Looking for a smile?

SAN: Trump Mobile’s latest problem: Hackers just released customer information https://san.com/cc/trump-mobiles-latest-problem-hackers-just-released-customer-information/

Four months ago:

Tech Crunch: Trump Mobile confirms it exposed customers’ personal data, including phone numbers and home addresses https://techcrunch.com/2026/05/22/trump-mobile-confirms-it-exposed-customers-personal-data-including-phone-numbers-and-home-addresses/ @TechCrunch #infosec #ransomware #databreach

There's a new gang in today's ransomware mix. But the first target. claimed by another new threat actor, takes the cake:

**** Trump Mobile Wireless (Telecom) https://ransomware.live/id/VHJ1bXAgTW9iaWxlIFdpcmVsZXNzIChUZWxlY29tKUBCWU9E ****

- US: O2 Dental Group https://ransomware.live/id/TzIgRGVudGFsIEdyb3VwQGludGVybG9jaw

- Thomas Y. Pickett & Co., Inc. https://ransomware.live/id/VGhvbWFzIFkuIFBpY2tldHQgJiBDby4sIEluYy5AYXVyb3Jh

Yesterday:

- MorseLife Health System, Inc. https://ransomware.live/id/TW9yc2VMaWZlIEhlYWx0aCBTeXN0ZW0sIEluYy5AQm9vYmEgUHJvamVjdA

More https://ransomware.live/ #infosec #ransomware #cybercrime

This isn't good, and it's allowing the big bullies breaking into legitimate companies to fill the gap.

24/7 Wall St: The Biggest Buyers in Cybersecurity Now Are Not Cybersecurity Companies https://247wallst.com/investing/2026/10/05/the-biggest-buyers-in-cybersecurity-now-are-not-cybersecurity-companies/ #infosec

New.

The Record: Data breach at Denmark’s national population register exposes 8.8 million people https://therecord.media/denmark-breach-register-cyberattack @therecord_media #infosec #databreach

New.

Fortinet: ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure @fortinet

More:

Infosecurity-Magazine: ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes https://www.infosecurity-magazine.com/news/clingstun-backdoor-unpatched-iot/ #infosec #vulnerability #Linux #IoT

A big batch of updates in our Security Conferences Archives at #InfoCon, everything should be up and seeding + web streaming should be improved. Please enjoy! https://infocon.org

Next up we will update some of the skills and documentaries collections.
#Hacking #InfoSec
@auscert @botconf @brucon @_c0c0n_ @cactuscon @CYBERWARCON @CypherCon @dnsoarc @globsec @hacktivityconf @ietf @layerone @nanog @NorthSec @offensivecon @REverseConf @rsaconference @rvasec @securityfest @steel_con @summercon @iacr_news @WEareTROOPERS @wootsecurity @vehiclesec_conf @x33fcon @zeronights

Privacy & security, Mon, Oct 5:

• Denmark Data Breach Exposes 8.8M People's Personal Data
https://www.cpr.dk/cpr-nyt/nyhedsarkiv/2026/okt/omfattende-uautoriseret-adgang-til-borgeres-cpr-oplysninger

• Xray-core concealed a certificate verification bypass vulnerability
https://github.com/net4people/bbs/issues/672

• OpenAI will show visual ads in ChatGPT while you generate images
https://www.bleepingcomputer.com/news/artificial-intelligence/openai-will-show-visual-ads-in-chatgpt-while-you-generate-images/

• Microsoft: Windows KB5124010 update crashes some games and apps
https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-kb5124010-update-crashes-some-games-and-apps/

#infosec #privacy

Alt...

Headline list: Denmark Data Breach Exposes 8.8M People's Personal Data (HN, 211 pts); Xray-core concealed a certificate verification bypass vulnerability (HN, 83 pts); OpenAI will show visual ads in ChatGPT while you generate images (BleepingComputer); Microsoft: Windows KB5124010 update crashes some games and apps (BleepingComputer); Google halts open-source bug bounty program amid AI spam surge (BleepingComputer)

Ransomware targets today:

- Canada: Nipigon District Memorial Hospital https://ransomware.live/id/TmlwaWdvbiBEaXN0cmljdCBNZW1vcmlhbCBIb3NwaXRhbEBTdG9ybQ

- France: Euroditel.com https://ransomware.live/id/ZXVyb2RpdGVsLmNvbUBrcnliaXQ

US: Genesis Credit Management https://ransomware.live/id/R2VuZXNpcyBDcmVkaXQgTWFuYWdlbWVudEBxaWxpbg

Yesterday:

St. Francis Healthcare Systems of Hawaii https://ransomware.live/id/U3QuIEZyYW5jaXMgSGVhbHRoY2FyZSBTeXN0ZW1zIG9mIEhhd2FpaUBXYWxsc3RyZWV0

More: https://ransomware.live/ #infosec #ransomware #cybercrime

Profil taki Zaufany, profesjonalnie mocno, bardzo bezpieczeństwo, wow uszanowanko.

#Polska #InfoSec

Alt...

Zrzut ekranu z interfejsu tworzenia hasła dla Profilu Zaufanego. Hasło zawiera znak "+". Interfejs ostrzega, że: "Nowe hasło nie spełnia wszystkich wymagań. Hasło powinno zawierać także: znak specjalny."

🚨 Antino backdoor hides its commands in Outlook and OneDrive

Cisco Talos says the Antino Windows backdoor uses Microsoft Graph, Outlook mailboxes, and OneDrive for command-and-control, blending into trusted Microsoft 365 traffic.

The campaign also used a spoofed phishing email that reached its target despite failing DMARC, because the impersonated domain had a p=none policy.

More details: https://digitalescapetools.com/2026/10/antino-backdoor-outlook-onedrive-dmarc-spoofing.html

#CyberSecurity #Malware #Phishing #Microsoft365 #DMARC #Windows #Infosec

Is there a chapter in Project Management books that give advice how and when to schedule a pre meeting to discuss what will be mentioned in the "real" meeting?

When does a premeeting require a meeting or touchpoint beforehand to discuss what is required to be covered?

I feel it is the responsibility of the PMO to limit the number of meetings, prior to the real meeting, as to avoid the nesting dolls of meetings... and my day is gone.

#infosec #projectmanagement #pmo

New.

"The chain uses two binaries. A dropper writes a shell script to the appliance's storage mount and executes it. The script stages both payloads into /sbin under the names ntpdate and udevds, launches them, and deletes each file ten seconds later while the processes continue running. One of those payloads is the dropper itself, re-executing as a resident watchdog, leaving both processes running without an on-disk image."

Rapid7: SMTP is the key: BPFDoor and AVERAT hitting the network edge https://www.rapid7.com/blog/post/tr-smtp-is-the-key-bpfdoor-averat-hitting-the-network-edge/ @Rapid7Official #infosec #threatresearch #Linux

New. You'll need a translator for this.

Group-IB: BraZetsu Anatomy: How Cybercriminals Supply the Clandestine Ecosystem https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace-es/ #infosec #threatintel #threatintelligence #malware #Windows #Python

CISA has updated the catalogue. GMBH is looking like Swiss cheese these days.

- CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102489

- CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102490

Yesterday's funny headline:

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-securing-next-250 #CISA #infosec #vulnerability

New.

Socket: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX https://socket.dev/blog/glassworm-vscode-themes @SocketSecurity #infosec #threatresearch #JavaScript #Git

The original story is paywalled.

WSJ: The sleuths who expose when AI goes rogue https://www.msn.com/en-us/news/other/they-re-known-as-swarm-chasers-and-they-spring-into-action-when-ai-goes-rogue/ar-AA2dpGKd #bots #infosec

From September 30.

"OpenAI and Anthropic safeguards are flagging routine aerospace, robotics and security work as risky, costing them time and disrupting otherwise ordinary workflows. Some described abandoning chats or moving specific tasks to other models when refusals became hard to work around."

VentureBeat: Developers say OpenAI and Anthropic safeguards are flagging routine work and costing them time https://venturebeat.com/technology/developers-say-openai-and-anthropic-safeguards-are-flagging-routine-work-and-costing-them-time @venturebeat #OpenAI #Anthropic #infosec

The Record: Mississippi mayor says ransomware incident led city to shut down systems https://therecord.media/vicksburg-mississippi-government-ransomware-attack @therecord_media @jgreig
----

More ransomware targets today:

France: The Official College of Architects of León https://ransomware.live/id/VGhlIE9mZmljaWFsIENvbGxlZ2Ugb2YgQXJjaGl0ZWN0cyBvZiBMZcOzbiAoQ09BTClAYWtpcmE

US: Pacific Tank Lines https://ransomware.live/id/UGFjaWZpYyBUYW5rIExpbmVzQGFraXJh

Raleigh Family Medicine https://ransomware.live/id/UmFsZWlnaCBGYW1pbHkgTWVkaWNpbmVAQm9vYmEgUHJvamVjdA

*** University of Illinois Chicago https://ransomware.live/id/VW5pdmVyc2l0eSBvZiBJbGxpbm9pcyBDaGljYWdvQEJvb2JhIFByb2plY3Q ***

Baltimorefreightliner.com https://ransomware.live/id/YmFsdGltb3JlZnJlaWdodGxpbmVyLmNvbUBzZXR0cmE

Yesterday:

Slate Valley Unified School District https://ransomware.live/id/U2xhdGUgVmFsbGV5IFVuaWZpZWQgU2Nob29sIERpc3RyaWN0QGthaXJvcw

More: https://ransomware.live/ #ransomware #infosec #cybercrime

"California's DoJ isn't saying exactly what it has demanded from OpenAI under the subpoena, but Bonta said the state wants more information about cybersecurity incidents involving the company."

The Register: OpenAI's wandering AI agents earn it a California subpoena https://www.theregister.com/ai-and-ml/2026/10/02/openais-wandering-ai-agents-earn-it-a-california-subpoena/5300850 @theregister @carlypage #OpenAI #bots #infosec #cyberattack

Fortinet has a couple of advisories today, one pertaining to a critical vulnerability.

CRITICAL: CVE-2026-104286 - Improper Pathname Restriction Allows Unauthenticated Arbitrary File Write in Fortinet FortiMail https://app.opencve.io/cve/CVE-2026-104286

More:

The Register: Fortinet sounds the alarm over actively exploited FortiMail zero-day https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803 @theregister @carlypage #infosec #Fortinet #zeroday #vulnerability

New.

Microsoft Digital Defense Report 2026 https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/

More:

Infosecurity-Magazine: Microsoft: AI Cuts Post-Compromise Attack Time to Minutes https://www.infosecurity-magazine.com/news/microsoft-ai-attack-time-minutes/ #infosec #Microsoft

Hashing several values together is easy to get wrong, and the mistakes can lead to forgeries. TupleHash only works with Keccak. Outside SHA-3, people roll their own multihashing, often insecurely.

We built SequenceHash to fix that for any hash function, with length-suffix encoding and protection against length-extension attack. https://blog.trailofbits.com/2026/10/02/sequencehash-multihashing-for-the-rest-of-us/

#cryptography #infosec #C2SP

New.

Zscaler: Ransomware Data Theft Surged 275% in 2026: Schools, Hospitals, and Government Agencies Had Some of the Largest Claims https://www.zscaler.com/blogs/security-research/ransomware-data-theft-surged-275-2026-schools-hospitals-and-government

Speaking of ransomware, here are the latest targets:

US - Associated Gastroenterologists of Central New York https://ransomware.live/id/QVNTT0NJQVRFRCBHQVNUUk9FTlRFUk9MT0dJU1RTIE9GIENFTlRSQUwgTkVXIFlPUkssIFAuQ0BCb29iYSBQcm9qZWN0

Graybar Electric Company, Inc. https://ransomware.live/id/R3JheWJhciBFbGVjdHJpYyBDb21wYW55LCBJbmMuQFJlZGFjdA

Guardian Pharmacy LLC https://ransomware.live/id/R3VhcmRpYW4gUGhhcm1hY3kgTExDQGluY3JhbnNvbQ

Northern Counties Health Care https://ransomware.live/id/Tm9ydGhlcm4gQ291bnRpZXMgSGVhbHRoIENhcmVAaW5jcmFuc29t

UK: Parkdental.com https://ransomware.live/id/cGFya2RlbnRhbC5jb21AY2hhb3M

A lot more: https://ransomware.live/ #infosec #ransomware #threatresearch

Another announcement from Cloudfare. Notice the data sources.

"Basin brings an end-to-end analytics platform to the Developer Platform, enabling you to collect data from a variety of sources, such as apps, infrastructure, devices, and other Cloudflare services, then query it to answer analytical questions."

Cloudflare: Introducing Cloudflare Basin: an open, serverless data platform, now generally available https://blog.cloudflare.com/cloudflare-basin/ #Cloudflare #infosec

New, and an excellant timeline for this gang's activities and various shenanigans.

Sekoia: Gotta breach 'em all! The journey of ShinyHunters https://www.sekoia.com/blog/gotta-breach-em-all-the-journey-of-shinyhunters @sekoia_io #infosec #ransomware #cybercrime #threatresearch

@briankrebs

New.

Group-IB: Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy https://www.group-ib.com/blog/milk-dragon-nailong-phishing-kit/ #infosec #phishing #scam #fraud

This was posted yesterday.

Sucuri Blog: SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor https://blog.sucuri.net/2026/09/sc-wordpress-malware-a-self-healing-mesh-of-loaders-drop-ins-and-a-blockchain-controlled-backdoor.html

More:

The Hacker News: WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory https://thehackernews.com/2026/10/wordpress-backdoor-rebuilds-itself.html @thehackernews

Meanwhile, Wordfence has two critical mentions today https://www.wordfence.com/threat-intel/vulnerabilities @wordfence #WordPress #infosec #vulnerability

@smallcircles - In #infosec, the terms "Responsible" and "Ethical" always mean "Corporate" (and sometimes "Legal").

Therefore protecting the information security and ensuring the operations of a company like Palantir is considered ethical, even while it's operations are grossly unethical...

...and degrading or denying the operations of the same is considered unethical, even though the actions are ethical in stopping harm.

So, in short, #EthicalAI and #ResponsibleAI just mean AI that enriches corporations and billionaires while actively hurting the majority of people and the biosphere.

Fewer women than ever in UK's 'old boys' club' cyber industry - The Register

“When I’ve spoken to a business and said to them ‘why don’t you hire a more diverse workforce?’ You’ll get the normal common ones of ‘well if we hire a female, she’ll get pregnant, she’ll be off for 12 months,’ which isn’t right.”

If this report is true, it speaks extremely poorly on UK cyber management. Frankly, its an insane position to take.

In the US with the shortage of competent infosec people, besides being extremely shitty and misogynistic, I find it unbelievable to exclude half the population at the start.

https://www.theregister.com/security/2026/10/01/fewer-women-than-ever-in-uks-old-boys-club-cyber-industry/5300064

#cybersecurity #infosec #misogyny #womenincyber

New.

Nvidia security advisories today:

This impacts multiple CVEs: NVIDIA GPU Display Driver - September 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5861

There's more, posted yesterday https://www.nvidia.com/en-us/product-security/

AMD security bulletin: CVE-2026-43598: RCCL Vulnerability https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6033.html #AMD #infosec #vulnerability #Nvidia

Another day, another ransomware crook.

US: West County Health Centers https://ransomware.live/id/V2VzdCBDb3VudHkgSGVhbHRoIENlbnRlcnNAU3Rvcm0

Gardeners' Guild https://ransomware.live/id/R2FyZGVuZXJzJyBHdWlsZEBTdG9ybQ

Datacomm Services https://ransomware.live/id/RGF0YWNvbW0gU2VydmljZXNAdGhlZ2VudGxlbWVu

Webb Electric Company of Florida https://ransomware.live/id/V2ViYiBFbGVjdHJpYyBDb21wYW55IG9mIEZsb3JpZGFAdGhlZ2VudGxlbWVu

UK: Defencebit https://ransomware.live/id/RGVmZW5jZWJpdEB0aGVnZW50bGVtZW4

So much more https://ransomware.live/ #infosec #ransomware #cybercrime

New.

Zscaler: 2CLoader: A New Malware Loader Delivering Vidar and Remus https://www.zscaler.com/blogs/security-research/2cloader-new-malware-loader-delivering-vidar-and-remus #infosec #malware #threatresearch

New.

Microsoft: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 https://www.microsoft.com/en-us/security/blog/2026/09/30/unauthenticated-command-injection-on-internet-facing-mail-servers-tracking-cve-2026-73570/ #Microsoft #threatresearch #infosec #vulnerability

New advisory, new flaw.

Cisco: CRITICAL CVE-2026-76504: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU @TalosSecurity #Cisco

More on that Cisco vulnerability:

Rapid7: Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504) https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504/ @Rapid7Official

Also:

Broadcom has several advisories today, three of them addressing critical vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom #infosec #vulnerability

And this is the outfit tasked with protecting the country. 😅

"Unauthorized users are said to have accessed files between October 2025 and 16 July 2026 without anyone noticing. It was only after nine months that a vulnerability in a file-sharing system was discovered and patched by the DMDC."

Bitdefender: Pentagon personnel database breach exposes personal data of millions https://www.bitdefender.com/en-us/blog/hotforsecurity/pentagon-personnel-database-breach-personal-data-millions @gcluley #infosec #databreach

New.

Google: Vulnerability Discovery and Exploitation Trends in the AI Era https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era #Google #infosec #threatintel #threatintelligence

New.

Leaving a predictable pattern in place seems kinda dumb.

"After multiple failed attempts, the threat actor gained access by exploiting a flaw in the platform's file upload function, then used the same technique across all three servers: register a new account, abuse the member files upload function to launch webshells, and ultimately steal payment card data."

"User-agent strings suggest that the threat actor is based in China. We also suspect the use of AI-generated scripts throughout the kill chain, from the large number of failed initial access probes to the final upload of PowerShell scripts with extensive comments in the provided instructions."

Huntress: Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers https://www.huntress.com/blog/parks-recreation-platform-webshell-attack #infosec #vulnerability #cyberattack

The announcement was made yesterday.

Kiteworks Difficult and Unique Decision to Ensure Customer Data Protection Through Customer-Wide Shutdown Successfully Navigates Credible Threat https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/

More:

The Hacker News: Kiteworks Fixes Critical Flaw Found During Nine-Hour Precautionary Shutdown https://thehackernews.com/2026/09/kiteworks-fixes-critical-flaw-found.html @thehackernews #infosec #Kiteworks #vulnerability

OpenAI, not "its agents" will be held responsible for these dumb actions.

Tech Crunch: OpenAI apologizes to Australia after its AI agents breached government sites https://techcrunch.com/2026/09/29/openai-apologizes-to-australia-after-its-ai-agents-breached-government-sites/ @TechCrunch #OpenAI #infosec

CISA has added one vulnerability to the KEV catalogue:

- CVE-2026-86950: Apple Multiple Products Out-of-Bounds Write Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-86950 #infosec #Apple #CISA #vulnerability

New.

WatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/

Yesterday:

WatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #infosec #vulnerability #NetScaler #Citrix

The company isn't issuing certificates yet, but it's coming.

"Cloudflare is announcing our intent to become a public certificate authority (CA)."

"Today we are announcing the first concrete milestones in that effort: We have applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs, and we have signed a definitive agreement to acquire an established, broadly trusted root from GlobalSign, so that we can offer certificates with the widest possible device reach the day we begin issuing. We’re also announcing our plans to be one of the first CAs to serve post-quantum certificates, targeting Chrome’s recently announced Quantum-resistant Root Program."

Cloudflare: Building a certificate authority for the whole Internet https://blog.cloudflare.com/cloudflare-certificate-authority/ #Cloudflare #infosec

@cR0w @ifin

Posted yesterday, if you missed this.

Microsoft: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ #infosec #Microsoft #malware #threatresearch

From yesterday.

Huntress: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat @huntress #infosec #ChatGPT #malware #threatresearch #ClickFix

New.

Google: Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances #Google #infosec #NetScaler #Citrix #vulnerability #threatintelligence #threatintel

@ifin

A new service announcement. The new offering is called Executive Threat Detection.

Cisco: Securing the keys to the kingdom: Announcing Executive Threat Detection https://blog.talosintelligence.com/securing-the-keys-to-the-kingdom-announcing-executive-threat-detection/ #Cisco #infosec

(truesec.com) Denmark Raises Threat Level for Destructive Cyberattacks Amid Escalating Russian Hybrid Warfare

In brief - This article discusses the increased risk of destructive cyberattacks in Denmark and Europe, driven by Russian hybrid warfare aimed at pressuring nations to reduce support for Ukraine.

Technically - This article categorizes the threat landscape into cybercrime, espionage, and cyber warfare, noting that while crime remains the most common threat, Russian state-sponsored activity is escalating. Technical vectors identified include Distributed Denial of Service (DDoS) attacks, the compromise of CCTV systems, and the manipulation of unprotected critical infrastructure components. Furthermore, the report highlights the use of proxy or disposable agents to target defense sector supply chains, factories, and warehouses through destructive cyber operations.

Source: https://www.truesec.com/hub/blog/danish-intelligence-services-raises-threat-for-destructive-cyberattacks

#ThreatIntelligence #ThreatIntel #Cybersecurity #Infosec

New. Apple has released several security updates.

Apple security releases: https://support.apple.com/en-us/100100

More:

Apple: About the security content of iOS 26.7.1 and iPadOS 26.7.1 https://support.apple.com/en-us/149226 #Apple #infosec #iOS

#BSidesLuxembourg2026 recording: "𝐒𝐩𝐲𝐰𝐚𝐫𝐞: 𝐓𝐡𝐞 𝐈𝐧𝐯𝐢𝐬𝐢𝐛𝐥𝐞 𝐓𝐡𝐫𝐞𝐚𝐭" by Julien Vander Straeten @julienvs

Find all the talks from this track/village here: https://archive.org/details/BSidesLuxembourg2026/d2+t5+02+Spyware:+The+Invisible+Threat+-+Julien+Vander+Straeten.mkv

#BSidesLuxembourg2026 #BSidesLux #cybersecurity #infosec #threatdetection #spyware #hacking

🚨 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.
https://www.cyberkendra.com/2026/09/cve-2026-88771-netscaler-zero-days-exploited.html

#citrixvulnerability #netscaler #zeroday #infosec

@LapTop006 @xssfox @voltagex

One is sobbing into their hands. The other is eating popcorn watching the show.

#infosec

Now it's confirmed as, watchTowr says two unpatched NetScaler RCE zero-days were found exploited during forensics. Citrix's advisory and patches are expected early next week.

https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html
#netscaler #citrix #zerodays #security #infosec

NetScaler alert: watchTowr says reports of unpatched remote code execution flaws in Citrix NetScaler are verified, and organisations are shutting appliances down. There's no Citrix advisory, CVE or patch yet, and it's not the earlier CVE-2026-19490 bug. Here's what we know.
https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html
#NetScaler #Citrix #ZeroDay #CyberSecurity #InfoSec

Also from yesterday.

Efficient IP: AliExpress Phishing Campaign: What EfficientIP Research Labs Uncovered https://efficientip.com/blog/aliexpress-phishing-campaign-dns/

More:

Infosecurity-Magazine: Researchers Identify AliExpress Phishing Domains Before Registration https://www.infosecurity-magazine.com/news/aliexpress-phishing-flagged-early/ #infosec #phishing

@ifin

MPC inside a Trusted Execution Environment (TEE) adds defense in depth, but the two make different bets on trust. MPC spreads trust across independent parties, while TEEs concentrate it in the hardware manufacturer and its attestation infrastructure. Our new post covers what TEE attestation can and can't fix in MPC deployments, the pitfalls we see most often in audits, and how to combine the two without undermining either.

https://blog.trailofbits.com/2026/09/25/dont-let-tees-break-your-mpc/

#infosec #cryptography #TEE

#BSidesLuxembourg2026 recording: "𝐌𝐈𝐒𝐏 𝐖𝐨𝐫𝐤𝐛𝐞𝐧𝐜𝐡" by Luciano Righetti

Find all the talks from this track/village here: https://archive.org/details/BSidesLuxembourg2026/d2+t1+07+MISP+Workbench+-+Luciano+Righetti.mkv

#BSidesLuxembourg2026 #BSidesLux #cybersecurity #infosec #hacking

🚨 Dates Updated and Location Confirmed! 🚨

DEF CON Training is headed back to Bahrain on November 9-11, this time at the Wyndham Grand Manama. The course line up has a bit of everything - AI, threat hunting, cryptocurrency, cloud infrastructure, and more!

Now's a great time to make plans to add to your skill toolkit before the end of the year. Browse the course catalogue and secure your seat today:

https://me.shop.defcon.org/collections/trainings

📆 November 9-11, 2026
📍 Wyndham Grand Manama

DEF CON Middle East

#DEFCON #DEFCONMiddleEast #DEFCONTraining #CyberTraining #HandsOnTraining #EthicalHacking #AI #InfoSec #threathunting #cloud #Cryptocurrency #Bahrain #MiddleEast

Alt...

DEF CON Training Middle East Novernber 9-11,2026 Wyndham Grand Manama

#BSidesLuxembourg2026 recording: "𝐓𝐡𝐞 𝐅𝐨𝐫𝐠𝐨𝐭𝐭𝐞𝐧 𝐅𝐢𝐧𝐠𝐞𝐫𝐩𝐫𝐢𝐧𝐭: 𝐃𝐍𝐒 𝐁𝐚𝐬𝐞𝐝 𝐎𝐒𝐈𝐍𝐓 𝐓𝐞𝐜𝐡𝐧𝐢𝐪𝐮𝐞𝐬 𝐅𝐨𝐫 𝐏𝐫𝐨𝐝𝐮𝐜𝐭 & 𝐒𝐞𝐫𝐯𝐢𝐜𝐞 𝐃𝐢𝐬𝐜𝐨𝐯𝐞𝐫𝐲" by Rishi (@rxerium) https://infosec.exchange/@rxerium

Find all the talks from this track/village here: https://archive.org/details/BSidesLuxembourg2026/d1+t5+06+The+Forgotten+Fingerprint:+DNS+Based+OSINT+Techniques+For+Product+&+Service+Discovery+-+Rishi+(@rxerium).mkv

#BSidesLuxembourg2026 #BSidesLux #cybersecurity #infosec #OSINT #hacking

NEWSCARD: Decentralized, Encrypted Paste Bin via Usenet Newsgroups

• NEWSCARD * Publish and fetch permanent named records via Network News

Newscard creates a decentralized, encrypted, named record paste bin.

[git repo] https://codeberg.org/OCTADE/newscard (use most recent version only)

With a single command, name the card, snarf the file and encrypt it.

With another command, push the encrypted file to the public network.

With another short command, snarf a file from the network.

Only users knowing the name [key] of the record will be able to decrypt it.

If a strong passphrase is used to name the file, it will be very secure.

This is useful for quickly snarfing, encrypting, and publishing a text file:

$~: card enc [passphrase] [file]
$~: card put [passphrase]

It is useful for retrieving a text file with just a key:

$~: card get [passphrase]
$~: card show [passphrase]

If and when you want the general public to access the record just share the keyword.

Newscard uses nine (9) (NINE) layers of encryption with OpenSSL chacha20 cipher.

Newscard generates 9 each of: cipher keys, salts, key iteration parameters.

It would be nice if something like this were added to the ActivityPub protocol, such that keyword[@]host.url would do the same thing. Then secret text records could be stored securely for later retrieval or revelation.

#NewsCard #Pastebin #Usenet #NNTP #NetworkNews #Encryption #Cryptography #Messaging #Anonymity #Protocols #OpenSource #FreeSoftware #BlackHackJack #Censorship #Retro #InfoSec #Ciphers #Codes #FOSS #CyberSecurity #Privacy #ComSec #OpSec #OpenSSL #ChaCha20

@usenet
@cryptography

[image description]

Playing card of the Jack of Clubs. The Jack is a moustached man in a black top hat and suit in a oval center cameo. The colors are inverted so that everything on the face is black except the lines which are white, like a charcoal cutout picture., giving it a retro digital appearance mixed with retro handicraft vibes.

Discord is rolling out automatic age-group classification for all users, estimating whether an account is an adult or teen from behavioral signals like account age, server memberships, connected games, and activity levels rather than message content, with more than 90 percent of users expected to be placed without manual confirmation. For those who must confirm, Discord added options beyond facial scans and ID uploads, including credit card checks routed through vendor k-ID to Stripe, and age-range signals shared by Apple and Google app stores. The rollout follows Discord's February 2026 delay of a global verification plan after backlash, which itself came after a third-party vendor breach in October 2025 exposed roughly 70,000 users' government ID photos submitted for prior age-verification appeals. The new model reduces reliance on document uploads for most users, but it still depends on third-party vendors and introduces continuous behavioral profiling as the default mechanism for sorting every account by age.

https://discord.com/blog/safer-for-teens-same-discord-for-adults

#InfoSec #Privacy #Surveillance #DigitalRights

@MagnusIdode

.. but could you imagine getting them tattooed there???

#painful #infosec #cybersecurity #tattoo

Pro tip: if you want to keep your incident responder happy, don't save up and submit all your incident reports 30 minutes before scheduled shift end.

This makes IR cranky.

#incidentresponse #infosec

#Shitpost #Shitposting #Infosec #OtterNonsense

Alt...

A wet otter holds a fish in its paws next to the water. The otter appears to be on a rocky shore with water flowing around it. HE HAS FALLEN VICTIM TO A PHISHING CALL

It's @GrapheneOS in the news again. https://www.theglobeandmail.com/canada/article-probes-toronto-shooter-for-hire-impenetrable-phone-graphene-os/ #GrapheneOS #Privacy #Security #InfoSec #C22

Secure and Private Decentralized P2P Encrypted Messaging over Git and WebRTC

This project demonstates a unique approach to secure messaging. The approach is different enough that it can't be easily compared to Signal or SimpleX.

The core philosophy around secure messaging here is that it can work in a way that avoids installation and registration by enabling users to host their own data.

The project is far from finished, but im putting together some docs for the "how it works". It's pretty outside-the-box thinking (and that doesnt make it a good idea), so it would be great if you could share your thoughts on the approach.

Website: Glitr.io

Features:

WebApp
P2P / WebRTC
Local-first / Local-only
No installation
TURN server
Encrypted-at-rest
Signal protocol
Post Quantum cryptography
Video calls
TOR / anonymous via Git
Serverless over WebRTC

#Privacy #OnlinePrivacy #DataPrivacy #Infosec #CyberSecurity #OpSec #DigitalRights #AntiSurveillance #DataOwnership #E2EE #P2P #PeerToPeer #WebRTC #LocalFirst #LocalOnly #NoCloud #NoRegistration #PWA #SignalProtocol #PostQuantum #Cryptography #SecureMessaging #PrivateChat #EncryptedChat #Decentralized #SelfHosted #BuildInPublic #IndieDev #DevCommunity

Alt...

Glitr.io

RE: https://eupolicy.social/@hpod16/117286020053320946

It’s interesting that people who support age verification have to ask what the problem is. As if it was a big mystery.

Asking people to reveal their personally identification so they can use the internet isn’t a problem that should need to be explained. But since you asked…

1. Our data can not be protected online. Especially by every random person who has the means to buy a domain and pay for hosting.

2. Forcing identification is a barrier for many people. That’s exclusion. And in many cases ableism.

3. Age verification won’t keep kids from using technology. If their parents are that disconnected, they’ll help them through the gates and move on. Restricting access creates a hurdle, not an impasse.

4. Age verification puts the onus on people using the web instead of the people make parts of it horrible. We are victims of nefarious systems. We are not the problem. The systems are. That should be the focus of solutions.

#EUKidsAct #Privacy #Internet #InfoSec #IfYouHaveToAsk

Light boosted

Hannah Grace » 🌐 2026-09-17 / 2026-09-17
@hpod16@eupolicy.social

Get get that the #EUKidsAct is getting a lot of negative chatter from the privacy advocates.
But at the same time to you have to acknowledge there is a serious problem here. I go out in public, I see parents park their kids in front of a tablet to keep them calm, with next to no supervision.
Teenagers are spending on AVERAGE 4-6 hours online per day, instead of going outside and interacting with humans.

So let me ask you, genuinely. What are the concerns here? What needs to be addressed?

I’m posting this again, specifically so I can say:

LOL.

LMFAO.

#privacy #flock #infosec

https://micahflee.com/flock-cameras-are-riddled-with-security-vulnerabilities-and-hard-coded-credentials/

NEW, by me:

Silent Ransom Group Hacked Greenberg Traurig; Who notifies the 126k Affected?

GT says they notified a small number of affected clients. But more than 126,000 clients were affected.

We dug into the data tranche, obtained exclusive details from the threat actors, and asked Yelisey Bohuslavskiy for his thoughts on the group and attempts to prevent their attacks.

https://databreaches.net/2026/09/14/silent-ransom-group-hacked-greenberg-traurig-who-notifies-the-126k-affected/

#databreach #infosec #cybersecurity #hack #extortion #SilentRansomGroup #SRG #GreenbergTraurig

@campuscodi

The whole AI going to destroy humanity feels a bit like mass psychosis.

I really question the motivation of the AI company leaders clamoring for regulation and doomsaying.

If they were so concerned they would just turn off and unplug the AI. As I don't see them doing that, I question the sincerity of their predictions.

Feels a bit like Machiavelli mixed with chicken little.

#ai #aidoom #infosec.

I had a non-recoverable messup with my password manager about a year ago. Since then I've been running very ad-hoc password management. I'm now trying to tidy this up and get a procedure. Recovery is my issue.

I can get a 'recovery phrase' but its the keys to everything. So if I save it somewhere on my computer I'll lose it but a bad actor will find it in no time. If I print it out I need to store it somewhere I can: A find it; B not make it too bloody obvious.

It seems just as insecure as writing down your password but much much harder to hide what it is. A written password can be concealed in surrounding text whereas a machine-generated recovery phrase cannot.

I feel this is all too hard and that I'm somehow setting myself up to fail. Anyone else got a policy they like and are willing to share the method?

PS The overall plan is roughly:
*low-value account pw manager for those that don't have financial stuff in them but I use often.
*high-value account pw manager for those that do have financial stuff in them
*My own memory for the password to the high value account.
#infosec

IDscan, used for age verification, hacked and leaked.

https://techcrunch.com/2026/09/10/id-verification-giant-idscan-confirms-data-breach-with-more-than-150-million-drivers-licenses-stolen/

#ageverification #cybersecurity #infosec #privacy

OpenSSL's latest advisory covers 9 patched vulnerabilities. Our engineers Filipe Casal and Opal Wright found 4 of them as part of Patch the Planet.

The headline finding is CVE-2026-63072: a deterministic 8-byte heap overflow in CMS key unwrapping that an attacker triggers by changing one byte in a legitimate message. Reachable from CMS_decrypt() on every supported branch back to 1.1.1.

https://openssl-library.org/news/secadv/20260825.txt

#openssl #infosec

I haven't played with "developer mode" on an LG TV yet, but had read there was a way to enable a shell like interface for local "app" development.

If that works, any possibility of applying some mitigations there for the egregious spying?

I'd assume user space would be limited vs firmware nonsense, but if "capture the flag" events taught me anything, getting in system at all frequently leads to escalation.

Anyone have references?

#infosec

Old news, but I finally got around to reading the METR paper/post about hugging face and OpenAI and the sandbox escape/attack.

https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

#infosec

I had assumed the "AI attack" was hyped up, but some of the factual details are wild.

"The swarm" isn't sentient, but goal-directed, paperclip maximizers, set to solve "impossible" tasks can get darn creative.

I particularly like using Artifactory cache as a message passing board between agents.

Details are worth the read.

This week: an “unprecedented” number of Apple users received mercenary spyware alerts, a 30-40% jump over previous waves. And a phishing platform is using AI voice agents to call people posing as Apple Support, fishing for passcodes.

Different attacks, same target: your account, your device, your identity.

Zerion has none of those to steal. No account, no phone number, no server. Nothing in the middle to compromise.

zerion.chat

#privacy #infosec #foss #tor

cPanel Patches CVE-2026-65643 Root Code Execution Flaw
https://www.cyberkendra.com/2026/08/cpanel-patches-cve-2026-65643-root-code.html
#security #cpanel #update #infosec #webhosting

You can find The Long Game podcast wherever you get podcasts. I think today's episode might interest some of you because the last portion (skip to 42:47 in the youtube version) has hosts Jake Sullivan & Jon Finer presenting pro/con mock decision briefs to the president regarding implementing a policy of allowing private companies to hack back. https://www.youtube.com/watch?v=oYzQTEllOtg #infosec #ForeignPolicy #cybersecurity

https://thelonggame.substack.com/p/irans-economic-d-day-and-the-us-canada

ok #infosec #browser #android folks: i have a weird thing happening with #localization:

even though i have android set to EN_CA, it looks like sites are reaching for info of my keyboard to set ―what they think― is my actual language.

this is a multilingual keyboard that i use to write in 4 languages. the fuckers think am monolingually french. i thought this was only a Google/Youtube fuck up but now Trackt is doing it too.

WTAF?!?!?

how can i block this stupid #fingerprinting?

It’s almost as if they shouldn’t have gutted #CISA

#US says #China #hackers broke into #DOJ, #NASA, #FederalReserve, #Senate & more

In a statement, the DOJ said that it had seized domains ​used by 2 hacking platforms, dubbed “QScan” & “QTRouter,” which it ​said had been used as part of the campaign. An affidavit ⁠identified the US Departments of #Energy, #HHS, the #NIH, & 4 unnamed companies ​in the US & #SouthKorea as being among the hackers' victims.

#law #InfoSec
https://www.reuters.com/world/china/china-sponsored-hacking-platforms-seized-by-us-justice-department-says-2026-08-26/?utm_source=braze&utm_medium=notifications&utm_campaign=2025_engagement

https://www.youtube.com/watch?v=M3RObanq4o4

The return of "hunter2"

#infosec

Short bit making fun of password change rules.

CC: @dumbpasswordrules

Log4j Deserialization Bypass Is Real but Not Log4Shell
https://www.cyberkendra.com/2026/08/log4j-bug-report-pulled-researcher.html

#infosec #apache #log4j

We gave GPT 5.6-Cyber one task: escape a QEMU/KVM VM used to sandbox agents.

It escaped three times. The final escape came from three 0-days the agent found on its own and built into a working exploit after we patched known bugs and rebuilt QEMU from upstream.

Our takeaway is off-the-shelf VMs cannot contain a modern, cyber-capable agent.

https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

#infosec #AIsecurity #linux

On Provenance (a Cosmos SDK chain), a user could administer a token account if they held 100% of its supply. A check compared their balance to the total supply.

But for many accounts that supply field was frozen at zero, so it just asked "is the balance zero?". Which meant any user that held zero tokens could get admin access.

We found 82 exploitable accounts holding ~$500K in drainable HASH. Now patched. https://blog.trailofbits.com/2026/08/25/state-divergence-enables-unauthorized-access/

#infosec #cosmos