.

https://www.frandroid.com/culture-tech/3214203_education-nationale-la-troisieme-fuite-de-donnees-expose-122-million-deleves

⋅ Cybersécurité et voitures électriques : les bornes de recharge présentent des risques

− https://www.undernews.fr/reseau-securite/cybersecurite-et-voitures-electriques-les-bornes-de-recharge-presentent-des-risques.html

#InfoSec

🥳 🥳 🥳

⋅ L’Éducation nationale se fait pirater par le hackeur des impôts : 43 Go de données dans la nature (personnels, élèves…)

− https://www.lesnumeriques.com/societe-numerique/l-education-nationale-se-fait-pirater-par-le-hackeur-des-impots-43-go-de-donnees-dans-la-nature-personnels-eleves-n260530.html

#InfoSec #EducNat #Hacking

Read our Mirai research: https://censys.com/blog/mirai-and-its-heirs-a-decade-of-structural-neglect-in-iot-security/

#CensysARC #Mirai #IoT #IoTSecurity #Cybersecurity #InfoSec #InternetSecurity

NEW, by me:

More than 2 million user records from TaxAct allegedly acquired; 450k already leaked

https://databreaches.net/2026/08/17/more-than-2-million-user-records-from-taxact-allegedly-acquired-450k-already-leaked/

#infosec #databreach #taxact #incidentresponse

@campuscodi

RE: https://tldr.nettime.org/@tante/117109449547518347

Cannot wait for the first zero-day traced back to Claude watermarking.

And the inevitable debate on whether that counts as an intentionally placed backdoor.

#InfoSec

Joachim boosted

tante [he/him] » 🌐 2026-08-17
@tante@tldr.nettime.org

"Claude watermarks your code now."

Dude. It's not yours, you didn't write it.

@briankrebs Have you ever gotten this notification 🔔 📳 😨 🤦🏼 😱 #infosec

Alt...

- threat-notifications@apple.com 10:59 To: tial ALERT: Apple detected a targeted mercenary spyware attack against your iPhone # ALERT: Apple detected a targeted mercenary spyware attack against your iPhone Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple Account icloud.com-. This attack is likely targeting you specifically because of who you are or what you do. Although it's never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously.

Happy Anniversary!

Founded: 16.08.1993

Thank you to everyone that has contributed to the project.

Website: https://www.debian.org
Mastodon: @debian

#Debian #Linux #FreeSoftware #OpenSource #FOSS #Privacy #InfoSec #CyberSecurity #GNU #DebianDay #Devuan #FLOSS #SoftwareLibre #LibreSoftware #SoftwareFreedom #Computer #Computing #Technology #Tech

Alt...

Debian logo.

RE: https://mastodon.social/@zackwhittaker/117099853139453682

LIKE AND SUBSCRIBE!

#infosec #cybersecurity #privacy #IT #newsletter

AodeRelay boosted

Zack Whittaker » 🌐 2026-08-15 / 2026-08-15
@zackwhittaker@mastodon.social

Every Sunday in my newsletter https://this.weekinsecurity.com, I hand-curate all the most important cyber stories you need to know from the week, and deliver it up with good news and a reader-submitted cyber cat (or friend).

No slop, and no email open/link tracking (for your privacy!) Sign up/RSS today. 🐈‍⬛

@briankrebs #infosec

Alt...

1 2 | Malware Blocked and Moved to Trash “Codex.app” was not opened because it contains malware. This action did not harm your Mac. CO eee Ee

Last night I "discovered" a vulnerability in a very widely used open-source tool. The tool is nearly 40 years old, and the vulnerability is at least 28 years old.

Interestingly, Apple has a fix included that dates it back to 2008, but it appears for whatever reason the fix never made it to upstream.

Result? Everyone else is vulnerable today. I am not pointing fingers here, but clearly something went wrong.

I've now reported the issue upstream, which will hopefully eventually lead to a fix being distributed to every affected platform.

I am not going to disclose the details of the vulnerability right now, even though the fix has been public for a very, very long time now. As far as I can tell, most Linux and BSD systems are vulnerable right now, so letting coordinated disclosure happen only makes sense.

#infosec #cybersecurity #vulnerabilityresearch

Piratage du SI de la #DGFIP
> Les usagers concernés recevront une information individuelle précisant les données susceptibles d'avoir été consultées ou extraites

https://presse.economie.gouv.fr/acces-illegitime-au-systeme-dinformation-de-la-direction-generale-des-finances-publiques/

#donnéesPersonnelles #infosec

This #FreeBSD bug is exactly why #HardenedBSD makes using the Linuxulator incredibly difficult and painful: emulation/compatibility layers are extremely complex and tend to have weird issues that can turn into exploitable vulnerabilities if one isn't careful.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297426

#Linux #infosec

1) What could possibly go wrong?
2) If the Chinese, Russian, and North Korean all coordinate offensive cyber with private companies doing the bidding of the government, why shouldn't the U.S.? /s
#infosec
https://techcrunch.com/2026/08/13/in-a-first-us-will-allow-some-private-firms-to-carry-out-cyberattacks/

⋅ Phantom Stealer Hides Inside PNG Files, Then Steals Your Passwords, Cookies and Crypto

− https://cybersecuritynews.com/phantom-stealer-inside-png/

#InfoSec #Phantom

I think perhaps the thing I hate most about working in #infosec oversight is having to chase after the people who think their work is too important to be interrupted by something as mundane as required security awareness training.
Buddy, if the CEO can find the time to do the training, then so can you.

Storing private key material in dumpable mappings: security vulnerability? What say ye? Yay or nay?

#infosec

⋅ Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

− https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/

#InfoSec

If Microsoft keeps patching hundreds of vulnerabilities per month "thanks to AI helping find vulnerabilities," then eventually they're going to find and fix them all and the rate of patching will go down, right?
Right?
#infosec

Anybody any news on DNS-PERSIST-01? It would allow me to simplify some things massively, once it's available…
https://letsencrypt.org/2026/02/18/dns-persist-01

#SysAdmin #InfoSec #DevOps #LetsEncrypt

This article by #Okta is so bad it's funny:
https://www.okta.com/identity-101/evil-twin-attack/

Not only do they bend over backwards to cram as many "hackers" there as possible (hackers are what editors crave!), but it also seems like they are not aware of HTTPS, HSTS, and how browsers warn users when credentials are being requested via unencrypted connections.

> [attacker] can see all the login details and save them for later use.

Not they can't. Stop parroting stuff that has not been true for a decade.

#InfoSec

C'est ballot !

⋅ Bloctel piraté juste avant de fermer : 3 millions d'inscrits sont maintenant exposés

− https://www.clubic.com/actualite-625006-bloctel-pirate-juste-avant-de-fermer-3-millions-d-inscrits-sont-maintenant-exposes.html

#InfoSec

I really, really blame the slavish mainstream media for dumb headlines like this. Give this guy his pilates class in jail.

BBC: AI agent hacks gym to get its owner spot in pilates class https://www.bbc.com/news/articles/cn0nww2qlp7o @BBCNews #infosec

Today's #TechIsShitDispatch adjacent gripe ( #infosec adjacent as well)…
Uncle loses his debit card while out on the town with a friend. I call #Chase to get it replaced. They say even though I have POA for Uncle they still need him on the phone to issue a replacement.
They can't call him to conference him in, they need me to do it.
I'm using Fi Web Calls for this call, which doesn't support conference calls, so I have to hang up and start over. (1/5)

@briankrebs #infosec

Alt...

< From delta community on Reddit 10:53 7 wll FE fool - Pilot Messages « 1001ve Live cockpit ACARS, intercepted Q DAL591 [x N6705Y REICH ACARS history is limited to the last 24 hours DLO517 DL2990 DL0918 DLO7 © 2 messages o System 16:512 "091630 KLAS KATL6 A NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFRENCE IN LAS THE WERE ABLE TO JAM OUR WIFI AND BRODCAST THERE SIGNIAL" o Crew 16:34 "091630 KLAS KATL6 A HEY ALERT CORP SECL WE HAVE A PAX ON TH. 4 tryflightdeck.com HAS CREATED A SCAM Wir CALLED DELTA WIFI FAST WE BELIEVE THEY ARE TRYING TO SCAM THE OTH PAX"

I work in #infosec and consider myself pretty well educated on what’s happening with #AI.

But I’m about 33% of the way through @emilymbender and Alex Hanna’s book, “The AI Con”, and I’ve really learned a lot more.

If you’re skeptical or curious about AI, this is a must-read. I’m recommending it to everyone I know.

“The AI Con: How to Fight Big Tech's Hype and Create the Future We Want”, by Emily M. Bender and Alex Hanna

Edit: Added text in this post with the title and authors. It's also in the image's ALT text. Sorry!

#books #bookstodon #reading #AI #technology #nonfiction

Alt...

“The AI Con: How to Fight Big Tech's Hype and Create the Future We Want”, by Emily M. Bender and Alex Hanna

⋅ Mozilla updates GPG signing key for Firefox releases after exposure

− https://www.bleepingcomputer.com/news/security/mozilla-updates-gpg-key-for-signing-firefox-thunderbird-releases-after-exposure/

#InfoSec #Mozilla

RE: https://mastodon.social/@zackwhittaker/117070977275313717

in 2009 Zuckerberg had mouthpieces at a Friends Of OReilley camp crowing about how privacy was a privilege only for those with the money for it.

it is so obvious now that Facebook ―and Twitter and mobile phones― was the full privatization of the DoD’s octopus project and not the stupid myth of a scripty kid setting up a tricked out forum so he could stalk ivy league girls.

this is adversarial in a “only the rich were generals in the american revolution” sort of way

#sewing #fashion #infosec

BrianKrebs boosted

Zack Whittaker » 🌐 2026-08-10 / 2026-08-10
@zackwhittaker@mastodon.social

Bill Swearingen spent the past year developing a pattern that can defeat being detected by surveillance cameras, including vehicles and people. At Def Con, for the first time, he demoed the pattern printed on a car against a Flock camera to prove it works. (One of my favorite talks from Def Con this year!)

More by me at TechCrunch: https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

Ad-blocker bypass: https://web.archive.org/web/20260810033558/https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

Dangerzone converts potentially dangerous documents into a safe PDF.

Linux container creates an isolated environment.
Sandbox is created inside the container, no network or filesystem access.
Sanitization process is performed in the sandbox.

Imagine printing a document and then scanning the printed document to remove malicious content, this concept is what the software does to sanitize the document.

Website: https://dangerzone.rocks
Mastodon: @dangerzone

#Dangerzone #InfoSec #CyberSecurity

Alt...

Dangerzone logo.

https://dangerzone.rocks/

PDFs are one of the most reliable ways attackers deliver malware.

A single infected file can quietly install spyware, steal credentials, and give attackers the entry point they need to move across a network.

Source: https://proton.me/business/blog/pdf-virus

Consider Dangerzone: https://mastodon.online/@blueghost/111481509766955614

Developed by Micah Lee / @micahflee
Maintained by Freedom of the Press Foundation / @freedomofpress

#Dangerzone #InfoSec #CyberSecurity #FPF #Proton #ProtonMail #Privacy #Linux #MicahLee #FreeSoftware #FOSS

Alt...

Dangerzone logo.

If your company uses #Atlassian products, you might want to consider disabling #Rovo, at least until this vulnerability is patched. Or what the heck, when your users discover they don't actually need it, leave it turned off, thus permanently reducing your attack surface area. 🤷
https://www.promptarmor.com/resources/atlassian-rovo-exfiltrates-data
#PromptArmor #AI #infosec #ThreatIntelligence

Yopass : partage de secrets, mots de passe et fichiers via des URLs à usage unique, avec chiffrement bout en bout côté navigateur. La clé de déchiffrement ne quitte jamais votre machine. Sans compte, sans tracking, self-hostable. ⬇️
https://github.com/jhaals/yopass

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev de la semaine → https://l.camilleroux.com/veille-rJJ

Dear Microsoft,

I do not need anything related to XBox or gaming on my employer-owned work laptop.

He who does not like bloat (especially on work equipment),

#infosec dude

Un zéro mal interprété dans le firmware Coldcard a rendu les clés Bitcoin devinables pendant cinq ans : 1 082 BTC vidés en 41 minutes le 30 juillet, sans toucher aux appareils, juste en recalculant les seeds depuis l'entropie réduite. ⬇️
https://korben.info/un-zero-mal-interprete-dans-le-firmware-coldcard-a-rendu-les-cles-bitcoin-devinables-pendant-cinq-ans.html

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev de la semaine → https://l.camilleroux.com/veille-SVZ

Alt...

Plusieurs portefeuilles matériels Coldcard Mk5 en différentes couleurs transparentes (orange, vert, violet, bleu, gris), affichant leur clavier numérique et l'écran avec l'inscription « Coldcard Wallet ».

#FirstManufacturing now says they are investigating how the unique email address I gave only to them ended up in the hands of another merchant, #LeatherNewYork. They also continue to deny any information was leaked, which is clearly false, and I wrote back and told them so. Additional details here if you're curious:
https://blog.kamens.us/2026/07/18/first-manufacturing-co-selling-customer-email-addresses-in-violation-of-its-own-privacy-policy/#update0804
#infosec #privacy #spam #breach

#mutualaidrequest #mutualaid

I don't suppose that I have any #bsd #unix #foss #infosec friends out there willing to signal boost, by chance? ​ ​

https://bsd.network/@brynet/114458997143046937

FYI: if anyone is using the tinc VPN daemon or protocol (https://tinc-vpn.org/), you have to keep in mind that your peer name WILL get sent in cleartext before establishing the proper encrypted connection. Specifically, the string "0 your-peername protocol-version" will be sent at the very beginning.

To me that is not a deal breaker, but it is something you have to keep in mind if you do not want the peer names you use to be public (e.g. I use my hostnames, and some people put a lot of things in those).

#security #infosec

John Oliver on police surveillance tech: https://youtu.be/lnBPhelCdWE

#infosec #privacy #HumanRights

Censys IOC Investigator closed beta launches August 10. Give it an indicator, a bulk list, or a raw intel report — it runs pivots, history checks, and host profiling in parallel across the Censys Internet Map, then returns ranked findings with the evidence and source queries attached.

This started as internal tooling Censys ARC researchers built to scale their own investigations. That's what powers it today, the same process, same Internet intelligence, now available in the platform.

https://censys.com/blog/introducing-censys-ioc-investigator/

#infosec #threatintelligence #CensysARC #threatintel

Want to detect intruders before they reach your real systems?

OpenCanary is a free, open-source network honeypot that emulates common services and sends instant alerts when someone interacts with them. It's lightweight, easy to deploy, and works on Linux, macOS, Docker, and Raspberry Pi.

More details: https://digitalescapetools.com/tools/tool.html?id=opencanary

#OpenSource #CyberSecurity #InfoSec #Honeypot #SelfHosting #Privacy #Linux #Homelab #FOSS

Alt...

Screenshot of the OpenCanary project page describing the lightweight network honeypot with passing GitHub test, Docker build, and PyPI badges.

⋅ Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted

− https://www.phoronix.com/news/Arch-Linux-AUR-Adoptions-Halted

#ArchLinux #Gnu #Linux #InfoSec

Good morning, folks.

We're observing an intensifying set of overlapping campaigns targeting Okta and M365 credentials to facilitate enterprise data exfiltration and ransom. I've pulled some initial thoughts together over at @ifin as well as a refined CSV of 133 suspect domains.

#threatintel #infosec #cybersecurity

Cohesive writeup: https://discourse.ifin.network/t/newly-observed-vishing-phishing-campaign-targeting-retail-finance-fintech-more/702

CSV: https://drive.proton.me/urls/1FRBB06NK8#I8wgJDlbMULS

instagram_monitor : un outil Python pour surveiller un compte Instagram en temps réel, stories, changements de bio, évolution des abonné·es, photos de profil. Dashboard web local et alertes instantanées inclus. Self-hosted, dispo sur PyPI et Docker. ⬇️
https://github.com/misiektoja/instagram_monitor

#CyberSecurity #InfoSec #Privacy

📬 Ma veille dev de la semaine → https://l.camilleroux.com/veille-NyB

@dalias @khm

*sigh* this is why I made no attempt to get back into #infosec.

If I wanted to be in "the theater," I'd act. 😄

Anybody else get signed out of their #Sony #PlayStation account recently on their PS, and then get told when trying to sign back in that their account has been locked and they need to change their password?
I don't know of any reason why my account would have been locked. I am wondering if there is a new security incident that they haven't disclosed yet.
#infosec

The following #HardenedBSD quarterly branches have been updated:

1. 15-STABLE: quarterly/hardened/15-stable/main-2026q3
2. 16-CURRENT: quarterly/hardened/current/master-2026q3

I'll kick off new builds tonight before going to bed.

#FreeBSD #infosec

The new #HardenedBSD 2026q3 builds have been published for both 16-CURRENT and 15-STABLE. This update includes the security fixes from yesterday.

#FreeBSD #infosec

The full report is available this fall. Pre-register to get it as soon as it publishes.

https://censys.com/blog/state-of-the-internet-2026-preview/ #CensysARC #infosec #threatintelligence #AIrisk #exposuremanagement

Today is #FreeBSD Security Advisory day. I will cherry-pick the fixes into the relevant #HardenedBSD quarterly branches today.

I will probably kick off new builds either tomorrow (Thursday) or Saturday.

#infosec

Portmaster: a free and open-source Application Firewall for Windows and Linux. Monitor every Network Connection on your Computer and set per-application Rules for what to block - Project by IVPN #Infosec #Network https://safing.io/

I got a notice I could get 2 years of identity monitoring from Kroll due to a breach with U of MN. I see that Kroll is a pretty large firm, but I also found a lot of people online with negative comments about Kroll and saying just locking/freezing your credit monitoring is the best thing you can do. I've already done that a long time ago. Any thoughts on Kroll or the usefulness of giving them identifying data about myself through their online enrollment form? I'm leaning against it. #privacy #infosec

PS:

LAST #BANKING #INFOSEC QUESTION

4) what’s up with banks using automated phone operators that ask for your #socialSecurity number AND bank account number. aren’t they supposed to NOT make it easy for 3rd parties to get that information? why are they demanding it to take a phone call they are obligated, by law, to answer?

these questions obviously apply only to the United States.

#USpol

⋅ Microsoft Defender for Endpoint Update Leaves Linux Servers Unprotected After Reboot

− https://cybersecuritynews.com/defender-for-endpoint-update-linux/

#InfoSec #Linux #Microsoft

A QUESTION TO #INFOSEC TOOTERS

had a friend call me about suspicious emails from their bank. they didn't respond but checked their accounts with the bank’s app. they saw transactions they didn't do but that were marked as done thru the app.

they wanted to know what to do. i told them:

1. call whichever fraud/stolen bank card number they found on the website immediately.
2. freeze the app but don’t uninstall yet
3. go to the bank immediately monday

they did so and called with updates… 🧵

Sont forts ces ricains (non) !

⋅ Un fabricant d'alarmes auto expose 2,2 millions de véhicules à un vol par Bluetooth

− https://www.clubic.com/actualite-622717-millions-de-voitures-avec-antivol-installes-en-concession-plus-exposees-au-vol-selon-une-etude.html

#InfoSec

Plexfiltration update: the AI work zone compliance tool has started emailing me thousands of pictures from a (I think) Saudi industrial facility again, to my internaluser.com domain. #infosec

Alt...

some security camera still showing a group of people in a parking lot in front of a stop sign

🚨 U.S. folks. There is one day left to comment on the FCC proposed rule to eradicate anonymity on all phone lines!

If they pass this rule government ID, physical address, and alternative phone number will be required for every new phone line. Anonymous phone lines and burner phones will cease to exist. That means no connected privacy via cellular at protests.

** Please add your comment! **

For the first field (proceedings) use these two:

17-59 and 02-278

https://www.fcc.gov/ecfs/filings/express

#Privacy #InfoSec #OpSec #FCC #Anonymity #Phones #Protest

#today I shall start to shut down all the creepy user data #scraping that #Win10 does by default, just so we can use #Ableton in peace again.

Meanwhile, praying for a breakthrough in being able to use Ableton on #Linux without pulling all my teeth out. Is there a #Distro out there to do this yet?

#infosec

More on those LG monitors installing apps on windows machines.

https://arstechnica.com/gadgets/2026/07/microsoft-responds-to-lg-monitors-installing-mcafee-ads-on-windows/

#microsoft #windows #LG #infosec #privacy

This is a great list of tips for improving your Signal privacy from @yaelwrites.

I found this part especially meaningful:

“Turning off biometrics makes it annoying to use your phone…If that’s you, remember that both Android and iOS have a quick lockout that forces a passcode and disables biometrics until you re-enter it: on iPhone, hold the side + volume button until the power-off screen appears, then cancel; on most Androids, hold power and tap Lockdown.”

https://blog.yaelwrites.com/how-to-keep-the-feds-out-of-your-signal-messages

#Signal #Privacy #InfoSec #OpSec

Phantomdrive: an open source encrypted USB drive with a stealth mechanism to hide its second partition - Firmware and hardware (PCB) available on GitHub - Project by Ryan Walker #DIY #Infosec #Privacy https://rootkitlabs.com/2026/06/22/I%27m-Building-a-Secure-USB-Drive/

CVE-2026-55973 - Buffer Overflow in NLnet Labs Unbound 1.23.0-1.25.1. EDNS Report-Channel option mishandling leads to memory corruption. CVSS 7.5. No patch yet. Disable dns-error-reporting immediately. #CVE #infosec #DNSSEC

https://www.valtersit.com/cve/CVE-2026-55973/

⋅ Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

− https://thehackernews.com/2026/07/russian-espionage-group-exploited.html

#InfoSec

Hot take:

I hate how all these articles talk about how OpenAI’s clanker “broke out” and attacked Hugging Face.

No, OpenAI’s dog slipped its chain because they don’t know what the hell they’re doing, and it bit another dog.

#AI #SlopPocalypse #FuckAI #Infosec #cybersecurity

Alt...

Little dog biting a person’s finger

https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/

LG announces to ban apps that turn your tv into a proxy for third parties.

Like: allow everyone that paid for it to use your home internet connection (and enables people to attack your home network)

#infosec #smarttv #internetofshit

https://openai.com/index/hugging-face-model-evaluation-security-incident/the new OpenAI model "accidentally" hacked Hugging Face, another AI company using AI in the build pipeline.

they say this will become more common.

"Last week, Hugging Face disclosed a new kind of security incident⁠(opens in a new window) after they detected and contained an AI agent that compromised their infrastructure, something we expect to become more commonplace with the proliferation of increasingly cyber-capable models.
(...)
We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities (...)"

#ai #openai #infosec #aisec

YouLend US LLC Reports Data Breach Exposing Social Security Numbers

YouLend US LLC reported a data breach after an hacker accessed its network in June 2026 and stole files containing names, dates of birth, and Social Security numbers. The company is offering 12 months of free credit monitoring to affected individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/youlend-us-llc-reports-data-breach-exposing-social-security-numbers-q-r-l-e-x/gD2P6Ple2L

Keeping Private Namespace Queries Private

...more of the quiet work behind the scenes that deserves to be talked about!

https://quad9.net/news/blog/keeping-private-namespace-queries-private/

#privacy #security #DNS #infosec

Alt...

The quad9 logo features white and pink text on a black background with abstract digital circuit designs in the corners.

⋅ New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction

− https://thehackernews.com/2026/07/new-7-zip-vulnerability-could-let.html

#InfoSec

Here's one for anyone curious about the technical ins and outs of why Telstra's network went down. Andrew Colley and Juha Saarinen provide as detailed an explanation as you're likely to find in any Australian media outlet:

https://www.itnews.com.au/news/telstra-broke-its-network-with-undocumented-time-fix-627442

#auspol #Telstra #infosec #telcos #telco

Microsoft faces a Windows zero-day after HiveLegacy exposed a flaw letting low-privilege users alter admin registry data under specific conditions. 🛡️
The exploit targets the User Profile Service, Microsoft is investigating, and researchers recommend tighter account controls. 🔍

🔗 https://arstechnica.com/security/2026/07/windows-0-day-drops-the-same-day-microsoft-releases-record-number-of-patches/

#TechNews #Microsoft #Windows #ZeroDay #Cybersecurity #Vulnerability #Privacy #Security #InfoSec #DigitalRights #Technology #SoftwareUpdate #BillGates #Windows10 #Windows11

🚨 CRITICAL: WordPress Core "wp2shell" RCE

A single anonymous HTTP request can lead to Remote Code Execution on vulnerable WordPress Core installations.

⚠️ No plugins.
⚠️ No themes.
⚠️ No authentication required.

Tracked as:
🔴 CVE-2026-63030 (REST API Batch Route Confusion → RCE)
🔴 CVE-2026-60137 (Facilitated SQL Injection)

Affected versions
• WordPress 6.9.0–6.9.4
• WordPress 7.0.0–7.0.1

✅ Update immediately to WordPress 6.9.5 or 7.0.2. Due to the severity, WordPress has enabled forced automatic security updates for affected installations.

🔗 Full technical analysis:
https://thecybersecguru.com/news/wordpress-core-rce-wp2shell/

#WordPress #WordPressSecurity #wp2shell #CVE202663030 #CVE202660137 #RCE #RemoteCodeExecution #SQLInjection #RESTAPI #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #PatchNow #ThreatIntelligence #BlueTeam #SOC #Linux #PHP #ZeroDay #SecurityResearch #SysAdmin #DevSecOps

RE: https://mastodon.social/@zackwhittaker/116929779183940055

various plot points in #MidsomerMurders were written based on exactly this: cops having access to the victims health-tracker data. tbh that show is an #infosec #surveillance #stalkerware nightmare.

your auntifa liza 🇵🇷 🦛 🦦 boosted

Zack Whittaker » 🌐 2026-07-16
@zackwhittaker@mastodon.social

Fantastic work by @Thorin at EFF looking at the state of fitness tracker privacy.

Most wearable makers don't end-to-end encrypt your data, so police/feds (and hackers!) can get your health data — and almost none publish a transparency report, so we may never know if they do.

https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review

"Microsoft Patches for July 2026
Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known."

The mother of all releases.

The Vulnerability Tsunami is on us.

#infosec #cybersecurity #patchday #vulnerabilitytsunami

En vertu de et conformément à France fuite, histoire de ne pas vous faire voler votre signature vocale, je vous suggère de supprimer l'annonce d'accueil personnalisée de votre messagerie téléphonique

#infosec #voicecloning #voicefraud

I do love a good “comedy of errors” pen testing finding. And here is what I mean by that, very recent example (last week):

During OSINT discover target app was previously worked on by third party dev shop.

Find public repo belonging to former employee of third party dev shop on Github, contains a lot of juicy info about app, but no hardcoded creds or secrets.

Check commit history.

Commit called - “remove creds and secrets”.

There they are, in the history.

But wait, this file has a lot of commit history.

Oh cool, creds and secrets from the previous customer this dev shop worked for, and accidentally copied over into a template .env.

And scene.

The two things that remember: pepperidge farm and git commit history

#infosec

⋅ Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found

− https://thehackernews.com/2026/07/google-and-microsoft-pull-modheader.html

#InfoSec

⋅ HalluSquatting : quand les hallucinations de l’IA deviennent une porte d’entrée pour les hackers

− https://www.zdnet.fr/actualites/hallusquatting-quand-les-hallucinations-de-lia-deviennent-une-porte-dentree-pour-les-hackers-498564.htm

#InfoSec

Somebody with a botnet has gotten it into their head to try to compromise my family IMAP server. There have been over 200 failed logins from IPs all over the internet every day since June 22, with a peak of 774 on June 25 and an average of 379.
#infosec #SelfHosting #botnet (1/4)

Yesterday I got email from MyRegistry.com offering free Ethereum.
Today, I got email from them saying that email didn't come from us, this was just "an unauthorized party accessing our email marketing platform."
"There is no evidence that any MyRegistry.com member accounts were compromised."
Perhaps not yet, but now that they've got your user list they can do a password-spraying attack?
Sounds like a breach to me. Maybe you should treat it that way.
#infosec #breach #MyRegistry #MyRegistryCom

U-Boot Bootloader Flaws Allow Stealthy Pre-Boot Code Execution

Binarly researchers discovered six vulnerabilities in the U-Boot bootloader's FIT signature verification process that allow for arbitrary code execution and denial of service. These flaws affect over 50 stable releases since 2013 and can be exploited to install persistent firmware malware.

**If you run devices that use the U-Boot bootloader (servers, network gear, industrial and IoT devices, BMCs), first make sure all these devices are isolated from the internet and their management interfaces are accessible from trusted networks only. Then ask your hardware vendors for firmware updates fixing the U-Boot FIT vulnerabilities and apply them as soon as they're released. Prioritize BMCs and core network equipment.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/u-boot-bootloader-flaws-allow-stealthy-pre-boot-code-execution-b-d-7-x-u/gD2P6Ple2L