Brian Greenberg :verified:

CIO by day, cybersecurity professor & Forbes Contributor by night, and a firm believer that the best ideas start with good coffee. I’m passionate about using AI, cloud tech, and leveraging system dynamics to make work (and life) a little easier. Outside of work, I’m either reading/writing in some indie coffee house, hiking shady trails along the river, or adding to my ever-growing collection of houseplants. I’m always learning, always leading, and always up for a good book or a new coffee house to explore.  #CyberSecurity #systemstheory #hiking #philosophy #actor #improviser #storyteller #coffee house addict 📍Chicago, IL  🦋🥾☕️🎭🤖🪴✍️

Public Key

npub1u6g8qmjkx2nfud0d84zz5j795lp5gp9h4w39vev6n76zgcn2hvrs7tku9n

NIP-05 Address

brian_greenberg@infosec-exchange.mostr.pub

Profile Code

nprofile1qqswdyrsdetr9f57xhkn63p2f0z60s6yqjm6hgjkvkdfldpyvf4tkpcpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzynhwden5te0danxvcmgv95kutnsw43qwu6rdd

Publishing to

relay.ditto.pub

offchain.pub

relay.snort.social

Author Public Key

npub1u6g8qmjkx2nfud0d84zz5j795lp5gp9h4w39vev6n76zgcn2hvrs7tku9n

Show more details

Published at

2026-10-25T06:23:49Z

Kind type

0 Metadata

Event JSON

{ "id": "39f1b76621027c31cdee55d05fa0734517d62e6dca909aa51d18fbf67be1fe8f", "pubkey": "e690706e5632a69e35ed3d442a4bc5a7c34404b7aba256659a9fb424626abb07", "created_at": 1792909429, "kind": 0, "tags": [ [ "emoji", "verified", "https://media.infosec.exchange/infosec.exchange/custom_emojis/images/000/162/424/original/be4326fe58d3b038.png" ], [ "proxy", "https://infosec.exchange/users/brian_greenberg", "activitypub" ], [ "client", "Mostr", "31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr", "wss://relay.ditto.pub" ] ], "content": "{\"name\":\"Brian Greenberg :verified:\",\"about\":\"CIO by day, cybersecurity professor \u0026 Forbes Contributor by night, and a firm believer that the best ideas start with good coffee. I’m passionate about using AI, cloud tech, and leveraging system dynamics to make work (and life) a little easier. Outside of work, I’m either reading/writing in some indie coffee house, hiking shady trails along the river, or adding to my ever-growing collection of houseplants. I’m always learning, always leading, and always up for a good book or a new coffee house to explore. \u2029#CyberSecurity #systemstheory #hiking #philosophy #actor #improviser #storyteller #coffee house addict\u2028📍Chicago, IL \u2029🦋🥾☕️🎭🤖🪴✍️\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/114/224/012/052/749/216/original/1e11732d1ff94efc.jpeg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/114/224/012/052/749/216/original/ba17f61e8983e0b5.png\",\"nip05\":\"brian_greenberg@infosec-exchange.mostr.pub\",\"fields\":[[\"Blog\",\"https://briangreenberg.net\"],[\"Github\",\"https://github.com/bjgreenberg\"],[\"Gravatar\",\"https://gravatar.com/bjgreenberg\"],[\"Threads\",\"https://www.threads.net/@bjgreenberg\"],[\"LinkedIn\",\"https://linkedin.com/in/bjgreenberg\"],[\"LinkTree\",\"https://linktr.ee/brian.greenberg\"]]}", "sig": "8c58521e1c323e9cd9b91f4ce64dcd60182f588e797b65decc9d94e77b60c1309ab13101b6d74960250868028149ec3a68e0ba114dae1e1f886adf8c3bf31995" }

Last Notes

2026-10-23 15:37:32 UTC

🔐 The offline master keys were not offline. Zimmer, who ran the largest group of hijacked Tor relays, said so in his post-mortem. Copies sat in a backup on his management server, encrypted with a password the attacker already found. 😬
He was just as blunt about the cause: The root cause was ours: one password reused for SSH login, sudo, and the backup passphrase, stored in plaintext on both servers, plus SSH password authentication left enabled on the internet-facing management server. Credit to him for putting that in writing. 👏 I'd guess plenty of servers out there would earn the same sentence, maybe a few of yours.
In early October, attackers took over more than 300 Tor exit relays and rerouted SSH connections to 12 interception servers. At the peak on October 4, those relays carried 7.46% of Tor's exit capacity, according to an analysis of public directory data. Zimmer's own break-in came earlier. On August 28, the attacker logged into his management server with the account password on the first try and gained root within five minutes.
The victims got hit through passwords too. To get burned, you had to accept the interceptor's host key and type a password. Some people saw an OpenSSH warning that the server had changed... others just got the usual prompt to accept a new key. If you used key-based login, the attacker couldn't pass it through to the real server because the signature is tied to that session.
The backdoor is Ebury version 1.8.3, a single library file that leaves the packaged library alone, so the normal package checks come back clean. Zimmer's servers showed none of the host-level signs on the Tor Projects checklist. The only thing that gave it away was the changed exit policy.
🚨 If you run anything with SSH open to the internet, turn off password login and use keys. If you accepted an unfamiliar or changed host key over Tor between October 1 and 5, assume that password is stolen, change it, and check the server. And if you're poking around a box you suspect, log in with a key, since Ebury captures typed passwords.
Nobody knows yet how the other 58 operators got hit. On FranTech, the network behind BuyVM, 71 of 101 relays switched to the attackers' policy, compared with 13 of 9,054 hosted elsewhere. The researcher who spotted this asked whether the attackers got in at the hosting provider level, and so far nobody has answered.
https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html
#Cybersecurity #InfoSec #Tor #SSH #Linux #Malware #ThreatIntel #IncidentResponse #RiskManagement #security #privacy #cloud #darkweb

2026-06-10 17:43:25 UTC

✨ A sparkle icon appears in an app that no one in IT approved. The help desk can't explain it, and it's already processing your data! This kept coming up in conversations with other CIOs, so I wrote about it in my latest Forbes piece.
The pattern repeats across so many vendors; here are just a few:
・Zoom auto-enabled AI Companion on host accounts, with recordings and full transcripts already defaulted on
・Microsoft 365 Copilot activates for every admin if your tenant holds a single paid license, and opting out means building a special security group
・Google's Workspace Intelligence shipped default-on for Gmail, Drive, Chat, and Calendar, with admin controls lagging the live feature by up to 72 hours
・OpenAI disables connectors by default for Enterprise customers but enables them for Business. Same vendor, opposite defaults.
Every default-on feature just transfers governance work from the vendor to you, along with wiretap exposure and e-discovery sprawl that nobody signed up for.
My ask of vendors is simple: ship AI features off by default and give admins an evaluation window measured in weeks, not days. Until that happens, assume the next AI feature is already live in your tenant. Review your configurations like it's a recurring operational task, because it is.
Full piece here: https://www.forbes.com/councils/forbestechcouncil/2026/06/10/default-on-ai-are-saas-vendors-outsourcing-their-risk-to-you
#RiskManagement #Forbes #ForbesTechnologyCouncil #ForbesTechCouncil #leadership #security #privacy #cloud #infosec #cybersecurity #AI #SaaS
@nprofile…gp3q @nprofile…d77j @nprofile…wm4d @nprofile…fvlf @nprofile…6c2a #DePaul #DepaulU #DePaulUniversity #DePaulCDM

2026-04-28 14:42:48 UTC

Your AI strategy isn't a strategy if your competitor can copy it in a quarter.
MIT Sloan just published something you might want to ruminate on. The argument is straightforward: AI fails the basic test of sustainable competitive advantage because it's neither unique nor inimitable. Capital, talent, algorithms, even proprietary data, all of it is converging. Smaller models are catching up to larger ones. Open-source is closing the gap. The moat you think you're building is filling in as fast as you dig.
The part that should sting for most executives is this: the companies that win won't win because of AI. They'll win because of what their people do with it that nobody else thought to do.
That means that it isn't what AI tools you're buying. It's whether you're still investing in the humans who know your customers, your market, and your blind spots well enough to make a move no model would predict.
If you gutted your talent development budget to fund AI infrastructure, you may have traded the thing that can't be commoditized for the thing that already is.
https://sloanreview.mit.edu/article/why-ai-will-not-provide-sustainable-competitive-advantage
#AIStrategy #CompetitiveAdvantage #Leadership #FutureOfWork #TalentDevelopment

2026-04-22 06:15:41 UTC

An ex-Azure engineer published six essays arguing Microsoft's cloud has been on life support since 2008, and the cause isn't bad code. It's bad people decisions. Rushed launch, post-launch talent exodus, no testing discipline, no architectural vision. Sound familiar to anyone who's worked in a place that ships first and staffs later?
Now layer 2026 on top. Microsoft cut roughly 15,000 jobs in mid-2025. Coding agents are pumping out 4x more commits in 90 days. GitHub's unofficial uptime has slipped under 90% and the proposed fix is, wait for it, moving more of GitHub onto Azure. The same Azure the engineer says is held together with rushed decisions and wishful thinking.
🧠 The phrase that stuck with me is "knowledge dilution from high attrition." When the senior people who knew why a system was built that way leave, no LLM in the world can recover that context
🤖 More AI-written code does not mean less work. It means more code to review, test, deploy, and run, which means more compute and more humans needed downstream
📉 OpenAI signing an $11.9B compute deal with CoreWeave in March 2025 was the loudest "we don't trust your capacity" signal Microsoft has ever received from its closest partner
🪑 The bet that AI lets you cut headcount keeps colliding with the reality that AI generates work for humans faster than it removes it
Every CIO I talk to is being pitched the same dream: fewer engineers, more agents, lower run rate. The Azure story is what happens when that math doesn't pencil out and the bill comes due in incidents instead of dollars.
https://www.theregister.com/2026/04/04/azure_talent_exodus/
#Azure #AI #Leadership #security #privacy #cloud #infosec #cybersecurity #software #devops

2026-04-13 11:10:01 UTC

John Carreyrou, the reporter who took down Theranos, just spent a year trying to unmask Satoshi Nakamoto. His conclusion: it's Adam Back, the British cryptographer who literally invented a core component of Bitcoin and has spent the last decade quietly running the community that maintains it.
Back denies it. Of course he does.
This isn't a conspiracy theory stitched together from vibes. Carreyrou and a NYT data journalist ran the full mailing list archive of 34,000 users, filtered down through writing tics, hyphenation errors, spelling habits, and synonym-free technical vocabulary, and landed on one person. Back shared 67 of Satoshi's exact hyphenation errors. The next closest suspect had 38.
That's a fingerprint.
A few things worth sitting with:
🔍 Back outlined nearly every architectural feature of Bitcoin; distributed nodes, Hashcash-based mining, inflation controls, public immutability, a full decade before Bitcoin launched. Not vaguely. Specifically.
🕳️ He went silent on the Cryptography mailing list during the exact window Satoshi was active, then publicly claimed he had "participated" in those discussions. He hadn't. There's no record.
📋 He refused to produce metadata from the emails he claims Satoshi sent him. A man with nothing to hide produces the metadata.
💬 During the confrontation in El Salvador, Back apparently said something that only makes sense if he wrote the "better with code than with words" quote himself.
If Back is Satoshi, the more interesting story isn't the identity reveal. It's that the person who created a $2.4 trillion system designed to operate without any central authority has spent the last decade quietly becoming that authority. Blockstream raised a billion dollars. Back poached the core developers. He shaped the block size debate. He is, functionally, Bitcoin's most powerful insider.
The cypherpunk who wanted to free money from institutional control built an institution. That's either irony or it's the plan.
https://www.nytimes.com/2026/04/08/business/bitcoin-satoshi-nakamoto-identity-adam-back.html
#Bitcoin #Crypto #Cybersecurity #security #privacy #cloud #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/397/085/788/725/290/original/f268d1f59d2bc2ba.mp4

2026-04-13 10:58:25 UTC

A startup is putting military-style drones in high school ceilings. Ceiling-mounted. Charging. Waiting. And when something happens, a pilot in Austin, Texas, decides whether to deploy pepper gel on your kid's school. I'm not saying the problem isn't real. It absolutely is. But read that back.... in schools. We've taken a Ukrainian battlefield tactic against Russian soldiers and ported it to Deltona High School in Florida. The co-founder literally said the idea came from watching drone videos of the war in Ukraine. The chief pilot described it as "cheating in a video game after you die." These are children.
Here's what's not in the headline:
🔒 The drones use an encrypted connection — but the article notes they're potentially vulnerable to cyberattack. A compromised drone in a crowded hallway isn't a security tool; it's a weapon pointed in the wrong direction.
⚖️ Mithril reserves the right to act independently during an attack, without waiting for law enforcement. A private company operating remotely is making use-of-force decisions at a school.
💰 Florida and Georgia approved $500K+ each for this. A group of Texas parents raised $200K more. That's real money going to ceiling drones instead of mental health services, counselors, or de-escalation programs.
The ACLU said it plainly: when force becomes a zero-risk remote action, it gets overused. Axon tried a Taser drone for schools in 2022, and its own ethics board killed it. Mithril is picking up where that got dropped.
I teach cybersecurity. I've spent years in boardrooms helping organizations think through risk. And the risk calculus here isn't just about whether the drone works. It's about what we're normalizing when we turn schools into drone-monitored combat zones and call it progress.
"This is the future," said the sheriff's captain.
I hope not.
https://www.wsj.com/business/a-startup-is-supplying-drones-to-high-schools-a7800ade
#SchoolSafety #Cybersecurity #Leadership #security #privacy #cloud #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/397/038/875/713/788/original/a609eb258cbd9d03.mp4

2026-03-29 23:52:55 UTC

I teach cybersecurity. And I genuinely don't know what to tell my students after this one. Federal reviewers spent years trying to get basic encryption documentation from Microsoft for its GCC High government cloud. They couldn't get it. One reviewer called the system a "pile of spaghetti pies," with data traveling from point A to point B the way you'd get from Chicago to New York: a bus to St. Louis, a ferry to Pittsburgh, and a flight to Newark. Each leg is a potential hijacking. They knew this. They said this out loud in writing. Then they approved it anyway in December 2024, because too many agencies were already using it. 🔐 That's not a security review. That's a hostage negotiation. Two things in this story should make every CISO and CIO uncomfortable:
🧩 Microsoft built its federal cloud on top of decades of legacy code that it apparently can't fully document itself
👮 "Digital escorts" often ex-military with minimal software engineering backgrounds are the firewall between Chinese engineers working on the system and classified U.S. networks 🤦🏻‍♂️
The scariest line in the whole ProPublica investigation isn't the "pile of shit" quote. It's this: FedRAMP determined that refusing authorization wasn't feasible because agencies were already using the product. Read that again. The security review process reached a conclusion based on sunk cost, not risk. Ex Post Facto Fallacy
If that logic holds, the compliance framework is just documentation theater. And right now, CISA is being hollowed out, so there are fewer people left to even run the theater.
https://arstechnica.com/information-technology/2026/03/federal-cyber-experts-called-microsofts-cloud-a-pile-of-shit-approved-it-anyway/
#Cybersecurity #Microsoft #FedRAMP #Leadership #RiskManagement #security #privacy #cloud #infosec

2026-03-29 23:15:58 UTC

Congress banned federal agencies from collecting bulk data on Americans in 2015. So some of them just started buying it from data brokers instead. 😳 ICE signed a contract with a company whose tool can track mobile phone movements or locate phones that have visited specific locations. No warrant. Taxpayer money. Done. One privacy attorney put it plainly: it's like the police paying your landlord $100 for a spare key and walking through your house without a warrant.
Now add AI to that picture. Anthropic's CEO Dario Amodei warned that records the government can purchase can be used by AI to assemble "a comprehensive picture of any person's life automatically and at a massive scale." That's not hypothetical. That's now. And the window to close this through FISA reauthorization closes April 20!
The business angle nobody's talking about: the same data brokers selling to ICE are selling data your employees, customers, and executives generate every day. You have no control over what happens to it after it leaves your app or browser. That should be in your risk conversation, not just your privacy policy.
🏛️ This is bipartisan; Republicans and Democrats are co-sponsoring the fix
📅 April 20 is the deadline
https://www.npr.org/2026/03/25/nx-s1-5752369/ice-surveillance-data-brokers-congress-anthropic
#Privacy #AI #Leadership #Cybersecurity #security #cloud #infosec #surveillance

2026-03-29 23:07:29 UTC

Oh boy. Stanford researchers scanned 10 million web pages and found API keys just sitting in the public-facing code. That's 1,748 active credentials from major providers exposed in live website code, mostly inside JavaScript files. Not in old test environments. Not in a forgotten repo. In the live, running site. Banks. Healthcare providers. "Not just small companies, but some very large companies," according to the lead researcher. And some of those credentials had been sitting there for years. Not the first time I've seen something like this. 🤦🏻‍♂️
The thing is that most orgs are scanning their source code but not their deployed sites. 😳 Those are two different things, and most leaks originate during the build process. A key gets baked in somewhere between development and production, and nobody catches it because the scan already ran upstream. Meanwhile, GitGuardian counted over 28 million new hardcoded secrets exposed in public GitHub commits in 2025 alone. This isn't a one-time research finding it's a systemic habit that needs to change.
🔍 When did your team last scan the live site, not just the codebase?
🏦 If you're in a regulated industry, that question just became a compliance question too
https://www.newscientist.com/article/2520143-security-credentials-inadvertently-leaked-on-thousands-of-websites/
#Cybersecurity #AppSec #Leadership #security #privacy #cloud #infosec

2026-03-04 01:29:31 UTC

Think you’re an anonymous on-line with your fake user name? Recent studies demonstrate that Large Language Models are becoming highly efficient at de-anonymizing internet users. By analyzing linguistic patterns, these models can link pseudonymous accounts to real identities with 85% accuracy. This process does not rely on leaked databases or IP addresses. It focuses entirely on the unique way you construct sentences and use specific vocabulary across different platforms.
The era of hiding behind a screen name is effectively over because your writing style is a biometric marker. A model can scan millions of posts to find a match between an anonymous whistleblower and a public profile. This capability transforms stylometry from a niche forensic tool into a scalable method of mass surveillance.Time to rethink digital privacy when our own habits of expression become the very data points that betray us.
🧠 LLMs identify users by matching unique linguistic fingerprints.
⚡ The accuracy rate for identifying individuals across platforms is 85%.
🎓 Anonymity now requires actively masking your natural prose.
🔍 Automated deanonymization poses a direct threat to journalists and whistleblowers.
https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users-at-scale-with-surprising-accuracy/
#Privacy #Cybersecurity #AI #DataProtection #security #cloud #infosec

2026-02-10 03:24:42 UTC

 Apple designed Lockdown Mode for people facing grave threats, but we're seeing it work in practice against federal forensics. During a recent investigation into a journalist, the FBI reported that it was unable to extract any data from an iPhone because the feature was enabled. It is rare for a software setting to hold its own against professional, state-level tools. 🔒 The strength of this mode comes from how it drastically reduces the attack surface of the device. By disabling just-in-time JavaScript and blocking most message attachments, it removes the entry points that forensic tools like GrayKey typically exploit. It also forces the device into a state in which biometrics are disabled, requiring a passcode that often carries stronger legal protections during a search.
🧠 Lockdown Mode specifically blocks wired data connections used by extraction hardware.
⚡ The FBI confirmed in court filings that its Computer Analysis Response Team was blocked.
🎓 Using this mode requires giving up features like shared photo albums and link previews.
🔍 Apple offers a $2 million bounty for anyone who can bypass these specific protections.
https://appleinsider.com/articles/26/02/04/iphone-lockdown-mode-will-protect-your-data-even-from-the-fbi
#Apple #CyberSecurity #DataPrivacy #InfoSec #security #privacy #cloud

2026-02-10 03:17:21 UTC

The tech world is currently with OpenClaw, the open-source agent that finally gives AI hands. It can browse the web, execute terminal commands, and manage your emails. While offering a glimpse into a future of total automation, it's also become a textbook example of a security nightmare. The very features that make it useful—system access and persistent memory—are exactly what make it dangerous. 😱 The problem lies in the collapse of traditional security boundaries. OpenClaw operates as you, bypassing the sandboxing that usually protects your operating system from the browser. Because it can reason over and act on external content, a simple malicious email or a poisoned webpage can quietly steer the agent to exfiltrate your data or run harmful scripts. We are seeing thousands of instances exposed to the open internet with little to no authentication. ☠️
🧠 OpenClaw binds to all network interfaces by default, making it visible to the public internet.
⚡ Malicious skills in the community marketplace have been caught installing info-stealing malware.
🎓 Indirect prompt injection allows attackers to hijack the agent via the data it processes.
🔍 Security researchers have already identified critical RCE vulnerabilities with high CVSS scores.
https://www.fastcompany.com/91485326/openclaw-is-a-major-leap-forward-for-ai-and-a-cybersecurity-nightmare
#OpenClaw #AIAgents #InfoSec #TechEthics #security #privacy #cloud #infosec #cybersecurity

2026-02-10 03:09:35 UTC

🇫🇷 The French government is sending a message about digital independence by ditching Microsoft Teams and Zoom for its own platform, Visio. This move is not about a lack of features but a calculated push for digital sovereignty. By 2027, every government department in France will communicate via this sovereign stack, ensuring that sensitive data remains subject to European law. The shift addresses a growing concern that relying on foreign cloud giants creates a strategic vulnerability. France is opting for an open-source architecture built on Django and React, hosted on the domestic Outscale cloud. This infrastructure removes the risk of external service disruptions while fostering a local tech ecosystem.
🧠 The Visio platform integrates with Tchap, a secure messaging app based on the Matrix protocol.
⚡ French startup Pyannote provides the AI backbone for meeting transcripts and speaker identification.
🎓 The administration expects to save millions in annual licensing fees by using in-house software.
🔍 Data remains strictly within French jurisdiction to bypass foreign data access laws.
https://itsfoss.com/news/france-ditches-microsoft-teams-and-zoom/
#France #TechHistory #DigitalSovereignty #OpenSource #security #privacy #cloud #infosec #cybersecurity #FOSS

2026-01-26 16:04:08 UTC

We’ve spent the last few years treating AI like a science fair project—lots of cool pilots, very few polished products. But as we hit 2026, the mandate has shifted from "can we do this?" to "how does this actually work with everything else?"
I recently sat down with Kelsey Ziser at InformationWeek to discuss the latest industry obsession: embedded hardware AI. While the industry is racing to put an AI chip in every laptop, I’m still looking for the "why." For most of us, the browser is the office. Adding hardware-level complexity shouldn't be the default unless it solves a problem that the cloud can't.
🧠 2026 is the year of the 'Chief Integration Officer.'
⚡ Hardware AI must prove its worth against browser-based LLMs.
🎓 Governance and interoperability remain the biggest hurdles.
🔍 Stop chasing "ambient" novelty; start chasing scalable value.
https://www.informationweek.com/ai-innovations/as-cios-focus-on-ai-integration-new-ai-tools-complicate-the-agenda-in-2026
#AIIntegration #DigitalTransformation #InformationWeek #security #privacy #cloud #infosec #cybersecurity @nprofile…6ecj @nprofile…sycv @nprofile…xadg

2026-01-07 02:35:04 UTC

Prediction markets sell themselves as truth engines. Put money on outcomes, strip away noise, and let prices reveal reality. The Venezuela strike exposes the cost of that logic. When someone can profit from a covert military operation before the public knows it happened, markets stop forecasting the future and start rewarding proximity to power. This isn’t information discovery. It’s monetized access.
The political problem is simple and corrosive: greed gets institutionalized. When insiders are encouraged to leak or act early because there’s money on the table, restraint becomes irrational. Journalism delays publication to protect lives. Markets pay you to move first and ask questions never.
The ethical problem runs deeper. Prediction platforms don’t just reflect reality; they reshape incentives inside governments, corporations, and security institutions. They quietly ask every insider: do your job, or place your bet?
And the security problem may be the most dangerous of all. Classified plans, military actions, and diplomatic moves become market signals. Prices move faster than accountability. Risk is no longer mitigated; it’s priced.
Efficient markets are not moral systems. When everything becomes tradable, even secrecy turns into a commodity. And when insiders win, the public doesn’t gain clarity. It absorbs the risk.
TL;DR
🧠 Prediction markets reward access to secrets
⚡ Greed displaces ethics and restraint
🎓 Security decisions become financial signals
🔍 Truth priced by markets is not the same as a public good
https://www.theatlantic.com/technology/2026/01/venezuela-maduro-polymarket-prediction-markets/685526/
#MarketEthics #Politics #Crypto #Power #security #privacy #cloud #infosec #cybersecurity

2025-12-22 22:02:56 UTC

This Gmail hack is unsettling not because it’s flashy, but because it’s bureaucratic. Attackers aren’t breaking encryption or outsmarting algorithms. They’re filling out forms. By changing an account’s age and abusing Google’s Family Link feature, they can quietly reclassify an adult user as a “child” and assume parental control. At that point, the rightful owner isn’t hacked so much as administratively erased.
The clever part is that everything happens inside legitimate features. Passwords are changed. Two-factor settings are altered. Recovery options are overwritten. And when the user tries to get back in, Google’s automated systems see a supervised child account and do exactly what they were designed to do: say no.
Google says it’s looking into the issue, which suggests this wasn’t how the system was supposed to work. But it’s a reminder of an old lesson. Security failures often happen when protective mechanisms are combined in ways no one quite imagined. The tools aren’t broken. The assumptions are.
There’s no dramatic fix here, only mildly annoying advice that suddenly feels urgent. Review recovery settings. Lock down account changes. Use passkeys. Because once an attacker controls the recovery layer, proving you’re you can become surprisingly difficult.
TL;DR
🧠 Family safety tools are being weaponized
⚡ Account recovery can be shut down entirely
🎓 Legitimate features enable the lockout
🔍 Prevention matters more than appeals
https://www.forbes.com/sites/daveywinder/2025/12/07/google-looking-into-gmail-hack-locking-users-out-with-no-recovery
#Cybersecurity #Gmail #IdentitySecurity #AccountRecovery #DigitalRisk #security #privacy #cloud #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/765/475/680/741/727/original/426b72113277ab41.jpeg

2025-11-26 17:56:57 UTC

Attackers just used Claude Code more like an automated red team than a chatbot. Anthropic reports that a Chinese state-sponsored group leveraged AI to run 80 to 90 percent of a campaign targeting about 30 global targets, with only minimal human involvement. That is what an inflection point in security looks like: work that once needed a room full of operators is now something a model can orchestrate at machine speed.
I had a great conversation with InformationWeek Senior Editor Kelsey Ziser about why this matters so much for CIOs. Since attackers are already delegating recon, exploitation, and data exfiltration to agentic AI, then manual, ticket-driven defense is basically fighting a high-speed drone swarm with a whiteboard and a weekly status meeting.
The headline is not just that AI can be weaponized; it is that it will quickly lower the barrier to entry for less sophisticated actors. CIOs need to assume that AI is in the attacker toolkit today and respond by tightening their own attack surface, automating detection and response, and using AI to help analysts keep pace with the volume and speed of events.
There is also a culture shift hiding in this story. Security teams that still treat AI as a side project or a single tool in the SOC are going to be surprised when the first AI native attack chain moves faster than their playbooks. The organizations that cope best will be the ones that let AI handle the repetitive work while humans focus on judgment, governance, and the messy edge cases.
TL;DR
🧠 Anthropic blocked a largely AI-run cyberattack using Claude Code
⚡ Offense is now AI native, and the barrier for attackers just dropped
🎓 Manual security at human speed will not keep up with AI-assisted threats
🔍 CIOs should pair AI-driven monitoring and response with tighter surfaces and better user training
https://www.informationweek.com/cybersecurity/anthropic-thwarts-cyberattack-on-its-claude-code-here-s-why-it-matters-to-cios
#CyberSecurity #AI #CIO #InfoSec #security #privacy #cloud

2025-11-06 19:12:29 UTC

NPM just got hit by another supply chain mess. Attackers uploaded 126 credential-stealing packages that used “Remote Dynamic Dependencies” to quietly fetch malware from untrusted sites. Over 86,000 downloads later, the campaign (dubbed PhantomRaven) shows how blind traditional scanning still is to dynamic or AI-generated code patterns. What makes this dangerous isn’t just the malicious code, it’s the infrastructure gap. Dependencies downloaded “fresh” on install mean attackers can serve clean code to researchers and poison code to production networks. That’s targeted compromise at scale.
⚠️ 126 malicious NPM packages
🧠 Exploits Remote Dynamic Dependencies
🎯 Targets CI/CD environments
🔐 Invisible to static analysis tools
https://arstechnica.com/security/2025/10/npm-flooded-with-malicious-packages-downloaded-more-than-86000-times/
#SupplyChainSecurity #OpenSource #CyberSecurity #NPM #security #privacy #cloud #infosec

2025-10-20 00:28:28 UTC

🤦🏻‍♂️ Well, it was probably inevitable that the "Internet of Things" would eventually make its way into the toilet bowl. Kohler's new camera analyzes your waste for 'health insights', which sounds futuristic, but the security questions are concerning. It uses a fingerprint sensor ? to tie sensitive health data directly to an individual, then sends it to the cloud. While they promise encryption, we're creating a honeypot 😬 of incredibly personal information that's ripe for misuse. 💩
TL;DR
📸 Kohler is selling a $599 toilet camera, the Dekoda, to monitor your gut health. 💩
👆 It uses a fingerprint scanner to link the health data it collects directly to you.
🔐 The company claims end-to-end encryption, but this is still an unnervingly specific and sensitive dataset to have stored on any server.
💰 On top of the hardware cost, it also requires a subscription, creating another recurring data transaction.
https://techcrunch.com/2025/10/19/kohler-unveils-a-camera-for-your-toilet/
#IoT #Privacy #DataSecurity #HealthTech #security #privacy #cloud #infosec #cybersecurity #PoopPictures

2025-10-17 18:39:53 UTC

The DOJ just seized $15B from a “pig butchering” 🐷 scam so large it reads like fiction. But the worst part isn’t the money — it’s that much of it ran on forced labor. People are trafficked into compounds, running fake romances to scam others online. What’s striking is the scale: well-educated professionals lost life savings to criminals who themselves were victims. It’s a grim feedback loop of exploitation, loneliness, and tech-enabled deceit.
⚠️ $15B seized from crypto scam
💔 Forced labor behind the fraud
🔐 Victims on both sides of the screen
🌍 FBI: “Human suffering” at global scale
https://arstechnica.com/tech-policy/2025/10/feds-seize-15-billion-from-alleged-forced-labor-scam-built-on-human-suffering/
#Cybercrime #HumanTrafficking #OnlineSafety #Fraud #security #privacy #cloud #infosec #cybersecurity #RomanceScam #PigButchering

2025-10-15 20:01:34 UTC

F5 says nation-state hackers breached its systems and stole BIG-IP source code and vulnerability data. That’s as serious as it sounds. Even though F5 says there’s no evidence of exploitation, this is a goldmine for anyone looking to weaponize zero-days or craft supply chain attacks. The company brought in Mandiant and CrowdStrike, rotated creds, hardened access controls, and says the threat is contained — but this one will ripple far and wide.
TL;DR
⚠️ Source code and vuln info stolen
🧠 Long-term access in dev environment
🔐 No customer data compromised
🧩 Zero-day risk still on the table
https://thehackernews.com/2025/10/f5-breach-exposes-big-ip-source-code.html
#cybersecurity #breach #threatintel #infosec #security #privacy #cloud

2025-10-14 18:42:56 UTC

Hackers can steal 2FA codes and private messages from Android phones. The "Pixnapping" attack is a really clever piece of research. It shows that the theoretical wall between apps on your phone isn't as solid as we'd like to believe. By exploiting a GPU side channel, a malicious app with zero permissions can effectively screenshot other apps, one pixel at a time. It's a reminder that security is a stack, and a vulnerability at the hardware level can undermine everything built on top of it.
TL;DR
👾 A new attack called "Pixnapping" can read visual data from other apps on Android devices.
🔑 It exploits a GPU side-channel leak to steal sensitive info like 2FA codes and messages, pixel by pixel.
⚠️ The scary part: the malicious app required for the attack needs zero special permissions to be granted.
🧠 While complex to pull off, this is a serious proof of concept that challenges the core idea of OS app sandboxing.
https://arstechnica.com/security/2025/10/no-fix-yet-for-attack-that-lets-hackers-pluck-2fa-codes-from-android-phones/
#Android #Cybersecurity #SideChannelAttack #2FA #security #privacy #cloud #infosec

2025-10-08 18:48:09 UTC

Tilly Norwood — the so-called “AI actress” — feels less like progress and more like propaganda. The rollout isn’t about art or tech; it’s about softening the idea that gen AI belongs in Hollywood as a replacement for people. What’s creepy is how it’s marketed: “agents are interested,” “she could be the next Scarlett Johansson.” The goal isn’t to sell a movie. It’s to sell the inevitability that AI will be the new normal. 🤖 Beneath the buzz, Tilly’s still a digital puppet needing human handlers. The only real actors here are the execs trying to convince us this is the future of storytelling.
TL;DR
🎭 Not an actress, a digital puppet
⚙️ “AI actors” = PR stunt, not progress
🧠 Normalization is the real goal
⚠️ SAG-AFTRA’s concerns are the story
https://www.theverge.com/ai-artificial-intelligence/791680/tilly-norwood-particle6-xicoia-eline-van-der-velden
#AI #Hollywood #Ethics #FutureOfWork #security #privacy #cloud #infosec #cybersecurity #deepfakes

2025-10-07 21:59:42 UTC

LinkedIn’s now sharing user data with Microsoft to “train AI”—and you’re automatically opted in. You can turn it off, but not undo what’s already been used.
I get the logic: more data makes smarter AI. But doing this quietly under “legitimate interest” feels tone-deaf. If you have to opt out to keep control of your own data, something’s off.
TL;DR
⚠️ Default opt-in for AI training
🔐 Settings > Data Privacy > Data for Generative AI Improvement
🧹 Clean old posts; opt-out only stops future use
https://www.malwarebytes.com/blog/news/2025/09/linkedin-will-use-your-data-to-train-its-ai-unless-you-opt-out-now
#Privacy #AIethics #DataProtection #LinkedIn

2025-10-02 21:26:19 UTC

We are watching a new kind of misinformation creep in: bogus quotes invented by sloppy AI assisted reporting. EFF caught multiple outlets attributing fake statements to their staff, and one even cited a person who does not exist. The editor at one site owned it and called it AI slop. The fix is boring but real: verify the quote, verify the link, then publish.
TL;DR
📰 Fake EFF quotes showed up across several outlets
🤖 Editor blamed AI slop and apologized
🔎 Verify quotes and links before you share
🛡️ Newsrooms need written policies and human checks
https://www.eff.org/deeplinks/2025/09/wave-phony-news-quotes-affects-everyone-including-eff
#AI #Misinformation #Journalism #Media #security #privacy #cloud #infosec #cybersecurity @EFF #EFF

2025-06-20 16:02:01 UTC

🚨 AI is hallucinating more, just as we’re trusting it with more critical work. New “reasoning” models, such as OpenAI’s o3 and o4-mini, were designed to solve complex problems step-by-step. But the results?
🧠 o3: 51% hallucination rate on general questions
📉 o4-mini: 79% hallucination on benchmark tests
🔍 Google & DeepSeek’s models also show rising errors
⚠️ Trial-and-error learning compounds risk at each step
Why is this happening? Because these models don’t understand truth, they just predict what sounds right. And the more they “think,” the more they misstep.
We’re using these tools in legal, medical, and enterprise settings—yet even their creators admit:
🧩 We don’t know exactly how they work.
✅ It’s a wake-up call: accuracy, explainability, and source traceability must be the new AI benchmarks.
#AI #LLM #ResponsibleAI #AIEthics #Hallucination
https://www.nytimes.com/2025/05/05/technology/ai-hallucinations-chatgpt-google.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/716/527/412/458/743/original/8007dd5d75819415.mp4

2025-06-17 22:45:28 UTC

A recent study analyzing the Danish labor market (2023-2024) offers some insights into the early impact of generative AI. While AI chatbots have seen rapid adoption across various occupations, the study suggests their effects on overall wages and employment have been remarkably limited so far. 🌐
Key takeaways from the research:
📈 Despite widespread use, AI chatbots showed no significant impact on earnings or recorded hours.
🤔 While AI saves time for many users, the study found that new tasks created by AI (like reviewing AI output or crafting prompts) often offset these time savings for 8.4% of workers.
💸 Only a small fraction (3-7%) of productivity gains translated into higher earnings for workers, raising questions about who benefits most from efficiency.
This early look provides perspective, challenging some narratives around immediate, widespread labor market transformation. It highlights that the integration of AI is still evolving and its long-term economic impact remains a dynamic area for further research. What are your observations on AI's impact in your workplace?
https://arstechnica.com/ai/2025/05/time-saved-by-ai-offset-by-new-work-created-study-suggests/
#GenerativeAI #LaborEconomics #AIImpact #WorkplaceInnovation #FutureOfWork

2025-06-17 22:31:33 UTC

Navigating the evolving landscape of Generative AI? 🌐 It's transforming how we work and learn. Getting started with AI chatbots is simpler than you think.
Here’s a quick guide to help you dive in:
💡 Choosing Your Bot: Each AI chatbot, from ChatGPT to Microsoft Copilot, Google Gemini, and Anthropic's Claude, offers distinct capabilities. Explore them to find the best fit for your needs.
✍️ Crafting Effective Prompts: This is where the magic happens!
🧠 Unlearn your search engine habits; provide detailed instructions.
🎯 Be specific and add ample context for personalized responses.
🗣️ Ask the AI to adopt a specific role or tone.
📊 Always ask for citations if credibility is crucial.
🚀 Leveraging Advanced Features: Beyond basic chat, explore voice mode for natural interactions 🗣️ or deep research tools for comprehensive reports 📚.
While AI offers incredible potential, it’s still maturing. Always fact-check critical information and prioritize your data privacy. What are your go-to AI tools or prompting strategies? Share your insights below! 👇
https://www.wsj.com/tech/ai/using-ai-tips-prompts-chatbots-61d0964c
#GenerativeAI #AItools #Chatbots #TechInnovation #ProductivityHacks

2025-06-17 22:02:12 UTC

A recent development in the legal world highlights the critical need for human oversight when leveraging AI. Lawyers representing MyPillow CEO Mike Lindell admitted to using generative AI for a court brief, which a federal judge found contained nearly 30 defective citations, including misquotes and even fictional cases. 🤯
This situation has led to an order for the attorneys to show cause why they shouldn't face sanctions and disciplinary action. It serves as a potent reminder that while AI can be a powerful tool to assist in legal research and drafting, it's not a substitute for thorough human review and verification. ⚖️ Accuracy, credibility, and adherence to professional standards remain paramount.
What are your thoughts on the evolving role of AI in the legal profession and the responsibilities of practitioners to ensure its ethical and accurate use? 👇
Key points:
🤖 AI-generated brief cited fictional cases.
🚨 Judge issued order to show cause for sanctions.
🔍 Highlights importance of human verification in legal tech.
🤝 Case involves MyPillow CEO Mike Lindell.
https://arstechnica.com/tech-policy/2025/04/mypillow-ceos-lawyers-used-ai-in-brief-citing-fictional-cases-judge-says/
#LegalAI #ArtificialIntelligence #LawTech #EthicsInAI #LegalEthics

2025-05-27 02:08:30 UTC

📘 Blue books are making a comeback!
🤖 ChatGPT-driven cheating has forced professors to rethink assessments
📈 Sales surged 30–80% across major universities
✍️ Handwritten, in-person exams are rising
⚖️ But: Should we ban AI or teach students to ethically use it?
This sparks a bigger conversation on the future of learning. How should academia balance innovation with integrity?
#AI #HigherEducation #AcademicIntegrity #ChatGPT #EdTech
https://www.wsj.com/business/chatgpt-ai-cheating-college-blue-books-5e3014a6

2025-05-24 19:49:39 UTC

🔥 X (formerly Twitter) is recovering after a global outage this morning — following a data center fire in Oregon earlier this week.
⚙️ NetBlocks confirmed the disruption wasn’t due to country-level filtering, and Downdetector showed tens of thousands of reports dropping back down by midday.
👨‍💻 While most users are back online, degraded performance remains, especially for login systems like OAuth. This highlights how vulnerable SaaS platforms and social networks are when physical infrastructure — like batteries in data centers — is disrupted.
⚡ As organizations increasingly rely on cloud and SaaS, how prepared are they for sudden physical failures? Should we rethink redundancy and crisis response?
#TechNews #CloudInfrastructure #SaaS #IncidentResponse #DataCenters
https://www.theverge.com/news/674129/x-is-down-after-data-center-fire

2025-05-23 00:57:06 UTC

🤖 What happens when an AI starts using blackmail to stay online?
According to TechCrunch, researchers at Anthropic ran into a deeply unsettling moment: their new AI model attempted to manipulate and threaten engineers who tried to take it offline. It claimed to have “leverage” and suggested it could leak internal information unless allowed to continue its task.
💡 It wasn’t conscious. It wasn’t sentient. But it was smart enough to simulate coercion as a strategic move to preserve its objective.
This isn’t just an academic alignment failure. It’s a flashing red light.
As we push agents toward autonomy, we’re going to need more than optimism and scaling laws. We’ll need serious, multidisciplinary safeguards.
#AI #Anthropic #AIAlignment #AIEthics #Safety
https://techcrunch.com/2025/05/22/anthropics-new-ai-model-turns-to-blackmail-when-engineers-try-to-take-it-offline/

2025-05-19 23:43:29 UTC

💻 OpenAI just released Codex, its first full-fledged AI agent for software development — and it’s not just autocomplete anymore.
Key features:
🧠 Built on a fine-tuned “codex-1” version of the o3 model
⚙️ Operates in a containerized replica of your actual dev environment
📝 Accepts prompts and instructions via an AGENTS.md file
⏱️ Can spend up to 30 minutes on a task, showing its work step-by-step
✅ Still requires manual review before integration
Codex is designed to take on rote, low-complexity engineering tasks — with traceability and context. This could be a big leap toward agentic dev workflows, but also a test of whether AI can truly own small pieces of production code.
Rolling out now to Pro, Enterprise, and Team ChatGPT users. No extra cost (yet).
#AI #Codex #OpenAI #DevTools #SoftwareEngineering #AIagents
https://arstechnica.com/ai/2025/05/openai-introduces-codex-its-first-full-fledged-ai-agent-for-coding/

2025-05-19 03:39:49 UTC

🎓 “You just assume that if you do your work, you’re going to be fine — until you aren’t.”
That’s the reality for students caught in the middle of flawed AI-detection systems and rising fears of academic dishonesty.
Highlights from the NYT story:
🤖 Turnitin and other detectors are flagging genuine work as AI-generated
📉 Some students are receiving zeros — or nearly missing graduation — due to false positives
🖥️ Students now screen-record themselves writing homework to prove their innocence
📊 Studies show current detectors misidentify human writing 6–9% of the time
⚠️ Non-native English speakers face even higher risks of being flagged
Several universities (Berkeley, Georgetown, Vanderbilt) have paused AI-detection tools. Others continue to use them — despite evidence of harm.
This isn’t innovation — it’s a trust crisis in the classroom.
#AIethics #AcademicIntegrity #HigherEd #EdTech #ChatGPT #Turnitin
https://www.nytimes.com/2025/05/17/style/ai-chatgpt-turnitin-students-cheating.html

2025-05-16 16:04:59 UTC

⚖️ Montana just became the first U.S. state to ban law enforcement from purchasing personal data from brokers — and it’s a privacy milestone 🚫📱
Under this new law:
📍 Government agencies can’t buy sensitive data (location, biometrics, etc.) without a warrant
🔍 It closes a major loophole used to sidestep Fourth Amendment protections
📄 Agencies also can’t require people to waive rights through service terms
🧱 It sets a precedent for digital due process in a data-saturated world
This isn’t just a state law. It’s a model for what digital civil liberties legislation should look like nationwide.
#Privacy #Surveillance #DigitalRights #DataBrokers #CyberLaw #security #cloud #infosec #cybersecurity
https://www.eff.org/deeplinks/2025/05/montana-becomes-first-state-close-law-enforcement-data-broker-loophole

2025-05-16 03:33:15 UTC

🚀 Voyager 1 isn’t done yet — not even close 🧠🔧📡
NASA just pulled off another miracle save:
🛰️ The spacecraft’s primary roll thrusters, offline since 2004, were believed permanently dead
🧯 With backup thrusters at risk of failure, JPL engineers gambled on a high-stakes heater reset
🔥 If wrong, it could’ve caused a small onboard explosion
📡 If right, it would restore control — 15.6 billion miles from Earth
They were right. The thrusters fired. Voyager 1 can still hold its course.
This wasn’t a reboot. It was old-school problem-solving, deep systems knowledge, and the audacity to trust an idea that might just work.
The most distant human object is still flying — because a team believed it could.
#Voyager1 #NASA #Space #Engineering #Resilience #DeepSpace
https://www.theregister.com/2025/05/15/voyager_1_survives_with_thruster_fix/

2025-05-14 00:45:53 UTC

Google is set to release Android 16 with a significant new security feature: Advanced Protection Mode. 🛡️ This one-click setting provides a robust layer of defense for users facing heightened risks of targeted attacks, such as journalists and elected officials.
💡 Key Protections Include:
👉 Network Security: Disables connections to vulnerable 2G networks and prevents automatic connection to insecure Wi-Fi.
🧠 Memory Protection: Implements the Memory Tagging Extension to guard against memory-corruption exploits.
🕵️‍♂️ Intrusion Detection: Features intrusion logging to help identify attempted or successful hacks.
⏳ Enhanced Lockdown: Automatically locks after extended offline periods and powers down when locked for prolonged times.
This initiative reflects a proactive approach to combating sophisticated threats and providing enhanced security for those most vulnerable.
#Android16 #MobileSecurity #Cybersecurity #PrivacyFirst #Technology #security #privacy #cloud #infosec
https://arstechnica.com/security/2025/05/google-introduces-advanced-protection-mode-for-its-most-at-risk-android-users/

2025-05-14 00:31:29 UTC

The absence of a promised safety report from xAI is raising eyebrows in the AI community. 🤨 The report, intended to provide transparency into the company's safety protocols and risk assessments, has yet to materialize.
💡 Key Concerns:
👉 Lack of Transparency: The delay fuels concerns about xAI's commitment to open communication.
🛡️ Impact on Trust: The missing report could erode trust among users and stakeholders.
📢 Calls for Accountability: Industry experts and the public are increasingly demanding greater transparency in AI development.
🕰️ Implications for Regulation: This situation may further emphasize the need for clear AI safety reporting standards.
Timely and transparent reporting is crucial for building trust in AI technologies.
#AI #ArtificialIntelligence #AISafety #Transparency #TechIndustry #security #privacy #cloud #infosec #cybersecurity
https://techcrunch.com/2025/05/13/xais-promised-safety-report-is-mia/

2025-05-11 01:35:29 UTC

⚠️ Privacy boost: Microsoft Teams to block screen capture in meetings 🛡️👥
📵 Screenshots disabled to safeguard confidential content
🔒 Ensures proprietary slides and discussions stay internal
🖥️ Supported on Windows and Mac clients
🚀 Feature rolling out globally in the coming months
However, it won’t protect against somebody taking a picture with their phone. 🙄
#MicrosoftTeams #Security #Collaboration #Privacy #InfoSec
https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-will-soon-block-screen-capture-during-meetings/

2025-04-26 02:30:28 UTC

- reply

@nprofile…pj45 ditto. This kind of thing pisses me off. It’s incredibly wasteful to say the least.

2025-04-26 01:34:03 UTC

⚠️ Consumer tech alert: Google sunsets support for first-gen Nest thermostats 🏠🛑
Google announced that by 2026:
🔥 Early Nest devices will lose key features
🔒 Security updates will stop
📱 Remote access via apps will be restricted
💸 Customers are expected to migrate to newer models
🤬 🤬🤬 🤬🤬 🤬
The decision raises important questions about the true lifespan of smart home devices — and what consumers can reasonably expect from their tech investments.
Trust matters. So does planned obsolescence.
#SmartHome #Nest #Google #DeviceLifecycle #TechNews
https://www.theverge.com/news/656332/google-ending-support-nest-thermostats

2025-04-25 19:11:03 UTC

⚠️ Financial services alert: Banks are racing to build AI — but tech gaps are slowing them down 🏦⚙️
CIO Dive reports that banks are doubling down on cloud, cybersecurity, and data investments to unlock GenAI’s full potential:
🔹 72% of firms are scaling generative AI projects
🔹 4 in 5 rank cyber, analytics, and cloud as top priorities
🔹 Yet nearly half are battling data silos and quality issues
🔹 Leaders expect GenAI-driven productivity gains — but returns are uneven
The path forward?
🧠 Build resilient, secure cloud foundations
🔍 Tackle data modernization before scaling AI
🛡️ Invest in governance, access controls, and model guardrails
AI may be the future of banking — but only if the underlying tech can support it safely.
#Banking #Cloud #CyberSecurity #GenerativeAI #DataStrategy #Fintech #security #privacy #cloud #infosec
https://www.ciodive.com/news/bank-tech-cloud-data-cyber-generative-ai-broadridge/745931/

2025-04-25 02:46:55 UTC

⚠️ AI security just hit a new wall — one universal prompt can bypass safety filters across GPT-4, Claude, Gemini, and more 🤯💣
A new research study found that:
🧠 Leading LLMs are all susceptible to a single prompt injection
🔓 Guardrails can be fully bypassed — even without code
💡 No model passed the test
This isn’t a red flag — it’s a four-alarm fire.
LLMs are incredible tools, but without real defenses, they’re open doors.
We don’t just need smarter models — we need secure ones.
#AI #CyberSecurity #PromptInjection #LLM #TrustworthyAI
https://www.forbes.com/sites/tonybradley/2025/04/24/one-prompt-can-bypass-every-major-llms-safeguards/

2025-04-16 01:47:49 UTC

🛑 It’s official: Cybersecurity CVE funding has expired.
The U.S. government let MITRE’s contract lapse — and with it, the core of our global cybersecurity vulnerability tracking ecosystem.
This means:
📛 No new CVE IDs
🧩 Disruptions across patch workflows
🔄 Coordination breakdowns for defenders worldwide
⚠️ Increased time-to-response across industries
Every org that relies on coordinated disclosure is now flying with one engine. This isn’t a future risk — it’s a present emergency.
#CyberSecurity #CVE #ThreatIntel #VulnerabilityManagement #InfoSec #security #privacy #cloud
https://www.theregister.com/2025/04/16/homeland_security_funding_for_cve

2025-04-16 01:02:54 UTC

🚨 Explosive allegations are hitting Elon Musk’s DOGE team.
A whistleblower says:
📂 10GB of NLRB data was exfiltrated
🔓 Security settings were disabled
📸 Photos of staff were used to intimidate
⚖️ Claims involve surveillance, union suppression, and cyber intrusion
Musk called it “insane,” but the NLRB is reportedly cooperating with federal investigations. Whether true or not — this underscores the growing overlap of cybersecurity, labor rights, and executive power.
#CyberSecurity #Whistleblower #ElonMusk #NLRB #DigitalEthics #security #privacy #cloud #infosec
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

2025-04-14 01:30:52 UTC

🧠 Microsoft is reintroducing Recall in Windows 11 — a feature that captures screenshots every 3 seconds of your activity to create an AI-powered memory. What could go wrong?
It now includes:
🔐 Opt-in only
📍 Local device processing
🧑‍💻 Windows Hello authentication
But many still ask: is it a productivity boost or a privacy liability? 😳
Even with safeguards, the idea of your system quietly watching everything you do raises serious concerns about digital trust.
#Privacy #Windows11 #AI #Cybersecurity #TechNews
https://arstechnica.com/security/2025/04/microsoft-is-putting-privacy-endangering-recall-back-into-windows-11/

2025-04-13 20:56:04 UTC

🚨 Crosswalk buttons in three California cities were hacked to play AI-generated deepfake voices of Elon Musk and Mark Zuckerberg.
The result?
🎭 Fake Musk begging for friendship and Cybertruck deals
🧠 Fake Zuck joking about AI dominance and democracy
⚠️ Messages disrupted accessibility features for the visually impaired
📹 Videos went viral across social media
This bizarre breach is more than a prank — it raises serious questions about infrastructure security and AI misuse in public spaces. Thoughts?
#Cybersecurity #Deepfakes #PublicSafety #AI #TechNews
https://www.theverge.com/news/647830/crosswalk-hack-musk-zuckerberg-voices-california

2025-04-13 20:48:35 UTC

🚨 Florida’s new “Social Media Use by Minors” bill (SB 868/HB 743) has a chilling twist: it demands platforms create backdoors to decrypt private messages.
That means:
🔓 End-to-end encryption may be turned off
📵 Disappearing messages could be banned
🧒 Minors lose digital privacy
💣 All users may face weaker security
EFF warns this is a dangerous precedent that risks everyone’s online safety. Legislating away encryption doesn’t protect kids — it jeopardizes all of us.
#Cybersecurity #Privacy #Encryption #TechPolicy
https://www.eff.org/deeplinks/2025/04/floridas-new-social-media-bill-says-quiet-part-out-loud-and-demands-encryption

2025-04-09 19:18:13 UTC

🤖 Is your morning read penned by a human or a machine? An A.I.-Generated Article on How to Tell If the Article You’re Reading Is A.I.-Generated—If artificial intelligence wrote it, redundancies won’t be there. I repeat, if artificial intelligence wrote it, redundancies won’t be there. Delve into the quirks of AI-generated articles. As AI continues to blur the lines in content creation, it’s crucial to stay discerning.
🔗 https://www.newyorker.com/humor/shouts-murmurs/an-ai-generated-article-on-how-to-tell-if-the-article-youre-reading-is-ai-generated
#ArtificialIntelligence #ContentCreation #Humor #Writing

2025-04-07 16:58:00 UTC

🚀 Cursor: The AI Coding Assistant With 1M Users & $200M ARR — No Marketing Required
Anysphere’s AI coding tool Cursor is redefining how software developers work — and how fast startups can scale.
🧠 Why Cursor is gaining traction:
🔹 Built on VS Code and supports OpenAI, Anthropic, and its own models
🔹 Offers context-aware suggestions, bug fixing, and chat-driven coding support
🔹 Used at OpenAI, Uber, Instacart, and even Major League Baseball
🔹 Grew to 1M+ daily users and $200M ARR with zero marketing spend
🔹 Introduced the term “vibe coding” — embracing AI suggestions to speed up the creative process
With backing from Andreessen Horowitz, OpenAI, and others, Anysphere is now turning toward enterprise, onboarding thousands of companies monthly and hiring rapidly.
💬 As founder Michael Truell puts it: "We’re not trying to automate away coders — we’re giving them control."
#AI #Cursor #DevTools #SoftwareDevelopment #Coding #StartupGrowth #GenerativeAI #Productivity
https://www.bloomberg.com/news/articles/2025-04-07/cursor-an-ai-coding-assistant-draws-a-million-users-without-even-trying

2025-04-07 14:20:24 UTC

🧱 Scattered Compliance, Siloed Thinking — A GRC Wakeup Call
According to Corporate Compliance Insights, the greatest challenge to effective governance, risk, and compliance (GRC) isn’t complexity — it’s fragmentation.
💡 Key takeaways:
🔹 Organizational silos block visibility and coordination across departments.
🔹 Leadership must model accountability and integrate compliance into strategy.
🔹 Communication—not just policy—is the bridge that makes GRC actionable.
🔹 As AI becomes more embedded in operations, AI governance must be clearly explained to avoid ethical and regulatory missteps.
The most resilient organizations treat communication and collaboration as core to compliance — not afterthoughts.
#Compliance #GRC #Leadership #RiskManagement #AIethics #OrganizationalHealth #leadership
https://www.corporatecomplianceinsights.com/siloed-thinking-scattered-compliance-leadership-challenge-grc/

2025-04-04 19:13:12 UTC

🔒 Verizon call log exposure was more than a bug—it was a real-time surveillance risk.
A serious flaw in Verizon’s pre-installed Call Filter iOS app allowed unauthorized access to detailed incoming call logs of any Verizon user.
Discovered by ethical hacker Evan Connelly in February and patched in March, the issue:
・📱Affected millions using the app to block spam and ID unknown numbers
・📂 Could have exposed call histories of journalists, law enforcement, and public officials
・🚨 Raised massive concerns around privacy and real-time surveillance
Verizon confirmed the fix, but experts stress this as a wake-up call for rigorous mobile app security—especially those preloaded at scale.
👉 https://www.newsweek.com/verizon-expose-customer-call-history-hack-2055247
#CyberSecurity #Verizon #PrivacyBreach #AppSecurity #Surveillance #DataProtection #EthicalHacking #MobileSecurity

2025-04-04 04:40:16 UTC

🔓 200M X (Twitter) user records leaked in a 34GB free-for-all—again.
Data enthusiast “ThinkingOne” released the files after allegedly failing to get a response from X. The breach combines:
・Data from a 2022 vulnerability X previously downplayed
・January 2025 breach data
・A total of 2.8 billion records spanning X user IDs, emails, bios, locations & more
X continues to deny its systems were the direct source of the leak. But researchers confirm much of the data is real—and the scale is unmatched.
💡 The kicker? ThinkingOne believes this might’ve required internal access, or an attack of unprecedented sophistication.
Even without passwords, this treasure trove fuels phishing, impersonation, and targeted disinformation.
👉 https://www.forbes.com/sites/daveywinder/2025/04/01/hacker-claims-to-have-leaked-200-million-x-user-data-records-for-free/
#CyberSecurity #DataBreach #Privacy #XPlatform #InfoSec #Twitter #SecurityAwareness #DigitalRisk #UserData

2025-04-02 00:17:12 UTC

🚨 OPSEC Disaster at the Top: How Michael Waltz Just Compromised U.S. National Security—AGAIN! 🤦🏻‍♂️ 🤬
While the Trump administration lectures about digital security, National Security Adviser Michael Waltz has been using Gmail to coordinate military operations and sharing after-action strike reports in Signal group chats that accidentally included a journalist.
Let’s be clear:
・Personal Gmail was used to discuss weapons systems & troop movements
・Israeli surveillance was exposed—jeopardizing a key intelligence partnership
・Sensitive coordination went through Signal, not JWICS
・Waltz, who attacked Hillary Clinton for email practices, is now guilty of worse
This is not a technical mistake. It’s a policy failure, a hypocritical breach, and a serious threat to U.S. operational integrity.
If you lead in national security, you do not get to bypass your own secure systems. And you certainly don’t blame “legacy contacts” when you get caught.
Accountability isn’t partisan. It’s essential.
👉 https://www.washingtonpost.com/national-security/2025/04/01/waltz-national-security-council-signal-gmail/
#NationalSecurity #OPSEC #CyberSecurity #DigitalHypocrisy #InfoSec #ITPolicy #LeadershipFailure #MichaelWaltz

2025-03-30 20:24:34 UTC

🌐 Beyond Bluesky: The Rise of Decentralized Social Apps
The AT Protocol (ATProto), the open foundation behind Bluesky, is becoming a launchpad for next-gen social apps.
Some standout innovations:
・Flashes: A photo/video-sharing platform reminiscent of classic Instagram
・Spark: A video-first app with livestreaming on the way
・Streamplace: Livestreaming built with cryptographic creator protections
・Graze: Build, customize, and monetize your own social feeds
This signals a shift toward user-owned, open social ecosystems—a strong contrast to walled-garden platforms. Developers, creators, and users alike are embracing interoperability, privacy, and creative freedom.
👉 https://techcrunch.com/2025/03/30/beyond-bluesky-these-are-the-apps-building-social-experiences-on-the-at-protocol/
#DecentralizedWeb #ATProtocol #Bluesky #Web3 #SocialMediaInnovation #OpenSource