Zack Whittaker

Security editor, TechCrunch
Email: [email protected]
Signal: zackwhittaker.1337
New York, NY

Newsletter: https://this.weekinsecurity.com
TechCrunch: https://techcrunch.com/author/zack-whittaker

Public Key

npub1p5zle0pk36rncv38srupa9hayycvc48anh0t9fxg2sjuhm7fw82q2tkrfz

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsq6p0uhsmgapeuxgncp7q7jm7jzvxv2n7emh4j5ny9gfwtalyhr4qprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyqq3hxesq

Publishing to

relay.momostr.pink

Author Public Key

npub1p5zle0pk36rncv38srupa9hayycvc48anh0t9fxg2sjuhm7fw82q2tkrfz

Show more details

Last Notes

2026-06-22 19:53:48 UTC

In a new privacy policy, Anthropic says Claude will soon require you to upload your driver's license or passport for a variety of reasons. The ID checker is Persona, a firm funded by Trump ally Peter Thiel. As a U.S. company, Persona is also subject to gov't demands for people's verification data. 👀
https://techcrunch.com/2026/06/22/anthropic-says-claude-may-want-to-see-your-id/

2026-04-22 14:17:43 UTC

U.K. intelligence says at least 100 countries now have access to government spyware, up from around 80 countries in 2023. The rise shows that spyware continues to proliferate and that the bar to obtaining spyware is lower.
https://techcrunch.com/2026/04/22/uk-government-says-100-countries-have-spyware-that-can-hack-peoples-phones/

2026-04-22 11:01:17 UTC

So... Anthropic spent weeks claiming that it couldn't publicly release its Mythos AI model because of its alleged offensive hacking capabilities and.... some AI nerds from Discord just found it and accessed it? Anthropic is a fucking joke. https://www.bloomberg.com/news/articles/2026-04-21/anthropic-s-mythos-model-is-being-accessed-by-unauthorized-users
https://files.mastodon.social/media_attachments/files/116/448/005/664/062/992/original/f9deb4fa7bd1acba.png

2026-04-20 18:35:28 UTC

Major alarm bells over this. Bessent wants US banks to require customers send in copies of their passports etc. to prove citizenship, which would be far beyond the know-your-customer checks that they're required to do already. Implies this could result in closing bank accounts over non-compliance.
https://www.cnbc.com/2026/04/15/banks-citizenship-data-collection-customer-accounts.html

2026-04-20 14:49:29 UTC

NEW by me: Cloud app host Vercel says it was hacked and that some customers' data was taken.
Vercel blames an earlier breach at Context AI (*unrelated to OpenAI). Hackers allegedly used their access in March to hack a Vercel employee, who had linked a Context AI app to their work account.
https://techcrunch.com/2026/04/20/app-host-vercel-confirms-security-incident-says-customer-data-was-stolen-via-breach-at-context-ai

2026-04-17 13:21:24 UTC

Embarrassing times for the European Commission after security researchers found flaws within minutes of using its age verification app. https://www.politico.eu/article/eu-brussels-launched-age-checking-app-hackers-say-took-them-2-minutes-break-it/
(ICYMI: I have a blog post on why age verification laws are a bad idea to begin with: https://this.weekinsecurity.com/papers-please-age-verification-laws-threaten-everyones-online-security-and-privacy/)

2026-04-16 13:19:22 UTC

NEW, by me: Fashion retailer Express exposed customers' personal information and order details to the web for anyone to view. Some customer order pages had already been listed in search engine results.
The bug is now fixed after we alerted the company, but wouldn't say if it would notify customers.
https://techcrunch.com/2026/04/16/fashion-retailer-express-left-customers-personal-data-and-order-details-exposed-to-the-internet/

2026-04-15 02:35:33 UTC

Theo hard at work in the biscuit factory. Have a peaceful evening, everyone.
https://files.mastodon.social/media_attachments/files/116/406/388/601/409/650/original/29c0f70894ea63b2.jpeg

2026-04-14 14:40:41 UTC

New, by me: Adobe has fixed a bug in its flagship PDF readers that hackers have been abusing for at least four months to break into people's Windows and macOS computers and steal data.
A security researcher who discovered the hacks said it works by tricking victims into opening a malicious PDF.
https://techcrunch.com/2026/04/14/adobe-fixes-pdf-zero-day-security-bug-that-hackers-have-exploited-for-months/

2026-04-12 14:25:37 UTC

Today in ~ this week in security ~:
FBI disrupts Russia's router botnet, Iran hackers targeting US critical infrastructure, a major hack hits Anadot customers, a U.S. spyware maker is sentenced, and a health records giant ransomware'd.
Plus: stick around for a raccoon hacker stealing outsourced data, and a new reader-submitted cybercat.
Thanks for reading, please share!
https://this.weekinsecurity.com/this-week-in-security-april-12-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-04-10 17:12:05 UTC

In some rare(?) good news, the developers of VeraCrypt and WireGuard have both told me that they have regained access following their Microsoft account lockouts and can now release updates again.

2026-04-09 12:19:56 UTC

Since North Korea has been in the news thanks to two massive hacks just days apart, I'm re-sharing my long-read primer on the ongoing and major threat from North Korean hackers, what they do, how they do it, and why they're incredibly successful — so much so that they could even be your co-worker.
https://this.weekinsecurity.com/thousands-of-north-koreans-have-secretly-infiltrated-us-and-european-companies-as-remote-it-workers/

2026-04-08 21:51:55 UTC

New, by me at TechCrunch: The developer of the widely popular Wireguard VPN says he is also unable to ship software updates to Windows users after Microsoft locked his account, marking the second high-profile app developer (VeraCrypt) in the past few weeks to face this issue.
https://techcrunch.com/2026/04/08/wireguard-vpn-developer-cant-ship-software-updates-after-microsoft-locks-account/

2026-04-08 15:22:15 UTC

New, by me: Mounir Idrassi, the developer of the popular file encryption software Veracrypt, says Microsoft has locked his account used for sending software updates, and warned that Windows users who encrypt their PCs with his software may soon find it "impossible to boot," Idrassi tells me.
https://techcrunch.com/2026/04/08/veracrypt-encryption-software-windows-microsoft-lock-boot-issues/

2026-04-07 17:24:50 UTC

It's incredibly bleak out there in the world today but I will take a little solace in just how soft and fuzzy my large adult cat son is.
https://files.mastodon.social/media_attachments/files/116/364/586/343/093/144/original/0c68be4069b6db88.jpeg

2026-04-07 13:05:08 UTC

For my blog ~ this week in security ~ I wrote about how hacks, cyberattacks, and data breaches are almost *never* the employee's fault — even if the companies say so.
Read online: https://this.weekinsecurity.com/that-big-company-hack-probably-was-not-an-employees-fault/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-04-06 17:01:02 UTC

I wrote some words for TechCrunch about how North Korean hackers took weeks to hack the top developer of one of the web's most popular open-source projects, Axios. Increasingly difficult to defend against well-resourced and persistent hackers when you're a small team or lone developer.
https://techcrunch.com/2026/04/06/north-koreas-hijack-of-one-of-the-webs-most-used-open-source-projects-was-likely-weeks-in-the-making/

2026-04-06 13:10:33 UTC

NEW, by me: pcTattletale founder Bryan Fleming has avoided a jail term after earlier pleading guilty to making, selling, and advertising spyware for unlawful purposes. pcTattletale was used to stealthily spy on thousands of people's devices without their knowledge, and shut down after a data breach in 2024 exposed the stolen personal data of countless victims.
Fleming is the first spyware maker convicted in the U.S. in over a decade.
https://techcrunch.com/2026/04/06/convicted-spyware-maker-bryan-fleming-avoids-jail-at-sentencing/

2026-04-02 21:28:29 UTC

New, by me: Telehealth giant Hims & Hers confirmed its customer service ticketing system was hacked. A spokesperson said it was a social engineering attack. The hacker stole mostly customer support tickets, including customer names and contact information, but also the contents of customer requests.
https://techcrunch.com/2026/04/02/telehealth-giant-hims-hers-says-its-customer-support-system-was-hacked/

2026-04-01 14:52:13 UTC

Not a joke: Hasbro was hacked. The American toymaking giant said in an SEC filing that it may take weeks for it to recover. Much of the company's website appears down.
https://techcrunch.com/2026/04/01/hasbro-hacked-may-take-several-weeks-to-recover/

2026-03-31 17:48:28 UTC

Google has now linked the hack and hijack of the popular Axios npm open-source project to North Korea (UNC1069), which is known for stealing cryptocurrency.
Axios is downloaded tens of millions of times weekly, so this hack is likely widespread.
Our updated story: https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware?nocache=1

2026-03-31 12:15:26 UTC

Today is International Trans Day of Visibility. Sending my love, support, and solidarity to all my trans and non-binary friends. 🏳️‍⚧️❤️

2026-03-25 16:52:09 UTC

In at least six instances identified by TechCrunch, first responders have had to take control of Waymo vehicles and move them out of traffic during emergency situations.
https://techcrunch.com/2026/03/25/waymo-relies-on-firefighters-and-police-to-bail-out-stuck-robotaxis/

2026-03-25 14:23:18 UTC

Good reporting from NPR on how U.S. federal agencies are simply buying people's private information and location data to use in investigations — without getting warrants.
https://www.npr.org/2026/03/25/nx-s1-5752369/ice-surveillance-data-brokers-congress-anthropic

2026-03-25 13:03:34 UTC

Loved this blog by @npub1u2v…8zpj and Jan Strozyk reflecting 10 years on from the Panama Papers, and how nerds in the newsroom who knew (or learned!) how to script, scrape, and build tools helped to transform modern journalism. Nowadays, handling and parsing data is an indispensable skill.
https://buttondown.com/readwrite/archive/edition-12-on-the-panama-papers-ten-years-later/

2026-03-25 12:32:43 UTC

Almost exactly four months ago, I wrote about how the Trump administration was preparing to ban TP-Link routers, citing the company's alleged links to China. Now, the FCC has decided to ban *all* new models of foreign-made routers, even though many U.S.-made routers are also full of security flaws.
https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/

2026-03-23 20:44:31 UTC

NEW: Someone has publicly leaked an exploit toolkit called DarkSword, which allows any hacker or cybercriminal to easily hack iPhones and iPads running iOS 18.
Apple said it is aware & has issued patches. Security researchers have already tested the code as working.
w/ @npub1xvw…ksg7: https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/

2026-03-18 16:58:02 UTC

FBI director Kash Patel confirms the FBI is buying location data and histories that can be used for tracking people. It's the first time in recent years that the FBI has said it's actively buying this information, without needing a warrant.
https://www.politico.com/news/2026/03/18/fbi-buying-data-track-people-patel-00834080

2026-03-18 12:18:35 UTC

On my flight back to the U.S. this week, I wrote some words about why age verification laws threaten the security and privacy of everyone on the internet. By requiring people to upload their IDs, governments are sleepwalking the world into an inevitable data disaster.
For my newsletter and blog ~ this week in security ~
Read online: https://this.weekinsecurity.com/papers-please-age-verification-laws-threaten-everyones-online-security-and-privacy/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-03-11 09:39:59 UTC

Breaking from vacation because this is huge/👀.
Per Burgess Everett on Bluesky: Sen. Ron Wyden says there's secret classified info in 702 surveillance program about Americans' privacy.
Americans "are going to be stunned that it took so long and that Congress has been debating this authority with insufficient information."
FAA 702 already allows warrantless surveillance of Americans' comms. Can't think how this extends. Collection of wholly domestic communications?
https://www.semafor.com/newsletter/03/10/2026/pm-semafor-washington-dc-threat-level

2026-03-07 14:32:13 UTC

In 2025, I found 3 popular apps leaking sensitive user data thanks to simple security bugs. In this *very* deep-dive for subscribers, this is how I use network analysis tools (like Burp) to understand how apps and websites work & share your data — and how you can, too!
I explain how to get started with Burp and similar browser tools, we'll explore API basics, how to understand network requests, and how to get started. I'll also include examples for you to follow along.
https://this.weekinsecurity.com/a-beginners-guide-burp-suite-analyzing-network-traffic-of-apps-and-websites/

2026-03-05 17:56:53 UTC

Meta is facing a new lawsuit over its AI smart glasses, after a news investigation found subcontractors are reviewing footage from customers' glasses, which "included sensitive content, like nudity, people having sex, and using the toilet."
https://techcrunch.com/2026/03/05/meta-sued-over-ai-smartglasses-privacy-concerns-after-workers-reviewed-nudity-sex-and-other-footage/

2026-03-04 01:28:29 UTC

Seems like the whole world is melting down so I'm gonna break my longstanding rule of not posting my feet to the internet to post this snap of my incredibly handsome loaf cat.
https://files.mastodon.social/media_attachments/files/116/168/307/095/498/011/original/40e52b6ad85895df.jpeg

2026-02-28 00:18:55 UTC

If you like my reporting, you might also like my free weekly cyber newsletter ~ this week in security ~ which packs in all the news you can use from the week, plus sections dedicated to good news and a reader-submitted cyber-cat. Goes out on Sundays by email & RSS. Newsletter archive & blog online. 🐈‍⬛
https://this.weekinsecurity.com

2026-02-27 13:26:13 UTC

Some independent/local news outlets I read and recommend. Share yours!
https://www.zetter-zeroday.com
https://citationneeded.news
https://www.lawdork.com
https://krebsonsecurity.com
https://404media.co
https://techdirt.com
https://www.metacurity.com
https://www.thehandbasket.co
https://www.garbageday.email
https://indicator.media
https://www.wheresyoured.at
https://www.courtwatch.news
https://realhackhistory.org
https://www.londoncentric.media
https://privacyguides.org
https://databreaches.net

2026-02-25 13:58:36 UTC

- reply

Despite a FOIA and an appeal, the FBI refuses to say why agents visited my home or if I was (or am) under investigation for my work. I still can't go to Mexico, or anywhere that relies on its airspace, unsure as to what view authorities there might take if I ever cross into its territory.
https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-25 13:57:05 UTC

In 2020, the FBI came to my house to try to ask me questions about a story I'd written. I declined.
I wrote about the back-story of what happened that day and after, my outstanding questions, and why press freedoms have taken a major step back under Trump's second term.
More: https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-24 18:45:47 UTC

Trump is "weighing a possible executive order or other action that would require banks to collect citizenship information from customers." This order could task banks, reportedly alarmed, with checking IDs of "both new and pre-existing customers who want to maintain a bank account in the U.S."
WTF. https://www.wsj.com/politics/policy/trump-administration-considers-action-requiring-banks-to-collect-citizenship-info-8e26f6d2

2026-02-21 03:13:12 UTC

Have a peaceful evening, and weekend.
https://files.mastodon.social/media_attachments/files/116/106/434/164/568/669/original/766fe06ec089e729.jpeg

2026-02-18 14:51:06 UTC

Uhh, whoops. https://techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/

2026-02-17 18:19:13 UTC

Apple reportedly working on creepware, aka surveillance glasses and other AI-enabled always-on devices.
Not sure how Apple squares these products with its long-standing stance that, "Privacy is a fundamental human right."
https://www.bloomberg.com/news/articles/2026-02-17/apple-ramps-up-work-on-glasses-pendant-and-camera-airpods-for-ai-era?srnd=undefined

2026-02-14 14:16:09 UTC

I wrote some words for ~ this week in security ~ about how social media giants (aka: ad tech companies!) track you around the web, even if you don't have an account or use their apps. Follows from a brilliant column in the BBC about TikTok's use of website "pixels" to track people's browsing activity.
More: https://this.weekinsecurity.com/how-tech-giants-track-you-across-the-web-even-if-you-do-not-use-their-apps/
Sign up (or RSS) for the weekly newsletter, out Sundays. No email open or link click tracking! https://this.weekinsecurity.com

2026-02-12 23:04:45 UTC

After threatening to ban TP-Link router sales over alleged links to China (which TP-Link denies), the Trump administration has reportedly put that ban plan on hold ahead of a summit with China, suggesting it was political leverage and not about cybersecurity.
From me in November: https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/
From Reuters today: https://reuters.com/business/media-telecom/us-china-trade-detente-fuels-mothballing-key-china-tech-curbs-2026-02-12/ (via @npub102x…wzj6)

2026-02-11 21:33:52 UTC

New, by me: Microsoft has fixed three zero-day bugs in Windows and Office that are being actively abused by hackers to break into people's computers. Microsoft said three of the exploits are now public.
Google, which helped find the bugs, said one of them is under “widespread, active exploitation."
https://techcrunch.com/2026/02/11/microsoft-says-hackers-are-exploiting-critical-zero-day-bugs-to-target-windows-and-office-users/

2026-02-11 18:49:22 UTC

Prosecutors have confirmed for the first time that Peter Williams, the former boss of L3Harris' Trenchant unit (which makes hacking and surveillance tools for the U.S. govermment and its allies), sold the company's exploits to a Russian broker that were capable of accessing "millions of computers and devices" around the world.
Williams, who pleaded guilty, is expected to be sentenced in the next two weeks.
https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/

2026-02-10 20:48:11 UTC

New, by @npub1xvw…ksg7: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.
https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

2026-02-10 13:53:40 UTC

For my newsletter and blog, I wrote about how Apple's Lockdown Mode, once billed as an "extreme" security protection for iPhones, iPads, Macs and Watches, has passed a major real-world test by blocking the feds from accessing a journalist's phone.
Free to read; with additional words, advice, and guidance for paying subscribers: https://this.weekinsecurity.com/apple-lockdown-mode-once-an-extreme-security-protection-now-a-necessity-for-americans/
Sign up/RSS for the weekly newsletter: https://this.weekinsecurity.com

2026-02-09 16:23:36 UTC

SCOOP: A hacktivist has scraped more than half a million payment records from a comapny that makes consumer-grade spyware and other phone tracking apps, exposing customers' email addresses and partial payment data. TechCrunch verified the scraped data is authentic.
By @npub1xvw…ksg7 and me:
https://techcrunch.com/2026/02/09/hacktivist-scrapes-over-500000-stalkerware-customers-payment-records/

2026-02-09 14:29:29 UTC

A Politico story out today describes how Oura wearable rings are winning over Washington, but makes no real mention of their privacy or security risks.
But... in my piece about Oura rings from last year, I explain how Oura puts user data at risk from goverment agencies (like ICE), and hackers.
• Oura data isn't end-to-end encrypted
• Sensitive health data can be accessed by Oura staff
• Oura said it has received government demands for user data.
https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

2026-02-08 01:32:59 UTC

- reply

I had no idea that pigeons are so awesome. Sure, they can't build a nest for shit, but clearly they found a place of safety, took care of each other, loved their babies, and did a great job of raising their young. They're smart and resilient. And I'm really proud of them!
Thanks for reading! /FIN.
https://files.mastodon.social/media_attachments/files/116/032/428/605/427/178/original/f3019dee9a6b889c.png

2026-02-08 01:30:55 UTC

- reply

And within a week, they were gone! We saw them flapping on the balcony, increasingly getting lift… sometimes flying into our balcony doors (with less frequency; they learned!) On Jan. 8, the second baby pigeon took off into the world.
Me: 🥲
https://files.mastodon.social/media_attachments/files/116/032/416/775/872/151/original/e20ef87d82805204.mp4

2026-02-08 01:28:07 UTC

- reply

By the first week of January, the fledglings emerged from under our furniture and started exploring our balcony for the first time. They were pretty confident by the looks of it, and their parents were on the neighbor's balcony keeping watch. (Redacted for opsec.)
https://files.mastodon.social/media_attachments/files/116/032/404/816/055/094/original/383cb71fbd1ce5b4.png

2026-02-08 01:26:06 UTC

- reply

And a particularly funny moment when bird meets Birdcam.
https://files.mastodon.social/media_attachments/files/116/032/402/828/490/698/original/a39e30039090085e.png

2026-02-08 01:25:10 UTC

- reply

We're now at Dec. 31 and they're now fledglings, with much of their feathers grown and they will soon leave the nest and fly away. (Any time they get excited, or fed, we can hear them chirping from the other side of the glass; our regular reminder that we are pigeon landlords.)
https://files.mastodon.social/media_attachments/files/116/032/393/871/535/089/original/680eb55f308853e8.mp4

2026-02-08 01:22:40 UTC

- reply

I wasn't kidding when we called it Birdcam. Look at this little face! (Yes, this video feed was end-to-end encrypted.)
https://files.mastodon.social/media_attachments/files/116/032/386/537/283/254/original/97cc27f187398065.png

2026-02-08 01:21:29 UTC

- reply

All the while, these pigeon babies are getting bigger, their feathers are developing, and they're getting more inquisitive, gaining independence from their parents.
https://files.mastodon.social/media_attachments/files/116/032/384/212/160/792/original/280df0342bf8c7be.mp4

2026-02-08 01:19:59 UTC

- reply

By Dec. 18, the pigeon parents began leaving the babies on their own for longer, seemingly to test their boundaries. The more time on their own, the more independent they become (we think). Where are the pigeon parents going? We saw them flying to …the neighboring balcony, just patiently waiting!
https://files.mastodon.social/media_attachments/files/116/032/378/358/495/734/original/612e2fcb8b44edba.jpeg

2026-02-08 01:17:59 UTC

- reply

By Dec. 17, and these pigeon darlings are fully fledged rowdy little fuckers any time they're getting fed. As you can imagine with four of them sharing this space, there's lots of poop — but we didn't want to risk a human presence going in and inadvertently scaring them.
https://files.mastodon.social/media_attachments/files/116/032/369/277/088/746/original/4907382d3f062bde.mp4

2026-02-08 01:16:37 UTC

- reply

Two weeks in, and… yeah, turns out even pigeon parents need their peace, quiet, and a bit of space.
https://files.mastodon.social/media_attachments/files/116/032/363/498/939/259/original/0d3ed9fba8f2e459.mp4

2026-02-08 01:14:56 UTC

- reply

By Dec. 10, the beebs are starting to get bigger and you can see how much they've grown in just over a week. We're not interacting with them at all because we don't want them to get accustomed to humans (and also we really would like our balcony back at some point, lol).
https://files.mastodon.social/media_attachments/files/116/032/356/383/177/232/original/6a75477d20505018.mp4

2026-02-08 01:12:58 UTC

- reply

It was getting even colder during the day, around freezing, so we put outside a raggedy old towel in their not-very-nest. Just trying to be a good pigeon landlord here, move along.
https://files.mastodon.social/media_attachments/files/116/032/349/799/180/664/original/720835b1234a13e1.mp4

2026-02-08 01:11:07 UTC

- reply

Brief intermission: Here's one whole minute of a pigeon throwing up into the mouths of its young. This is how they are fed. Baby pigeons have one job, and that is to stay alive. They don't leave the nest until they're fully grown. That's why you never really see baby pigeons out in the world.
https://files.mastodon.social/media_attachments/files/116/032/341/887/952/864/original/eb996804e7a5778f.mp4

2026-02-08 01:07:42 UTC

- reply

They'd just sit here for hours, nesting on top of these tiny fluffballs to keep them warm as the temperatures continued to drop, presumably just thinking about how to pay for pigeon college or whatever. We put out some yarn for them in case they wanted to build up their nest. They declined, clearly.
https://files.mastodon.social/media_attachments/files/116/032/329/902/844/225/original/c6a04d55979e6f28.mp4

2026-02-08 01:05:33 UTC

- reply

Over the next few days, the pigeon parents would sit on the baby pigeons and occasionally swap every few hours, while the other would go out and get food. The baby pigeons would only be uncovered for a few seconds or so. They were tiny little things, so they would get cold very quickly.
https://files.mastodon.social/media_attachments/files/116/032/320/324/107/642/original/a29ad326fa59b416.mp4

2026-02-08 01:02:48 UTC

- reply

Almost exactly a day later…
[P...p...p… player four has entered the game.] *airhorn*
https://files.mastodon.social/media_attachments/files/116/032/299/998/143/389/original/b46274de1a15c228.mp4

2026-02-08 00:59:27 UTC

- reply

The egg hatched, and pigeon parent on duty removed it, and there it was, the tiniest little baby pigeon. I let out an almighty squee of joy.
https://files.mastodon.social/media_attachments/files/116/032/297/314/872/924/original/0b80baceb50f74a9.mp4

2026-02-08 00:56:05 UTC

- reply

Then two weeks later on Dec. 1, Birdcam sent a notification to new activity. I opened my phone and saw this new video.
Narrator voice: Player three has entered the game.
https://files.mastodon.social/media_attachments/files/116/032/279/549/913/783/original/8b15b183f5018445.mp4

2026-02-08 00:54:07 UTC

- reply

It was getting colder and colder throughout November, getting down to almost freezing temperatures, high winds, and increasingly harsher weather. I secured some cardboard to the balcony railings so that it would shelter the pigeons from the elements.
OK, so I interfered a little bit, shuddup. :).

2026-02-08 00:52:45 UTC

- reply

Meanwhile, let's take a look at their nest and… granted, not much improvement.
(Yes, this is a cybersecurity, cat, and pigeon stan account now.)
https://files.mastodon.social/media_attachments/files/116/032/269/551/888/557/original/09eff8024b5e6e82.jpeg

2026-02-08 00:51:44 UTC

- reply

We soon found that these pigeons would take turns nesting on these eggs, sometimes do a little dance and coo at each other when they would swap, maybe once or twice a day, presumably so they both could go out and eat. To see these birds take such care of their eggs was adorable.
https://files.mastodon.social/media_attachments/files/116/032/267/093/750/797/original/16d4c3db15bbffb1.mp4

2026-02-08 00:47:37 UTC

- reply

We wanted to keep watch to make sure they were doing OK, while not interfering (because nature, y'know?). We knew nothing about pigeons, but were honored that this pigeon chose our balcony to raise their young, so of course this was fine.
Soon after Birdcam went live… holy shit, it's *two* pigeons!
https://files.mastodon.social/media_attachments/files/116/032/250/296/459/339/original/10755069a78b19b2.mp4

2026-02-08 00:44:43 UTC

- reply

In mid-November, we found our cat Theo transfixed at the window. He was looking at a pigeon and two eggs, just plonked there on the astroturf. As it turns out, pigeons are quite shit at making nests (https://defector.com/why-do-pigeon-nests-look-so-shitty-an-investigation), and it was already starting to get cold out in the NY/NJ area.
https://files.mastodon.social/media_attachments/files/116/032/237/642/907/156/original/1ea87f99a0dcacb4.jpeg

2026-02-08 00:42:35 UTC

The world is on fire, but here's a nice thing. A few months ago, a pigeon laid two eggs under our outdoor furniture on our balcony. We put a camera in there to keep an eye. The eggs hatched, survived, grew up, flapped their wings, and left the nest. :) Here's what happened & what we learned.
https://files.mastodon.social/media_attachments/files/116/032/217/004/947/092/original/65fd27023a11e7a2.mp4

2026-02-07 13:41:04 UTC

My newsletter https://this.weekinsecurity.com features all of the most important cybersecurity news, analysis, and reporting that you need to know so you can stay ahead. Plus, good news that you might've missed, and a reader-submitted cyber-cat.
No email link/open tracking!
Sign up (or RSS!) for your weekly dispatch. Out Sundays.

2026-02-06 18:09:18 UTC

New, by me: I wrote some words for TechCrunch about Sen. Ron Wyden's recent unclassified letter to the CIA director, citing his "deep concerns" about the agency's activities. This isn't the first time Wyden has sounded his "siren" — and history tells us why this new letter is likely a big deal.
https://techcrunch.com/2026/02/06/senator-who-has-repeatedly-warned-about-secret-u-s-government-surveillance-sounds-new-alarm-over-cia-activities/

2026-02-04 22:09:50 UTC

🚨 This is what we call a "Wyden siren." For those who don't know, Ron Wyden (D-OR) is one of the longest serving members of the Senate Intelligence Committee. https://www.wyden.senate.gov/imo/media/doc/wyden_letter_to_d-ciapdf.pdf
https://files.mastodon.social/media_attachments/files/116/014/640/173/269/888/original/8548076e0f0a31ac.png

2026-02-03 18:45:06 UTC

I wrote a story about how Homeland Security is using administrative subpoenas, which aren't subject to judicial oversight, to seek data from tech giants about Trump critics and anonymous accounts of ICE trackers. Features some really great reporting by Bloomberg & Washington Post.
https://techcrunch.com/2026/02/03/homeland-security-is-trying-to-force-tech-companies-to-hand-over-data-about-trump-critics/

2026-02-02 18:22:40 UTC

NEW: The developer of the long-running and popular open source text editor Notepad++ has confirmed that China government-backed hackers hijacked the software's update feature for months during 2025.
The hackers could access computers of victims who were running hijacked versions of Notepad++.
https://techcrunch.com/2026/02/02/notepad-says-chinese-government-hackers-hijacked-its-software-updates-for-months

2026-02-02 12:37:40 UTC

NEW: A few weeks ago, @npub17l5…4kr3 and I ran a survey asking security researchers and journalists about the legal and criminal threats they have received for doing their jobs.
Over 100 people responded, and we now have our results.
One of our key findings is that while legal threats and criminal threats are common, most researchers & journalists stood their ground and did not give in to threats.
More: https://this.weekinsecurity.com/new-survey-reveals-how-security-researchers-and-journalists-experience-legal-and-criminal-threats/
Results: https://databreaches.net/2026/02/02/under-pressure-exploring-the-effect-of-legal-and-criminal-threats-on-security-researchers-and-journalists/
PDF: https://databreaches.net/wp-content/uploads/security-researcher-journalist-threats-survey-2026.pdf

2026-01-29 14:53:43 UTC

NEW, by me: A security and privacy feature rolled out to select models of the latest iPhones and iPads this week will make it more difficult for law enforcement, spies, and malicious hackers to obtain a person's precise location data from their phone provider.
https://techcrunch.com/2026/01/29/apples-new-iphone-and-ipad-security-feature-limits-cell-networks-from-collecting-precise-location-data/

2026-01-27 23:12:13 UTC

If you could pick one non-U.S. tech, product, or service to switch to, what would you recommend, and why? Open-source and self-hosting options welcome!
https://techcrunch.com/2026/01/27/amid-trump-attacks-and-weaponized-sanctions-europeans-look-to-rely-less-on-us-tech/

2026-01-27 14:31:55 UTC

This is an amazing read about resistance.
So many amazing lines in this piece, but one that stands out:
"We proved that you can bring a trillion-dollar security apparatus to its knees with one well-aimed rubber cock."
https://www.closertotheedge.net/p/the-dildo-distribution-delegation

2026-01-26 14:01:35 UTC

After another massive database of usernames and passwords was found unprotected and exposed to the internet (without a password of its own, ironic!), I wrote some words about the underlying problem — infostealing malware — and why it powers much of cybercrime today.
Read online: https://this.weekinsecurity.com/another-huge-leak-of-passwords-is-the-tip-of-the-infostealing-iceberg/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-01-24 14:51:18 UTC

Feels like -5°F (or -20°C) here on the east coast, and my cat just wants to sleep.
https://files.mastodon.social/media_attachments/files/115/950/623/781/614/805/original/20c0f4b1691dfeea.jpg

2026-01-20 17:58:51 UTC

Always thankful for Techdirt.
https://www.techdirt.com/2026/01/20/everyone-knows-our-mad-kings-greenland-obsession-is-insane-why-wont-congress-stop-it/

2026-01-16 17:23:33 UTC

NEW, by me: A hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East this week, sent as a phishing lure over WhatsApp.
I obtained a copy of the phishing page and analyzed it with the help of experts. The attack aimed to steal passwords, hijack WhatsApp accounts, and grab victims' location data.
But a bug in the code also *exposed* victims' data, allowing us to see dozens of people who had fallen victim.
More: https://techcrunch.com/2026/01/16/how-a-hacking-campaign-targeted-high-profile-gmail-and-whatsapp-users-across-the-middle-east/

2026-01-14 16:12:51 UTC

New, by me: Security researcher Eaton Zveare spent weeks trying to alert a little-known but critical U.S. cargo tech giant that their shipping systems and customers' data were exposed to the web.
After weeks of trying, Zveare asked TechCrunch for help. We were ignored, too. On the third time we emailed the firm's CEO, we included a partial copy of his password to show the seriousness of the flaws.
A couple of hours later, we got a response — from its law firm.
https://techcrunch.com/2026/01/14/us-cargo-tech-company-publicly-exposed-its-shipping-systems-and-customer-data-to-the-web/

2026-01-14 14:14:19 UTC

This is utterly insane, almost unheard of. This morning, the FBI *searched the home* of a Washington Post reporter, and seized her phone and smart watch, as part of an investigation into an alleged leak of classified info. by a government employee. (The federal case appears to be 1:26-mj-00045.)
https://www.washingtonpost.com/national-security/2026/01/14/washington-post-reporter-search/

2026-01-13 22:22:26 UTC

Daily Beast reports that a DHS whistleblower has leaked the personal details of around 4,500 ICE and Border Patrol employees. The data is said to include about 1,800 on-the-ground agents and 150 supervisors.
https://www.thedailybeast.com/personal-details-of-thousands-of-border-patrol-and-ice-goons-allegedly-leaked-in-huge-data-breach/

2026-01-12 18:24:30 UTC

Betterment was hacked and users' personal data compromised, but you might not know it because the company hid its data breach notice with a "noindex" tag in its web page source code. This tells search engines to ignore the page so people won't see it in search results.
More from TechCrunch: https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/
https://files.mastodon.social/media_attachments/files/115/883/523/594/684/372/original/2dd608a6249b629f.png

2026-01-09 13:33:05 UTC

I very much appreciated this essay by Sarah Jeong this morning. It's a reminder that reality and truth still matters, even in the face of blatant and brazen lies.
https://www.theverge.com/policy/859055/minneapolis-renee-good-ice-shooting

2025-12-31 14:30:45 UTC

Are you a security researcher or journalist? We want to hear from you — please take this survey!
Dissent Doe at DataBreaches, and I, are running this survey to better understand the state of legal demands and criminal threats in cybersecurity. Help us by filling out this survey! (and please share!)
https://forms.gle/yAiNNq2gTqE6ctWU8

2025-12-26 14:26:37 UTC

New, by @npub1xvw…ksg7 and me: We just published TechCrunch's annual jealousy list of cybersecurity stories that we *didn’t* publish but wish we had. This is the very best cybersecurity reporting from our friends at competing publications.
https://techcrunch.com/2025/12/26/these-are-the-cybersecurity-stories-we-were-jealous-of-in-2025/

2025-12-23 15:16:25 UTC

- reply

The exposed Uzbek license plate tracking system offers a rare glimpse into how these surveillance systems work, and the security and privacy risks associated with the mass monitoring of vehicles and their owners.
Just this week, 404 Media reported finding publicly exposed Flock cameras in the United States.
https://www.404media.co/flock-exposed-its-ai-powered-cameras-to-the-internet-we-tracked-ourselves/

2025-12-23 15:07:47 UTC

NEW, by me: Uzbekistan exposed its nationwide license plate surveillance system to the web, no password needed.
The system reveals around a hundred locations around the country where banks of cameras have been placed, including big cities and rural areas. The system contains raw video footage of millions of vehicles and their occupants.
https://techcrunch.com/2025/12/23/inside-uzbekistans-nationwide-license-plate-surveillance-system/

2025-12-19 23:54:05 UTC

Absolute horror story of a long-time Apple customer who was locked out of their devices and account with no recourse after redeeming a suspected bad gift card.
Gift card scams are on the rise & increasingly difficult to spot, and can have devastating consequences.
https://this.weekinsecurity.com/apple-nuking-a-customer-account-over-a-bad-gift-card-is-a-warning-for-everyone/

2025-12-17 21:33:32 UTC

I'm thrilled to have been featured in the EFF's Breachies for uncovering security lapses in the info-sharing app TeaOnHer and stalkerware app Catwatchful, along with TechCrunch's security desk's coverage of data breaches at Blue Shield of California, PowerSchool, TransUnion, and more. Thanks, EFF!
https://www.eff.org/deeplinks/2025/12/breachies-2025-worst-weirdest-most-impactful-data-breaches-year

2025-12-17 19:17:28 UTC

This looks like a particularly spicy shituation affecting Cisco customers:
• 10/10 severity zero-day bug in popular Cisco products
• Cisco says China is exploiting bug to hack customers
• Cyberattacks discovered on Dec. 10; disclosed today
• No patches yet. Compromised devices must be wiped
https://techcrunch.com/2025/12/17/cisco-says-chinese-hackers-are-exploiting-its-customers-with-a-new-zero-day/

2025-12-17 16:28:34 UTC

- reply

These are the questions that TechCrunch asked Mixpanel CEO Jen Taylor about the company's data breach.
If anyone else wants to follow up with any of these questions, be my guest. Mixpanel is welcome to respond to my emails at any time.
https://files.mastodon.social/media_attachments/files/115/735/843/697/130/364/original/7329930fd8baa230.png

2025-12-17 16:15:29 UTC

- reply

If anyone at Mixpanel wants to respond to any of the emails (including the 19+ specific questions) we've sent to CEO Jen Taylor about the company's data breach, please get in touch.
You can reach me at [email protected] or email me back from any of the messages we've sent!