<unnamed>

Public Key

npub1p5zle0pk36rncv38srupa9hayycvc48anh0t9fxg2sjuhm7fw82q2tkrfz

Profile Code

nprofile1qqsq6p0uhsmgapeuxgncp7q7jm7jzvxv2n7emh4j5ny9gfwtalyhr4qpqqq3samnwvaz7tmjv4kxz7fwd4hk6mmnw3ezuurfde4sxtydsw

Publishing to

relay.momostr.pink

Last Notes

2026-08-18 18:48:37 CEST

By enabling the new Xfinity Wi-Fi motion sensing tech, Comcast says it may disclose information generated from a customer’s use of the feature to outside parties under a broad array of reasons — and Comcast also says it doesn’t have to tell you.
More: https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/
Ad-block bypass: https://web.archive.org/web/20260818164350/https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/

2026-08-18 13:43:50 CEST

Not content with Meta making camera-equipped pervert glasses, now Apple is making camera-equipped headphones. PervertPods.
https://www.macrumors.com/2026/08/17/camera-equipped-airpods-macos-26-7/

2026-08-16 17:40:46 CEST

In a busy newsletter this week: U.S. will allow private companies to hack-back; Flock flucked up; new Windows zero-day drops online; a bunch of companies have reported hacks and breaches; a North Korean got caught working in the federal government; and London face scans will continue until morale improves.
Also: a brand new two-for-one reader-submitted cybercats that you won't want to miss, and some fun things in the happy corner of good news. 🐈
Read online/sign up/RSS: https://this.weekinsecurity.com/this-week-in-security-august-16-2026-edition/

2026-08-15 13:38:23 CEST

An absolutely insane story about when U.S. sanctions go wrong and seemingly name the wrong person.
https://conic.al/writing/the-other-sean-byrne-doesnt-exist/

2026-08-14 13:41:14 CEST

RE: https://infosec.exchange/@metacurity/117093610555674034
This is insane. I wrote about the NHS leaking medical data over unencrypted pagers back in *2019*! https://techcrunch.com/2019/10/30/nhs-pagers-medical-health-data/
NHS was meant to phase out pagers by 2021, but apparently several NHS organizations didn't phase out their pager infrastructure, thus leading to the data leak of people's health data.
#note19pd…yfvs

2026-08-13 23:53:54 CEST

New, by me: Apple told me it's sending out threat notifications to customers in 110 countries saying they've been targeted with spyware. This latest batch also features a new push notification, warning users to take action and what to do next.
More: https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/
Ad-block bypass: https://web.archive.org/web/20260813215216/https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/

2026-08-12 17:28:31 CEST

New: A security researcher called Nightmare Eclipse has published details of a new zero-day bug in Windows, seemingly undettered by Microsoft's legal threat earlier this year. The bug affects latest versions of Windows, and currently no patch.
More: https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/
Bypass for ad-blockers: https://web.archive.org/web/20260812152500/https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/

2026-08-10 13:29:07 CEST

Bill Swearingen spent the past year developing a pattern that can defeat being detected by surveillance cameras, including vehicles and people. At Def Con, for the first time, he demoed the pattern printed on a car against a Flock camera to prove it works. (One of my favorite talks from Def Con this year!)
More by me at TechCrunch: https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/
Ad-blocker bypass: https://web.archive.org/web/20260810033558/https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

2026-08-09 21:15:40 CEST

- reply

Leading this week's newsletter is a rare one from me, looking at the highlights from Black Hat, Def Con, and BSides Las Vegas 2026 — especially if you couldn't make it.
Featuring the DOJ's POV on the CFAA, Cliff Stoll's incredible talk 40 years after catching Soviet hackers in the act, OpenAI breaks down its Hugging Face hack, and why popular sex toys on Amazon can be easily and remotely hijacked
Read more: https://this.weekinsecurity.com/the-top-highlights-from-black-hat-def-con-and-bsides-las-vegas-2026-if-you-couldnt-make-it-in-person

2026-08-09 20:10:22 CEST

In my cyber newsletter ~ this week in security ~
The best from Black Hat, Def Con, and BSides Vegas (if you didn't go!); hackers predicted a hardware wallet's seed passwords; inside a China police spy dashboard; AI notetaker app exposed call recordings; Apple Private Relay leaked IP addresses; and much more. 🐈‍⬛
Read online: https://this.weekinsecurity.com/this-week-in-security-august-9-2026-edition/
Sign up: https://this.weekinsecurity.com

2026-08-08 00:05:19 CEST

Microsoft wins "lamest vendor response" award at this year's Pwnie Awards, for publishing a blog post earlier this year threatening security researchers with legal action if they published zero-days.
Also: Meta wins "epic fail" award after its Meta AI hijack bug.
By me: https://this.weekinsecurity.com/microsoft-wins-lamest-vendor-at-pwnie-awards-2026-for-threatening-security-researchers-with-legal-action/

2026-08-07 23:12:47 CEST

Two researchers scanned Poland's internet out of a sense of patriotism and a desire to make it more secure, and found thousands of gov't and public bodies were at risk of very easy hacks. One bug let them take over two-thirds of Poland's court websites.
More: https://techcrunch.com/2026/08/07/security-researchers-scanned-the-polish-web-and-found-courts-hospitals-and-airports-at-risk-of-hacks/
(Bypass for ad-blockers: https://archive.is/pDB7Q)

2026-08-07 15:15:27 CEST

This was really important, powerful reporting by @npub1m0g…ct7v.
The US military’s cyberwarfare unit is scrutinizing an unusually high number of deaths by suicide among personnel over a month-long period this summer, according to government officials and other people familiar with the matter.
https://www.bloomberg.com/news/articles/2026-08-06/us-military-s-cyber-command-unit-grapples-with-cluster-of-deaths-by-suicide

2026-08-06 02:35:04 CEST

I'll be hosting an AMA with security researcher @npub1ukf…az95 on August 12th at 5pm PT / 8pm ET to answer questions about the recent case of an American charged by the DOJ for allegedly wiping his phone with a "duress" password during an airport interrogation. It's the first case of its kind. https://reddit.com/r/pwnhub/comments/1vgovkv/we_are_techcrunch_security_editor_zack_whittaker/

2026-08-04 23:28:37 CEST

Another AI test gone awry, U.K. edition.
"An agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code."
More: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

2026-08-04 14:15:22 CEST

By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.
More: https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/
Sign up (or RSS!) for the weekly newsletter: https://this.weekinsecurity.com

2026-08-04 13:18:54 CEST

RE: https://mastodon.social/@zackwhittaker/117033323332487017
If there's one thing I've learned from publishing this story is that there is a very, very, very wide chasm between what the law says about all this... and what people *think* the law says and/or *should* say.
#note1pqa…7kdf

2026-08-03 21:53:14 CEST

After Anthropic and OpenAI both admitted to their AI models hacking other companies, @npub1xvw…ksg7 and I wanted to find out: Who is legally to blame when an autonomous AI agent hacks something? Lawyers say it's really complicated; one called it "uncharted territory."
Read more: https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/
Bypass for ad-blockers: https://web.archive.org/web/20260803194912/https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

2026-07-31 22:30:12 CEST

U.S. biotech giant Amgen confirms July hack, and says proprietary data, patients' health data, and other information was exfiltrated from its cloud environments (Amgen runs largely on AWS). Amgen says volume & types of data stolen "could be sensitive."
Amgen says it serves 17 million patients. 🫠
From the SEC filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/0000318154/000031815426000119/amgn-20260729.htm

2026-07-31 12:47:50 CEST

I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

2026-07-30 22:35:06 CEST

CareCloud, which stores patients' medical records for 45,000+ hospitals & healthcare providers across the U.S., has begun notifying hundreds of thousands of people that their data was stolen in a March breach. The notices reveal new details, and the number of affected people is expected to rise.
More, by me: https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/
Bypass for ad-blockers: https://web.archive.org/web/20260730203017/https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

2026-07-30 00:35:14 CEST

- reply

Ah — an extortion racket called ExfilSquad took credit three days ago for stealing ~570,000 records, allegedly containing customers' personal information and addresses.
Notably, the hackers' leak site doesn't currently list Analog, suggesting that the company may have paid a ransom. I asked, etc., but nada.

2026-07-30 00:23:53 CEST

Analog Devices, which makes a shit ton of computer chips, confirmed in an 8-K filing that it had a data breach in June where hackers exfiltrated data.The nature of the data is still under investigation, and nothing more for now, the company said.
"Separately and unrelated," the company goes on (👀), it's investigating a *second* security incident. I asked, but a spox. wouldn't comment beyond the statement.
Here's the filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/6281/000119312526324223/d158253d8k.htm

2026-07-29 23:17:03 CEST

RE: https://cyberplace.social/@GossiTheDog/117004159920714904
Solid thread here from @npub1lcc…lcye and other defenders. ClickFix, phishing, and phone calls seem to be the big common threat themes, not AI.
#note12un…5w7s

2026-07-26 16:10:27 CEST

In my latest weekly cyber newsletter: OpenAI admits to hacking Hugging Face, millions of cars with hidden alarms vulnerable to hacking, Iran's hacking water and energy systems, Russia's targeting nuclear scientists with an email zero-day, a healthcare hack sparks data theft fears, and much more.
Read online: https://this.weekinsecurity.com/this-week-in-security-july-26-2026-edition/
Sign up/RSS and support: https://this.weekinsecurity.com

2026-07-25 01:56:41 CEST

Incredibly detailed reporting by @npub1xx5…plnx et al at Reuters on the OpenAI hack of Hugging Face, revealing new details on how it went down and how it took a week for OpenAI to notice one of its AI models was hacking into another company, citing multiple sources.
More: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/

2026-07-24 20:08:25 CEST

- reply

The person's attorney said feds are using a rarely used federal statute, and security experts said they hadn't heard of similar cases. This raises fresh questions about constitutional rights and device searches at the U.S. border.
Also: the DOJ's indictment had a notable typo. Read on for more.
https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search

2026-07-24 20:06:18 CEST

New, by me: The Justice Department is prosecuting an American for allegedly providing U.S. border agents with a "duress" passcode that wiped the contents of his phone when they entered it. We've confirmed the phone was running GrapheneOS.
Read more: https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search
Bypass for ad-blockers: https://web.archive.org/web/20260724175443/https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/

2026-07-22 12:22:50 CEST

Even if Hugging Face is fine with all this (and honestly, why should it be; OpenAI clearly can't control a technology of its own making?), there's room for the USG to bring criminal CFAA charges against OpenAI. It's not like OpenAI execs wrote a blog post describing their crimes or anything. 🙄
https://www.theguardian.com/technology/2026/jul/22/openai-says-its-models-went-rogue-and-hacked-startup-in-unprecedented-incident

2026-07-21 16:59:36 CEST

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.
More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/
Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

2026-07-20 17:04:53 CEST

New, by me: A tech company called Craneware says it was hacked and that a "significant" amount of data stolen, including its customers. The company provides software to thousands of U.S. clinics, hospitals, and pharmacies around the world, sparking fears of a data breach of patient data.
More: https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/
Bypass for ad-blockers: https://web.archive.org/web/20260720150203/https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/

2026-07-19 17:09:28 CEST

In this week's ~ this week in security ~
Spy vans are coming to U.S. police departments, how a London crew pulled off a brazen datacenter theft, Iran exploited phone bugs to track U.S. troops, Finnish therapy hacker wanted, and most fitness trackers lack basic security features. Also: WordPress bugs under active attack, and why librarians are helping people avoid AI. Plus: A brand new cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-july-19-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-07-17 17:42:27 CEST

RE: https://infosec.exchange/@josephcox/116936059609034986
This is really bad on its own, but again — it's an absolute travesty that a private company like Thomson Reuters can collect and store massive databases of Americans' private and personal data — from names, addresses, Social Security numbers, ethnicity, social media posts, and location information — and the government can just buy that data, no warrant needed. The data broker industry needs be shut down and privacy rights in the U.S. regulated. https://www.404media.co/ice-to-pay-thomson-reuters-125-million-to-find-voter-fraud/
#note107n…g4zd

2026-07-17 17:37:47 CEST

New, by me: Amazon said it's trying to fix a bug in its billing platform that kicked out incorrect estimates for Amazon Web Services cloud customers. How bad? Some AWS customers reported getting estimates into the billions of dollars. Whoops!
More: https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollars/
Bypass for ad-blockers: https://web.archive.org/web/20260717152958/https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollars/

2026-07-16 15:00:35 CEST

Fantastic work by @npub1l3x…v4qu at EFF looking at the state of fitness tracker privacy.
Most wearable makers don't end-to-end encrypt your data, so police/feds (and hackers!) can get your health data — and almost none publish a transparency report, so we may never know if they do.
https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

2026-07-15 16:32:26 CEST

- reply

ding ding ding, exactly

2026-07-15 16:23:11 CEST

U.K. government says it's not taking action to restrict on VPNs for now, as ministers sought to limit them under its age verification laws.
https://www.bbc.com/news/articles/c982857nlrlo

2026-07-13 22:05:16 CEST

New, by me: Core to its complaint against OpenAI, Apple accused a former employee of allegedly exploiting a security bug to steal reams of confidential files from Apple's network over several weeks while working as an OpenAI employee
“LOL, I found out I can access the [network storage], so funny,” the ex-Apple employee allegedly wrote.
Read more: https://techcrunch.com/2026/07/13/apple-says-former-employee-exploited-rare-bug-to-download-confidential-files-after-leaving-for-openai/
(Bypass for ad-blockers: https://archive.is/rmPlh)

2026-07-13 16:26:33 CEST

New: The LAPD, the third-largest police department in the United States, let its contract with surveillance giant Flock expire this weekend, citing "serious concerns" with civil liberties and privacy.
Flock said it was surprised by the move, but it's not clear if the company's license plate readers will immediately cease recording.
More: https://techcrunch.com/2026/07/13/lapd-lets-contract-with-surveillance-giant-flock-expire-citing-serious-concerns-over-civil-liberties-and-privacy/
(Bypass link for ad-blockers: https://archive.is/zUou2)

2026-07-10 16:23:31 CEST

New, by me: A federal court has jailed a Florida man for helping a notorious ransomware gang extort U.S. companies while working for a cyber company as a *ransomware negotiator*. He's the third security person to be jailed for this (batshit) extortion scheme.
More, by me: https://techcrunch.com/2026/07/10/florida-ransomware-negotiator-convicted-for-helping-ransomware-gang-extort-us-companies/
(Bypass for ad-blockers: https://archive.is/lDVxf)

2026-07-09 14:50:17 CEST

I think this raises an important point. I moved to the U.S. a few years ago to become a U.S. journalist. I've been very fortunate to have workplaces that let me do my job uninhibited. In America, a person's ability to access healthcare for themselves and their family is almost always linked to their employer. This means U.S. companies, including media outlets, hold way too much power & control over their employees. It's all the more crucial to support independent media.
https://mastodon.social/@randahl/116889333585143994
#note1d0d…7m7q

2026-07-09 03:47:42 CEST

- reply

My hand-written cybersecurity newsletter ~ this week in security ~ goes out every Sunday with all of the major news you need to know from the week and much more, plus some levity in the happy corner of good things, and a reader-submitted cyber-cat. 🐈‍⬛
No email open/link tracking — because I care about your privacy! Sign up/RSS for the weekly email: https://this.weekinsecurity.com/

2026-07-08 18:31:26 CEST

There's been *yet another* majot breach of U.S. driver's license numbers. Insurance giant AssuranceAmerica confirmed a breach affecting over 6.9 million people, making it the largest known spill of Americans’ driver’s license data this year.
By me at TechCrunch: https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/
Bypass for ad-blockers: https://web.archive.org/web/20260708162100/https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/

2026-07-08 14:15:20 CEST

Smart glasses with cameras and microphones built-in and facial recognition to come are the latest fad in surveillance tech.
For my blog & newsletter ~ this week in security ~ I wrote about why the backlash against smart glasses — aka "pervert glasses" — is justified from a security and privacy perspective. Please read and share!
More: https://this.weekinsecurity.com/reframing-smart-glasses-as-pervert-glasses/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-07-07 03:17:53 CEST

Took a photo of this license plate a few days ago while on vacation in Maine, seems apt today.
https://files.mastodon.social/media_attachments/files/116/876/054/582/649/826/original/eff43c120f8718da.jpeg

2026-07-06 16:15:53 CEST

Layoffs are a failure of leadership.
https://www.theverge.com/news/961528/microsoft-layoffs-july-2026-sales-xbox

2026-07-03 13:23:49 CEST

New, by me: A politician who was part of a European Parliament committee tasked with investigating spyware abuses had his own phone hacked with Pegasus spyware. Stelios Kouloglou told me the hacking was "reckless" and likely due to his work. He plans to sue NSO, which develops Pegasus.
More: https://techcrunch.com/2026/07/02/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware/

2026-07-02 02:09:37 CEST

RE: https://mastodon.social/@zackwhittaker/116032232185026857
Nice to be back home and online after a relaxing few days away, went outside to water the plants on the deck and OH FOR FU... guys, c'mon, AGAIN?!
https://files.mastodon.social/media_attachments/files/116/847/475/010/609/034/original/5fda747b33a7ab91.jpeg
#note1kq8…g4su

2026-06-24 17:44:47 CEST

Trump is threatening to refuse to sign a bipartisan(!)-agreed bill that aims to tackle the ongoing housing affordability crisis unless Congress passes his insane voter ID law. Last week it was FISA & now this. Trump doesn't care about natsec, the economy, or you. It's all so he can stay in power.
https://apnews.com/article/trump-capitol-republican-senators-968c1454ede461d2db413790670c07df

2026-06-23 21:55:20 CEST

New, by me: Klue says hackers used a credential from a 2022 pilot that allowed the recent mass-theft of customers' data. Lots of unknowns, but raises questions about how long the credential was active & what could've been done to mitigate.
More: https://techcrunch.com/2026/06/23/klue-says-hackers-stole-credential-from-2022-that-led-to-customer-data-breaches/
Bypass for ad-block users: https://web.archive.org/web/20260623194503/https://techcrunch.com/2026/06/23/klue-says-hackers-stole-credential-from-2022-that-led-to-customer-data-breaches/

2026-06-22 21:53:48 CEST

In a new privacy policy, Anthropic says Claude will soon require you to upload your driver's license or passport for a variety of reasons. The ID checker is Persona, a firm funded by Trump ally Peter Thiel. As a U.S. company, Persona is also subject to gov't demands for people's verification data. 👀
https://techcrunch.com/2026/06/22/anthropic-says-claude-may-want-to-see-your-id/

2026-06-22 16:44:53 CEST

A cybercrime gang took credit for a hack at Klue, allowing them to steal data from a bunch of major cybersecurity companies.
My story: https://techcrunch.com/2026/06/22/klue-hack-results-in-data-breach-at-several-cybersecurity-firms/
But you might not have seen Klue CEO's blog post because it included "noindex" code in the HTML, which hides the page from search engine results: https://web.archive.org/web/20260622144218/https://klue.com/blog/an-update-on-recent-klue-security-incident

2026-06-21 21:32:21 CEST

To anyone and everyone who also has complicated or painful feelings on days like today for Mother's or Father's Day, you are seen and you are loved.

2026-06-18 13:50:46 CEST

My adorable large adult cat son Theo had high blood pressure (what reason does he have to be stressed? he's a cat, he doesn't even pay rent). After some medication, he's doing great.
Still something hilarious about cats having their own blood pressure machines. His brother Toby was being very sweet.
https://files.mastodon.social/media_attachments/files/116/770/956/632/179/822/original/a0618bd3cd38c83d.jpeg
https://files.mastodon.social/media_attachments/files/116/770/956/678/121/825/original/43e39052f7e677c8.jpeg

2026-06-16 01:05:34 CEST

I wrote some words for TechCrunch about the Anthropic ban shitshow. https://techcrunch.com/2026/06/15/the-us-governments-anthropic-models-ban-was-never-about-an-ai-jailbreak/

2026-06-12 13:57:47 CEST

New, by me: In a rare rebuke for Trump, Republicans balked at voting to reauthorize the U.S.' warrantless spying powers over Trump's pick to oversee the intelligence agencies.
Critics said Bill Pulte would weaponize the job of top spy, so lawmakers let the powers expire instead. Trump caved and picked someone else over Pulte, but by then most lawmakers had left Washington DC for the week.
Due to a quirk in the law, the government's spy programs won't stop overnight.
https://techcrunch.com/2026/06/12/us-spy-law-to-expire-for-first-time-after-lawmakers-reject-trumps-controversial-pick-to-lead-spy-agencies/

2026-06-10 16:15:23 CEST

New, by me: ServiceNow appears to have notified some enterprise customers that there was outside access to their data, after a security bug left instances exposed to the web.
The company has hidden its notice behind a login wall, but was shared by network defenders on Reddit.
https://techcrunch.com/2026/06/10/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet/

2026-06-08 22:47:33 CEST

Microsoft confirmed it's notified a "small number of customers" who may have pulled password-stealing malware from some of its GitHub-hosted open source repos, while many affected repos are still down.
I've asked for a specific number. Even a "small number" of Microsoft's many, many customers could be significant.
https://techcrunch.com/2026/06/08/microsofts-open-source-tools-were-hacked-to-steal-passwords-of-ai-developers/

2026-06-06 13:52:21 CEST

New, by me: Meta has filed a data breach notice confirming that *thousands* of people had their Instagram accounts hacked as part of a months-long campaign abusing its Meta AI chatbot.
Meta's breach notice shows the hacks were far more widespread than first thought.
More: https://this.weekinsecurity.com/meta-confirms-thousands-of-instagram-accounts-were-hacked-by-abusing-its-ai-chatbot/
Sign up/RSS for my free weekly newsletter: https://this.weekinsecurity.com/

2026-06-04 22:37:43 CEST

RE: https://infosec.exchange/@cR0w/116692776221622923
Last year I said this, and it's still true.
"If there's one thing I've learned about covering cybersecurity over the past decade or so, is that the cybersecurity community (the fixers and breakers) and the cybersecurity industry (profits above all else) are two very, very different things."
#note1le8…4h0s

2026-06-04 22:33:34 CEST

Personally I think Dashlane's update to its 2FA-busting data breach notice is still lackluster and doesn't explain that much beyond its original post. That said, @npub1z3l…qvzu does a solid job of reading between the lines and filling in the gaps. tl;dr: Bruteforcing Dashlane customer account 2FA codes was relatively easy.
https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/

2026-06-04 17:22:10 CEST

- reply

while the decision is above my paygrade, I agree with you, and you shouldn't have to ever switch off your ad blocker.

2026-06-04 17:07:00 CEST

You know things are bad when Chinese spies are *also* spending their entire day on LinkedIn.
https://techcrunch.com/2026/06/04/chinese-spies-are-using-linkedin-to-lure-westerners-into-sharing-sensitive-information/

2026-05-30 14:48:37 CEST

It's rare to see near-universal condemnation from the infosec community, but Microsoft threatening a security researcher has done it.
Notable exceptions: When Keeper Security sued Ars Technica over a story (2017); NSA's mass surveillance uncovered (2013); and FBI demanding an Apple backdoor (2016).
https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/

2026-05-30 04:34:02 CEST

PostHog says it's currently experiencing a security incident. The analytics company said it's "rotating keys after a security research team was able to confirm an exploit in one of our AWS environments," referring to Amazon Web Services.
Incident page: https://www.posthogstatus.com/incidents/01KSV6HJYKG5QJAP8HVTSQVSM1
https://files.mastodon.social/media_attachments/files/116/661/186/596/263/969/original/72cc7c1dc9632d5f.jpeg

2026-05-28 20:09:22 CEST

It's a day ending in "y," so there's another 300,000+ driver's licenses and other sensitive documents publicly exposed to the web. This time it's Pay Tel, a prison phone calling service, which hasn't responded to requests for comment or said if it plans to notify those whose data was exposed.
https://techcrunch.com/2026/05/28/a-security-lapse-at-prison-payphone-service-pay-tel-publicly-exposed-over-300000-callers-drivers-licenses/

2026-05-27 18:59:57 CEST

Condé Nast shit the bed so hard when it fired four journalists last year that it's now settled with the union and given three out of the four reporters "two years’ pay and furnished [them] with positive letters of recommendation."
UNIONS, PEOPLE. UNIONS!
https://www.hollywoodreporter.com/business/business-news/conde-nast-union-settlement-fired-four-exclusive-1236606293/
https://files.mastodon.social/media_attachments/files/116/647/596/398/326/862/original/34d063439c6fa0ad.png

2026-05-27 01:57:19 CEST

New, by me: A person notified us that a website called UK Visa Portal is publicly exposing 100,000+ passports & selfies of applicants who paid the site to obtain a UK immigration visa. We emailed the company to share details about the security lapse — but didn't hear back from its management.
https://techcrunch.com/2026/05/26/uk-visa-portal-spilled-thousands-of-applicants-passports-and-selfies-online-and-hasnt-fixed-the-leak/

2026-05-23 14:40:16 CEST

New, by me: Health wearable giant Oura says it has received government demands for users' information (because Oura does not use end-to-end encryption).
Will Oura say how often it gets demands for user data, and how often Oura hands over users' data to authorities?
Read online: https://this.weekinsecurity.com/oura-says-it-gets-government-demands-for-user-data-will-it-share-how-many/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

2026-05-23 04:03:11 CEST

"I have been a professional tech journalist for nearly fifteen years, and before today, I cannot think of a single time when a Bing search result was more valuable than the Google equivalent. There really is a first time for everything!"
https://techcrunch.com/2026/05/22/you-can-no-longer-google-the-word-disregard/

2026-05-23 03:37:11 CEST

If someone wants to leak me a copy of this app (either .apk or .ipa), please reach out on Signal — my username is zackwhittaker.1337 — and I would be keen to run this app through Burp Suite to see how it works. Happy to grant anonymity.
https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

2026-05-23 00:23:03 CEST

- reply

Cognizant *again?!*

2026-05-22 14:41:33 CEST

Oh no! BASED APPAREL, the online store run by FBI director Kash Patel (for some reason?), was hacked to serve ClickFix attacks (🎻).
Website visitors see a fake Captcha-style screen, and are then tricked into hacking themselves by copying and pasting malware code.
How this hack works: https://this.weekinsecurity.com/clickfix-attacks-are-increasingly-devious-dangerous-and-can-get-you-hacked-in-an-instant/
https://files.mastodon.social/media_attachments/files/116/618/263/548/131/332/original/015943dfd2b15c9b.png
https://files.mastodon.social/media_attachments/files/116/618/268/327/259/606/original/cfad64c2e49ca61b.png

2026-05-21 13:56:18 CEST

New, by me: Scammers are abusing a legitimate internal Microsoft account (used for sending critical account alerts and MFA codes to users logging in) to send spam and scam emails.
We first saw a flood of these emails last week, but anti-spam project Spamhaus says this has been going on for months.
More: https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam

2026-05-20 17:14:04 CEST

- reply

I get there's a lot of buzz and excitement about AI's cyber capabilities at the moment. But if the government assessments of AI today are anything to go by, it's *all the more reason* to invest in strong cyber foundations and best practices to make it more difficult for attacks to succeed.
Let me know what you think, and please share if you found this blog useful.
https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/

2026-05-20 15:27:41 CEST

GitHub says thousands of its internal repos were compromised in a recent attack. The Microsoft-owned company said it "detected and contained a compromise of an employee device involving a poisoned VS Code extension."
https://techcrunch.com/2026/05/20/github-says-hackers-stole-data-from-thousands-of-internal-repositories/

2026-05-20 14:07:39 CEST

For my newsletter & blog, I wrote about why many in cybersecurity are talking about AI — but crucially, why I think it's also all the more important to *not forget* about the cybersecurity basics and best practices, which are still the leading causes of damaging breaches.
More: https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-05-20 02:05:28 CEST

- reply

Here it is:
Within 60 days, Treasury shall propose changes to the Bank Secrecy Act to strengthen risk-based customer due diligence requirements, including information relevant to whether account holders possess lawful immigration status & to "collect and verify" customer identity information.
https://www.whitehouse.gov/presidential-actions/2026/05/restoring-integrity-to-americas-financial-system/

2026-05-18 14:24:23 CEST

We have yet to normalize booing billionaires in public, but we should definitely start.
https://techcrunch.com/2026/05/17/if-youre-giving-a-commencement-speech-in-2026-maybe-dont-mention-ai/

2026-05-15 23:11:25 CEST

CNN's Sean Lyngaas back once again with a belter story: Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple U.S. states.
Per Lyngaas: the hackers "exploited automatic tank gauge systems that were sitting online and unprotected by passwords."
A little louder for the folks in the back:
...."UNPROTECTED BY PASSWORDS."
https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

2026-05-15 21:47:45 CEST

Filed under "shit I can't believe is still happening in 2026 but here we are": 1+ million photo IDs and selfies from a hotel check-in system left publicly exposed online for anyone to find.
This is the latest example of a company leaking government-issued IDs in recent months.
https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/

2026-05-14 16:11:38 CEST

In a Wednesday blog post, Cisco CEO Chuck Robbins announced layoffs of 4,000 employees (5% staff) so that the company can spend more on AI and cybersecurity. He also touted Cisco's "record revenue" and "double-digit growth."
Robbins' total executive compensation is ~$52 million for 2025.
https://techcrunch.com/2026/05/14/cisco-cuts-nearly-4000-jobs-to-spend-more-on-ai-reports-record-quarterly-revenue/

2026-05-13 20:17:54 CEST

Malware research group vx-underground has 30 terabytes of malware. VirusTotal has 31 *petabytes* of malware in its bank.
We were curious how tall these datasets would be if stacked as hard drives, so we did some rough back-of-a-napkin math to figure it out.
https://techcrunch.com/2026/05/13/this-is-what-some-the-worlds-largest-banks-of-malware-look-like-stacked-as-hard-drives

2026-05-12 17:41:03 CEST

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails.
Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.
https://files.mastodon.social/media_attachments/files/116/562/355/988/416/854/original/6bd8200b17e0a93a.png
https://files.mastodon.social/media_attachments/files/116/562/356/033/300/617/original/7f0198d1a59491c8.png

2026-05-11 15:07:02 CEST

In this 3,000+ word deep-dive for my blog and newsletter ~ this week in security ~ I explore the most pressing threats to face the internet this year. This includes surveillance and choking online access to governments going rogue, and more, and why they pose a risk.
https://this.weekinsecurity.com/the-most-dangerous-threats-to-the-internet-in-2026/

2026-05-10 00:16:58 CEST

Edtech giant Instructure was hacked (twice) — and finally put up a security incident page after the mass-defacement of Canvas school login pages.
But you might not find the page because right now it has a "noindex" tag in the page's HTML code, which prevents it from being listed in search results.
The page is here, FYI: https://www.instructure.com/incident_update

2026-05-08 23:55:28 CEST

SEC filing: Identity/security firm SailPoint said it detected a breach of some of its GitHub repos on Apr 20. Says the root cause was a vulnerability in a third-party application, without saying more. "No evidence" of a customer data breach, but said it notified each customer that had data accessed.

2026-05-08 16:47:10 CEST

What did you (or someone you know) do this week that you're incredibly proud of?

2026-05-07 23:02:22 CEST

NEW w/ @npub1xvw…ksg7: Hackers have defaced a bunch of school login pages for Canvas, the student portal made by ed-tech giant Instructure.
This appears to be the latest effort by the ShinyHunters to apply pressure on the company.
https://techcrunch.com/2026/05/07/hackers-deface-school-login-pages-after-claiming-another-instructure-hack/

2026-05-07 17:17:04 CEST

Police arrested three men accused of driving around an SMS blaster across downtown Toronto, which allegedly blasted tens of thousands of phones with spammy text messages over several months.
https://techcrunch.com/2026/05/07/police-arrest-sms-blaster-crew-that-sent-malicious-messages-to-thousands-across-toronto/

2026-05-06 20:41:02 CEST

Per The Register, cybersecurity vendor Arctic Wolf has laid off 250 workers, or ~10% staff, to save money amid an AI push. https://www.theregister.com/ai-and-ml/2026/05/06/arctic-wolf-cuts-250-jobs-in-ai-push/5231213
Arctic Wolf is worth billions of dollars. Will execs take a paycut? Also, it doesn't have any women on its executive leadership team. Shameful. https://arcticwolf.com/company/companyleadership/

2026-05-06 18:11:14 CEST

I heard more from Disc-Soft, the maker of Daemon Tools, which was backdoored by suspected Chinese-language hackers and used to compromise thousands of users.
Disc-Soft tells me the backdoor was "limited to the free DAEMON Tools Lite" and v12.6 removes the backdoor; investigation ongoing.
My earlier story: https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-05 17:25:16 CEST

NEW: Kaspersky says hackers planted and activated a backdoor in the popular Windows disk imaging app Daemon Tools a month ago, infecting thousands of computers around the world in a n ongoing, "widespread" attack.
The attack appears to be ongoing. A representative for Disc Soft, which makes Daemon Tools, said it was aware of Kaspersky's report and was investigating.
This is the latest supply chain attack targeting software used by a large number of people.
https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-05 03:02:38 CEST

By me: I'm suing the U.S. government under the Freedom of Information Act.
https://this.weekinsecurity.com/plot-twist-i-am-suing-the-justice-department-and-fbi

2026-05-04 13:04:36 CEST

Excellent reporting, alarming findings. Bloomberg's @npub1ry5…n4f0 et al found U.S. state government health websites are sharing people's personal info (sex, citizenship & race data) with tech giants via pixel-sized webpage trackers. Several states pulled the trackers after Bloomberg disclosed.
ALWAYS USE AN AD-BLOCKER. But really!
https://www.bloomberg.com/features/2026-healthcare-advertising-trackers-privacy/
https://files.mastodon.social/media_attachments/files/116/515/976/653/674/081/original/1a8d2e5a2585b1ee.png

2026-05-02 14:06:11 CEST

For my blog and newsletter, I wrote about a growing trend of regular consumers finding security bugs, flaws, and data leaks but having no way to report them to the companies.
In this blog, I make the case why *every* organization should make it easy for anyone to alert them to security issues. You might also avoid getting an alarming email from an inquiring reporter like me...
Thanks for sharing! ❤️
Read: https://this.weekinsecurity.com/why-every-organization-should-make-it-easy-to-report-security-flaws/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-04-22 16:17:43 CEST

U.K. intelligence says at least 100 countries now have access to government spyware, up from around 80 countries in 2023. The rise shows that spyware continues to proliferate and that the bar to obtaining spyware is lower.
https://techcrunch.com/2026/04/22/uk-government-says-100-countries-have-spyware-that-can-hack-peoples-phones/

2026-04-22 13:01:17 CEST

So... Anthropic spent weeks claiming that it couldn't publicly release its Mythos AI model because of its alleged offensive hacking capabilities and.... some AI nerds from Discord just found it and accessed it? Anthropic is a fucking joke. https://www.bloomberg.com/news/articles/2026-04-21/anthropic-s-mythos-model-is-being-accessed-by-unauthorized-users
https://files.mastodon.social/media_attachments/files/116/448/005/664/062/992/original/f9deb4fa7bd1acba.png

2026-04-12 16:25:37 CEST

Today in ~ this week in security ~:
FBI disrupts Russia's router botnet, Iran hackers targeting US critical infrastructure, a major hack hits Anadot customers, a U.S. spyware maker is sentenced, and a health records giant ransomware'd.
Plus: stick around for a raccoon hacker stealing outsourced data, and a new reader-submitted cybercat.
Thanks for reading, please share!
https://this.weekinsecurity.com/this-week-in-security-april-12-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-04-08 23:51:55 CEST

New, by me at TechCrunch: The developer of the widely popular Wireguard VPN says he is also unable to ship software updates to Windows users after Microsoft locked his account, marking the second high-profile app developer (VeraCrypt) in the past few weeks to face this issue.
https://techcrunch.com/2026/04/08/wireguard-vpn-developer-cant-ship-software-updates-after-microsoft-locks-account/