Catalin Cimpanu

Cybersecurity reporter for Risky Business

#infosec #cybersecurity #security

Newsletter:: https://risky.biz/newsletters/
Podcast:: https://risky.biz/podcasts/

Public Key

npub1s69ytgd44h8539aftjc83pfc8w6w35gnmqqje6n42wqkvkepdwcs7mrmen

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsgdzj95x66mn6gj754evrcs5urhd8g6yfasqfvaf648qtxtvskhvgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsspu9t7

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1s69ytgd44h8539aftjc83pfc8w6w35gnmqqje6n42wqkvkepdwcs7mrmen

Show more details

Last Notes

2026-06-25 20:42:25 UTC

Polymarket discloses a security breach
Looks like a CDN poisoning incident (don't quote me on this)
https://files.mastodon.social/media_attachments/files/116/812/686/537/475/580/original/10b00487451dfc29.png

2026-06-11 12:32:25 UTC

Npm will block all auto-running installation scripts starting next month with the release of version 12.0.
The change is meant to counter the rising number of supply-chain attacks taking place on the platform
https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/

2026-05-19 19:24:19 UTC

Eight of the largest US telcos have formed a new center for sharing intel on cyber attacks, the C2 ISAC
Founding members include AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, Verizon, and Zayo.
https://about.att.com/story/2026/c2-isac.html

2026-05-14 14:27:10 UTC

Security researcher Shellsharks has created Vulnerability.Garden, a catalog of named vulnerabilities.
So far, we're 25 vulnerabilities away from 1K branded security bugs.
Don't worry, @npub1z3m…zn2f... we'll get you there!
https://vulnerability.garden/

2026-05-04 10:21:30 UTC

-DigiCert hacked with a malicious screensaver file
-Ransomware negotiators get four years in prison
-Trellix discloses security breach
-Another Russian hacker arrested vacationing in the wrong place
-Secessionist party leaks Albertans personal data
-Fakestortion campaign hits cPanel sites
-Rockstar stock went up after the hack (leaked financials were spectacular)
-Hacker leak exposes Hungarian-Kremlin propaganda coordination
Podcast: https://risky.biz/RBNEWS559/
Newsletter: https://news.risky.biz/risky-bulletin-digicert-hacked-with-a-malicious-screensaver-file/
https://files.mastodon.social/media_attachments/files/116/515/794/507/160/172/original/8fb36aeb13a3dea2.png

2026-05-03 13:28:43 UTC

Hungary's pro-Kremlin media gets hacked by WorldLeaks
The leaked data exposes coordination with the Kremlin in anti-Ukraine coverage: https://telex.hu/zacc/2026/04/30/mediaworks-hekkertamadas-memo-zelenszkij-lejaratas-telefonos-segitseg-moszkvabol
Mediaworks threatens lawsuits over coverage of the hacked data: https://hirtv.origo.hu/ahirtvhirei/2026/05/a-mediaworks-kozlemenye
It sues one of the sites that covered the Kremlin ties: https://media1.hu/2026/05/01/mediaworks-buntetofeljelentes-media1-telex-lapszemle-toth-tamas-antal/
h/t @npub1prm…rs6z --> https://mastodon.social/@npub1prm…rs6z/116498047329184815

2026-05-02 20:08:56 UTC

Ask Jeeves, one of the first search engines, has shut down on Friday
https://www.ask.com/
https://files.mastodon.social/media_attachments/files/116/506/788/889/856/852/original/47cfede159f15a77.png

2026-05-02 19:53:38 UTC

Security firm Trellix has disclosed a security breach after hackers gained access to its source code
This highlighted section here is important since Trellix is one of Europol's closest industry partners
If this is TeamPCP, as I suspect, they might have screwed up
https://www.trellix.com/statement/
https://files.mastodon.social/media_attachments/files/116/506/727/617/345/653/original/13b09ca7b21b1651.png

2026-04-30 19:58:37 UTC

RE: https://mastodon.social/@campuscodi/116490790808300234
This is now exploited in the wild
https://www.cisa.gov/news-events/alerts/2026/04/30/cisa-adds-one-known-exploited-vulnerability-catalog
#note18hr…ty4q

2026-04-30 18:57:16 UTC

Cloudflare labels Russia's MAX[.]ru domain as spyware 😆
https://radar.cloudflare.com/domains/domain/max.ru
https://files.mastodon.social/media_attachments/files/116/495/183/566/675/753/original/512e706cc9ef9b5e.png

2026-04-30 11:08:03 UTC

This is a very interesting report from Group-IB.
The company believes it found one of the PhaaS platforms—Phoenix System—working with SMS blaster operations
https://www.group-ib.com/blog/phoenix-phaas-kit-smishing/

2026-04-30 00:20:04 UTC

Major authentication bypass disclosed in cPanel
https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026

2026-04-28 20:39:03 UTC

The Ghostty founder is leaving GitHub
When you read his blog post, I want you to keep this image in your mind
https://mitchellh.com/writing/ghostty-leaving-github
https://files.mastodon.social/media_attachments/files/116/484/256/442/835/119/original/4ff93f66952a1530.png

2026-04-23 18:58:33 UTC

Nextcloud stops bug bounty program due to increase of low-effort AI-generated reports
https://discuss.privacyguides.net/t/nextcloud-stops-bug-bounty-program-due-to-increase-of-low-effort-ai-generated-reports/37334

2026-04-23 18:29:48 UTC

Iran says networking equipment mysteriously went down during a recent missile strike on Isfahan
https://www.entekhab.ir/fa/news/917640/

2026-04-23 01:48:18 UTC

The world is so stupid these days
https://news.bitcoin.com/a-hair-dryer-may-have-gamed-a-paris-weather-sensor-for-34000-on-polymarket/
https://files.mastodon.social/media_attachments/files/116/451/499/081/637/305/original/c600632325765bab.png

2026-04-21 09:30:47 UTC

The third security firm employee who worked with the BlackCat ransomware has also pleaded guilty now
https://www.justice.gov/opa/pr/florida-man-working-ransomware-negotiator-pleads-guilty-conspiracy-deploy-ransomware-and

2026-04-19 11:04:12 UTC

A Tennessee man who hacked the US Supreme Court was sentenced to twelve months of probation.
Nicholas Moore hacked the US' highest court in 2023 and leaked documents on an Instagram account named @ihackthegovernment.
https://www.courtlistener.com/docket/72124298/united-states-v-moore/

2026-04-15 23:42:43 UTC

The Rhadamanthys infostealer left its frontend API exposed online without authentication, allowing security researchers to track its activity for months before the Europol takedown last year
https://censys.com/blog/rhadamanthys-private-sector-ops-limitations/

2026-04-15 20:50:09 UTC

NIST makes it official and basically gives up on enriching CVEs: https://www.nist.gov/news-events/news/2026/04/nist-updates-nvd-operations-address-record-cve-growth
Will only enrich:
-KEV listed bugs
-bugs in software used by the US govt
-bugs in critical software (see list here/PDF: https://www.nist.gov/system/files/documents/2026/04/15/EO%2014028%20Critical%20FINAL.pdf)

2026-04-14 13:26:45 UTC

A malicious Ledger crypto-wallet that managed to sneak onto the official Mac App Store has stolen almost $10 million from more 50 victims. App was live for almost 2 weeks: https://t.me/investigations/313
One of the campaign's victims is American singer Garrett Dutton, who lost his retirement fund: https://www.thestreet.com/crypto/markets/music-superstar-loses-retirement-fund-to-fake-app

2026-04-14 09:59:25 UTC

Jamf's Nir Avraham has published a report looking at how the Predator spyware exploits, interacts, and modifies the iOS kernel for its operations
"The engine has never been reported on — until now"
https://www.jamf.com/blog/predator-spyware-ios-kernel-exploitation-engine/

2026-04-12 11:42:05 UTC

The Pixel 10 smartphones released last year are the first phones to use Rust for its modem firmware in an attempt to narrow the phone's baseband attack surface
https://security.googleblog.com/2026/04/bringing-rust-to-pixel-baseband.html

2026-04-11 19:53:33 UTC

Bitcoin miners have entered the red as it now costs $88,000 to mint a $69,000 bitcoin
https://www.coindesk.com/markets/2026/03/22/bitcoin-miners-are-losing-usd19-000-on-every-btc-produced-as-difficulty-drops-7-8

2026-04-09 15:39:53 UTC

RE: https://mastodon.social/@zackwhittaker/116371299735270176
VerCrypt and Windscribe devs said someone at Microsoft has reached out and this is being handled now
#note1jaa…wp44

2026-04-09 15:33:18 UTC

"Intelligence agencies of Viktor Orbán’s government have been secretly using Webloc — a mass surveillance tool that tracks hundreds of millions of people via smartphone advertising data — making Hungary the first confirmed EU country to deploy it"
https://vsquare.org/orban-spying-toolkit-cobwebs-webloc-hungary-spyware-citizen-lab/

2026-04-09 13:14:13 UTC

The Claude.md file can be abused for malicious operations
https://layerxsecurity.com/blog/vibe-hacking-claude-code-can-be-turned-into-a-nation-state-level-attack-tool-with-no-coding-at-all/
https://files.mastodon.social/media_attachments/files/116/374/926/152/634/247/original/035e2abd394fd77e.png

2026-04-09 11:53:03 UTC

Adobe Reader Zero-Day Exploited for Months: Researcher
https://www.securityweek.com/adobe-reader-zero-day-exploited-for-months-researcher/

2026-04-05 16:44:11 UTC

A GPU-based rowhammer attack achieved root access on a Linux system
https://gpubreach.ca/

2026-04-04 23:46:26 UTC

The US Army has reduced the frequency of mandatory cybersecurity training from once a year to once every five years
https://defensescoop.com/2026/03/31/army-cybersecurity-training-policy-change/

2026-04-02 20:06:36 UTC

Node.js pauses bug bounty program after a funding lapse
They were sponsored by IBB, a program funded by Microsoft, Meta, Adobe, and a bunch of other tech giants
Unclear what happened there
https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties

2026-03-31 13:48:21 UTC

Claude's source code has leaked via npm
https://xcancel.com/Fried_rice/status/2038894956459290963

2026-03-29 15:07:53 UTC

Security firm Cybereason has open-sourced owLSM, an EDR-like agent for Linux, an eBPF LSM agent to run Sigma rules
https://github.com/Cybereason-Public/owLSM

2026-03-26 14:22:10 UTC

Russian intelligence managed to install a wire-taping device as part of a thermostat at a Ukrainian drone factory
https://en.interfax.com.ua/news/general/1153997.html

2026-03-26 13:26:17 UTC

Hungarian opposition leader Peter Magyar has accused the ruling government of using the Candiru spyware against his TISZA party
https://x.com/magyarpeterMP/status/2037113263238840702
https://files.mastodon.social/media_attachments/files/116/295/697/852/716/494/original/c28c56c105a223e4.png

2026-03-26 01:10:06 UTC

Infosec news cycle:
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved
CVE is in danger
CVE is saved

2026-03-25 10:53:36 UTC

- reply

-Pay2Key returns
-Novel WebRTC skimmer
-DarkSword leaks online
-Russian TikTok info-ops arrive to Hungarian elections (RO, MD, FR, CZ, PL say "hi")
-Half a million IIS servers are EOL online
-AI adoption grows among info-op groups
-KACE bug exploited in the wild
-Less than 1% of vulnerabilities were exploited last year
-Edge devices were most targeted last year
-Citrix security update
-IRGC info-op hits BlueSky
-New tool—OpenClaw Security Platform
-ROCon APAC 2025 videos
https://files.mastodon.social/media_attachments/files/116/289/438/692/888/998/original/a35fcbb9f9730d76.png

2026-03-25 10:51:43 UTC

- reply

-Checkmarx KICS vulnerability scanner hacked
-Trivy supply chain attack expands to Docker images
-Reddit prepares new account verification methods
-Russia to block international calls to seniors
-Will also block SMS OTPs to children numbers
-State Department launches new cyber office
-University professor hacked students in Dublin
-Yanluowang ransomware affiliate sentenced to 81 months
-Operation Atlantic reaches out to crypto-fraud victims
-Silver Fox expands to SE Asia
-New EvilTokens PhaaS
https://files.mastodon.social/media_attachments/files/116/289/418/128/322/012/original/c93052fecc04250d.png

2026-03-25 10:46:24 UTC

-The Intellexa CEO is pissed!!!
-Google launches threat disruption unit
-German police visit companies in the dead of night about software bugs
-FTC bans all foreign-made routers
-Firefox now has a built-in VPN
-Breach at the Dutch Ministry of Finance
-Hackers breach South Korea's top lender
-Breaches also at Mazda, Crunchyroll, HackerOne, InfiniteCampus
-Resolv hacked for $25m
-CSAM at record levels online
Podcast: https://risky.biz/RBNEWS542/
Newsletter: https://news.risky.biz/risky-bulletin-the-intellexa-ceo-is-pissed/
https://files.mastodon.social/media_attachments/files/116/289/399/091/022/059/original/28696f433c2394a2.png

2026-03-24 10:25:50 UTC

Apparently there's been a Citrix security update yesterday: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300
Something changed on their website. Is there an RSS feed or URL that I can scan for security updates now?

2026-03-22 15:27:43 UTC

NetAskari believes a recent hack and leak from China's National Super Computer Center of China (NSCC) might be real
https://netaskari.substack.com/p/chinas-massive-data-leak-of-military

2026-03-22 12:01:18 UTC

A vulnerability in a Linux enterprise app can allow attackers root access over devices
The issue impacts Himmelblau, an interoperability suite to integrate Linux with Entra ID and Intune networks.
https://www.akamai.com/blog/security-research/2026/mar/cve-2026-31979-symlink-root-privilege-escalation-himmelblau

2026-03-22 11:13:41 UTC

Internet's outage has now reached 3 weeks, is state-mandated and not a result of the strikes, per new reports
https://www.kentik.com/blog/internet-and-airstrikes-tracking-irans-extended-communication-blackout/
https://krypt3ia.wordpress.com/2026/03/16/intelligence-assessment-report/
PDF: https://insights.nccgroup.com/l/898251/2026-03-19/31myn1q/898251/1773936226AmWpHs8F/Middle_East_Crisis_Cyber_Update_19_03_2026.pdf

2026-03-21 12:03:30 UTC

RE: https://techhub.social/@Techmeme/116262102959307572
Google search results are now more dangerous than torrent sites
#note1vlj…yt3v

2026-03-20 22:18:15 UTC

Android will require a 24-hour wait before sideloading apps
https://android-developers.googleblog.com/2026/03/android-developer-verification.html
https://files.mastodon.social/media_attachments/files/116/263/820/605/458/838/original/32a2f88b35a75182.png

2026-03-17 12:48:44 UTC

After Hunt found an open directory hosting APT28's Roundcube exploit kit, Ctrl-Alt-Intel also found a 2nd open directory on the same server, this one with the "C2 source code, additional payloads, telemetry logs, exfiltrated data and evidence of further campaigns."
https://ctrlaltintel.com/threat%20research/FancyBear/#unique-victim-emails

2026-03-15 19:26:14 UTC

Major breach in Sweden, where a hacker claims to have stolen PII data and electronic signage documents from Sweden's e-government portal
They leaked the portal's source code to prove the breach
The IT contractor confirmed a breach too
https://www.svt.se/nyheter/inrikes/uppgift-statlig-it-information-har-lagts-ut-pa-darknet

2026-03-15 18:26:51 UTC

There's DRAMA between the Greek government and Intellexa's founder, who was recently sentenced to 126 years in prison
He says his company sells to governments exclusively, hinting that the Greek government was responsible for hacks of its opposition party and not him
Love me some drama!
https://www.occrp.org/en/news/convicted-spyware-dealer-links-greek-government-to-surveillance-scandal

2026-03-15 18:21:05 UTC

Office EU, an European company, has launched Office.eu, an EU-based alternative to Microsoft Office and Google Workspace, built on open-source technology and running on European server infrastructure.
https://office.eu/media/pressrelease-20260304

2026-03-14 20:37:07 UTC

"End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026." :hurb:
https://help.instagram.com/491565145294150

2026-03-12 08:52:16 UTC

Hacked Dutch ISP Odido found itself in a new pickle last week after its routers were caught sending telemetry to a US AI company
They now stopped after lawmakers announced Parliament hearings
https://www.linkedin.com/pulse/odido-router-verzamelt-analytics-van-je-huishouden-sipke-mellema-0uoie/

2026-03-10 14:43:17 UTC

RE: https://mastodon.social/@rvps2001/116205390963964950
...and it only took four years to reach the conclusion
#note1nrc…mnqv

2026-03-04 21:11:00 UTC

Joshua Rogers has published a good tutorial on how to customize your Firefox right-click menu and remove all the bloat you don't like
https://joshua.hu/firefox-making-right-click-not-suck

2026-03-03 18:44:11 UTC

That "meow meow" button deploys a GRU backdoor, fyi
https://www.clearskysec.com/russian-campaign-targeting-ukraine-badpaw-and-meowmeow/
https://files.mastodon.social/media_attachments/files/116/166/716/775/778/431/original/320037d386f073ea.png

2026-03-03 15:18:59 UTC

Google has discovered a new iOS exploit kit containing five full iOS exploit chains and a total of 23 exploits
It tracked it to a surveillance vendor, which sold it to both Russian and Chinese customers
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit/
https://files.mastodon.social/media_attachments/files/116/165/908/044/817/604/original/fe0e53636ecc8a2c.png

2026-03-03 14:41:48 UTC

RE: https://mastodon.social/@fedizen/116165634225914065
You should hate Google with the energy of 1000 burning suns for attempting to kill ad blockers in Chrome
#note1h2e…9tq4

2026-03-03 12:20:24 UTC

https://files.mastodon.social/media_attachments/files/116/165/209/156/703/203/original/4e0154de4f67b6ca.png

2026-03-01 14:03:53 UTC

"A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 5 targets"
👀👀👀👀👀
https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation

2026-02-28 17:57:53 UTC

Security firm Trail of Bits has released mquire, a Linux memory forensics tool that works without any external dependencies
https://blog.trailofbits.com/2026/02/25/mquire-linux-memory-forensics-without-external-dependencies/

2026-02-26 16:03:56 UTC

Meta's new Threads micro-blogging platform and Twitter rival has been flooded with pro-PRC propaganda bots, according to a new report
https://www.newsguardrealitycheck.com/p/automated-pro-china-bots-swarm-metas

2026-02-26 01:15:08 UTC

There was a post going around earlier today about how Mozilla removed its pledge not to sell user data from its code
They made it official: https://blog.mozilla.org/en/firefox/update-on-terms-of-use/
https://files.mastodon.social/media_attachments/files/116/134/281/547/289/013/original/23ecaefbf08391ec.png

2026-02-24 18:27:08 UTC

RE: https://mastodon.social/@campuscodi/116126560151585483
These settings are utter bullshit and a major dark pattern
Basically, if you don't agree to have AI present and watching over you, Firefox disables all these features... including the ability to translate pages....
Nice going, you Mozilla idiots!
#note169e…0y7p

2026-02-24 16:31:25 UTC

Firefox 148 is out with the new AI settings
Go to about:preferences#ai
https://files.mastodon.social/media_attachments/files/116/126/560/861/241/847/original/c224a7edb5bfd213.png

2026-02-24 10:31:34 UTC

Talks from the Hackfest 2025 security conference, which took place in October, are available on YouTube
https://www.youtube.com/playlist?list=PLaXanmjyAPzG6heHuTSu9f6lIZF25qevU

2026-02-24 08:38:30 UTC

Some breaking news out of Russia: Officials have started an investigation into Telegram founder Pavel Durov for promoting terrorism
https://www.kommersant.ru/doc/8460981?from=top_main_2

2026-02-19 18:27:05 UTC

The West Virginia Attorney General has sued Apple for failing to detect child sexual abuse material on iCloud
https://ago.wv.gov/article/west-virginia-attorney-general-sues-apple-role-distribution-child-sexual-abuse-material

2026-02-19 11:57:37 UTC

If you're not up to date with the latest devops drama, someone published a PoC for a prompt injection in Cline: https://adnanthekhan.com/posts/clinejection/
That PoC was later used to hijack the actual Cline repo and push a malicious npm update that installed OpenClaw everywhere (LOL): https://github.com/cline/cline/security/advisories/GHSA-9ppg-jx86-fqw7
Choosing to deploy an AI agent instead of malware is... something else
Maybe not malicious, but still a major compromise of dev environments

2026-02-17 19:26:11 UTC

A suspected Chinese APT, UNC6201, is exploiting a zero-day in Dell RecoverPoint for Virtual Machines
https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day/

2026-02-17 18:34:59 UTC

- reply

This didn't go out on the RSS? Something happened?
Saw this for the first time now on a Russian forum

2026-02-17 14:12:40 UTC

Cellebrite was used against a Kenyan activist and opposition figure last year
https://citizenlab.ca/research/cellebrite-used-on-kenyan-activist-and-politician-boniface-mwangi/

2026-02-17 03:48:35 UTC

There's a massive WhatsApp account takeover campaign in Armenia right now
This seems to be a commodity spam operation, but investigators believe the attackers are exploiting SS7 👀
https://cyberhub.am/en/blog/2026/02/16/massive-wave-of-whatsapp-takeover-attacks-targeting-armenian-users-what-happened/

2026-02-15 20:15:55 UTC

Western Digital has recently announced that it sold all of the year's hard-drive inventory to AI companies.
In other words, prepare for huge SSD price surges.
https://wccftech.com/western-digital-has-no-more-hdd-capacity-left-out/

2026-02-13 11:14:37 UTC

Palo Alto Networks opted not to tie China to a global cyberespionage campaign the firm exposed last week over concerns that the cybersecurity company or its clients could face retaliation from Beijing, according to two people familiar with the matter.
https://www.reuters.com/world/china/palo-alto-chose-not-tie-china-hacking-campaign-fear-retaliation-beijing-sources-2026-02-12/

2026-02-12 01:03:57 UTC

Don't show this to kids in Australia or the UK: https://age-verifier.kibty.town/
https://files.mastodon.social/media_attachments/files/116/054/964/593/619/867/original/6a96243f6ad8205a.png

2026-02-11 22:16:59 UTC

Russia has permanently blocked YouTube yesterday and WhatsApp today
https://www.kommersant.ru/doc/8421763

2026-02-09 09:14:03 UTC

-SmarterTools hacked via its own product
-Dutch DPA and European Commission hacked via Ivanti zero-days
-Senegal held for ransom
-state actor behind Signal phishing campaign in Germany
-Flickr 3rd party breach
-China executes scam compound execs
-DDoSer arrested in Poland
-Northwestern hacker pleads guilty
-Nigerian scammer gets 8 years
-17% of OpenClaw skills are malicious
-ClawHub to scan skills using VT
Podcast: https://risky.biz/RBNEWS523/
Newsletter: https://news.risky.biz/risky-bulletin-smartertools-hacked-via-its-own-product/
https://files.mastodon.social/media_attachments/files/116/039/894/235/865/628/original/f2f1b0b3a94aa389.png

2026-02-08 11:35:31 UTC

Microsoft held an AMA session and updated its guide to help sysadmins safely replace Secure Boot certificates that are set to expire this June.
https://techcommunity.microsoft.com/event/windowsevents/ask-microsoft-anything-secure-boot/4486023
https://techcommunity.microsoft.com/blog/windows-itpro-blog/secure-boot-playbook-for-certificates-expiring-in-2026/4469235

2026-02-05 14:37:18 UTC

Cisco has discovered DKnife, an AitM toolkit installed on hacked routers and edge devices by Chinese hackers, designed to intercept and tamper with traffic to deliver malware
https://blog.talosintelligence.com/knife-cutting-the-edge/

2026-02-03 11:57:12 UTC

Dear f***ing lord!
Nearly one every three Meta ads showed in the EU and UK over 23 days pointed to online scams
This should be the easiest layup for govt agencies in the history of enforcements
https://www.gendigital.com/blog/insights/research/scam-ad-machine-meta

2026-02-03 11:31:57 UTC

Kaspersky has a list of individuals targeted in the Notepad++ incident
https://securelist.com/notepad-supply-chain-attack/118708/
https://files.mastodon.social/media_attachments/files/116/006/473/076/480/784/original/5f0189a8ef21b7a0.png

2026-01-28 20:28:01 UTC

Sounds about right 🫠
https://files.mastodon.social/media_attachments/files/115/974/605/682/123/163/original/910595848b49105e.png

2026-01-26 18:08:44 UTC

Microsoft releases emergency patch for an Office zero-day
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

2026-01-24 15:58:50 UTC

There's a cool Mastodon account named Malicious Extension Bot that sends out notifications whenever new malicious Chrome extensions are detected
https://infosec.exchange/@malicious_browser_bot

2026-01-23 10:41:21 UTC

-Improperly patched bug exploited again in Fortinet firewalls
-Hackers go after security testing environments
-Jordan used Cellebrite against activists
-new Cisco and SmarterMail zero-days
-China accuses Taiwan of 4,000 hacks
-Kazakhstan to tighten data breach laws
-Spain dismisses NSO case
-Dutch want to avoid US clouds for govt data
-€3.5m fine for mysterious company
-Grok generated 23k sexualized images of kids
Podcast: https://risky.biz/RBNEWS516/
Newsletter: https://news.risky.biz/risky-bulletin-improperly-patched-bug-exploited-again-in-fortinet-firewalls/
https://files.mastodon.social/media_attachments/files/115/943/982/993/750/631/original/55fa429a8b2be4a8.jpg

2026-01-22 12:17:20 UTC

Iran is trying to use cryptocurrency to stabilize its fiat rial currency... that's a first
https://www.elliptic.co/blog/iran-has-acquired-us-dollar-stablecoins-worth-at-least-half-a-billion-dollars

2026-01-18 10:15:24 UTC

Five malicious Chrome extensions are targeting the users of popular HR and ERP platforms
-steal cookies
-hijack sessions
-block access to the platform's security and admin pages
Targeted services:
-Workday
-NetSuite
-SuccessFactors
https://socket.dev/blog/5-malicious-chrome-extensions-enable-session-hijacking

2026-01-14 21:32:06 UTC

The Australian cybersecurity agency has warned local businesses against uploading customer data and files to AI chatbots or genAI platforms
https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-for-small-business

2026-01-14 11:33:32 UTC

Beijing tells Chinese firms to stop using US and Israeli cybersecurity software, sources say
https://www.reuters.com/world/china/beijing-tells-chinese-firms-stop-using-us-israeli-cybersecurity-software-sources-2026-01-14/

2026-01-08 10:18:31 UTC

Cloudflare says that BGP routing anomalies right before the US intervention and arrest of Nicolas Maduro appear to have been just "an accident"
https://blog.cloudflare.com/bgp-route-leak-venezuela/

2026-01-04 13:42:37 UTC

"Flights across Greece were grounded on Sunday after a collapse of radio frequencies crippled air traffic communication, stranding thousands of travellers and bringing airport operations to a halt."
https://www.reuters.com/world/europe/greek-airports-halt-flights-due-radio-frequency-issues-2026-01-04/

2025-12-25 13:31:30 UTC

Christmas Eve miracle: Fortinet admits new exploitation of a 2020 bug
https://www.fortinet.com/blog/psirt-blogs/product-security-advisory-and-analysis-observed-abuse-of-fg-ir-19-283

2025-12-25 09:44:56 UTC

David Stern, the CISA official behind the agency's Pre-Ransomware Notification Initiative (PRNI), has quit the agency after he was forced to relocate to FEMA's Boston office by the new DHS leadership
https://www.cybersecuritydive.com/news/cisa-ransomware-warning-program-key-employee-left/808589/

2025-12-18 10:54:10 UTC

French authorities said they arrested the man who hacked their Ministry of Interior email servers.
He's a known hacker who was already convicted this year. Anyone has any ideas who this could be?
https://www.rfi.fr/en/france/20251218-france-detains-suspect-over-interior-ministry-cyberattack-as-probe-widens

2025-12-17 10:14:49 UTC

-Most smart devices run outdated web browsers
-Ukraine hacks major Russian defense contractor
-Ransomware hits Venezuela's oil company
-Hackers are trying to extort PornHub with stolen user data
-SoundCloud has a data breach
-Ribbon Finance hacked for $2.7m
-Prosper data breach exposes 17.6m users
-Iranian hackers put out bounties on Israelis
-Russian hackers breach Dutch public fountain (yes, you read it right)
Podcast: https://risky.biz/RBNEWS509/
Newsletter: https://news.risky.biz/risky-bulletin-most-devices-run-outdated-web-browsers/
https://files.mastodon.social/media_attachments/files/115/734/369/122/464/175/original/fc0034e425759dc8.png

2025-12-16 17:57:03 UTC

"Microsoft Scales Back AI Goals Because Almost Nobody Is Using Copilot"
:thinkerguns:
https://www.extremetech.com/computing/microsoft-scales-back-ai-goals-because-almost-nobody-is-using-copilot

2025-12-14 17:41:01 UTC

The GNOME project has banned developers from including AI-generated code in its shell extensions
https://blogs.gnome.org/jrahmatzadeh/2025/12/06/ai-and-gnome-shell-extensions/

2025-12-11 02:16:19 UTC

The Justice Department charged a former product manager at Accenture Federal Services with falsely misleading government customers about the security posture of a cloud product offered by the company.
https://www.nextgov.com/cybersecurity/2025/12/us-charges-former-accenture-employee-misleading-feds-cloud-platforms-security/410085/

2025-12-09 11:49:56 UTC

Per Sysdig, North Korean hackers are now exploiting React2Shell to drop EtherRAT, a remote access trojan that uses Ethereum smart contracts as C2
https://www.sysdig.com/blog/etherrat-dprk-uses-novel-ethereum-implant-in-react2shell-attacks

2025-12-08 23:59:53 UTC

Meta told the EU it will use less personal data for ads
...and those dummies believed it!!!
https://ec.europa.eu/commission/presscorner/detail/en/mex_25_2966

2025-11-25 14:32:16 UTC

"A cross-party group of lawmakers will urge the European Parliament to ditch internal use of Microsoft’s ubiquitous software in favor of a European alternative, according to a letter obtained by POLITICO."
https://www.politico.eu/article/get-us-off-microsoft-eu-lawmakers-press-parliament-to-change-in-house-it/