2026-03-29T21:49:57Z https://nostr.now Nethemba https://nostr.now/npub13yxp2xmwcsd28gnknpkdw4uhmf9sjvmz4vpts4lp0x929fc5va8qels5ku https://cdn.nostrcheck.me/f4f1f341001ae518bd18bfa7c2a33e2ce618dfb3aa969dd88f284ed0aea40730.webp https://cdn.nostrcheck.me/f4f1f341001ae518bd18bfa7c2a33e2ce618dfb3aa969dd88f284ed0aea40730.webp https://nostr.now/nevent1qqsdnu9ep68edw8d3pzfe52gsazq8rxwj25gw3zw2q9hnzxees9m6rczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uhfun0j eMudhra Intermediate CA Compromise<br/>The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.<br/><a href="https://emudhra.we-have-a-problem.com/">https://emudhra.we-have-a-problem.com/</a> 2026-10-30T01:00:00Z https://nostr.now/nevent1qqsvx77pv8p48nx300y48aksgdky2xr3xjkwhcfqwdmg4eqxymau38gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ukqaed7 A coding-agent skill that turns your agent into a security auditor. It orchestrates isolated agents through reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting.<br/><a href="https://github.com/cloudflare/security-audit-skill">https://github.com/cloudflare/security-audit-skill</a> 2026-10-29T01:00:01Z https://nostr.now/nevent1qqspe37tkej3jgquv9kl8vq3dqyfdgwxjwv9j6nnxqxv83fwy2femfqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uy2uspc The Internet goes on high alert after discovery of 8 compromised TLS certs<br/>Intermediate certs allow anyone to mint web credentials for any Internet server. <br/><a href="https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/">https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/</a> 2026-10-28T15:20:00Z https://nostr.now/nevent1qqsr3x57uz6gs3qq4lge0z6ywl3duw549js30pl9djuszz26y50qd0gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uj6hh6g Perhaps not entirely obvious: If you want to withstand current AI-driven attacks and ensure that vulnerabilities discovered by AI are patched as quickly as possible, the only effective defense is to use AI. 2026-10-28T02:04:42Z https://nostr.now/nevent1qqs2hxxkdyzl3s7urdfj8wsnxflc6l9d5mxvvwtjs49nsq86pgmllwszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u8pvhlm Uruguay to the moon:<br/><br/>Next available dates at immigration:<br/>April 2027 2026-10-27T15:20:01Z https://nostr.now/nevent1qqs07tvejlk27fyn44qwlufkjfn7raumpcwfwzvnzx2a2fgux5fte7gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uw5z45l Big surprise: Some Ray-Ban Meta owners say their glasses are listening without being asked (Updated)<br/>Owners say ordinary conversations are unexpectedly appearing in Meta AI history.<br/><a href="https://www.androidauthority.com/ray-ban-meta-glasses-listening-3722586/">https://www.androidauthority.com/ray-ban-meta-glasses-listening-3722586/</a> 2026-10-27T01:00:03Z https://nostr.now/nevent1qqsx9ewf4crtslqcpkg5uwszshe7mve30m6r8tjp0s8phlhlcsvczwgzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uv6jglh Anonymous VPS<br/>in Switzerland and Panama<br/>Linux &amp; Windows VPS with NVMe SSD and 1 Gbps unmetered. No KYC, no logs, DMCA ignored. Pay with crypto. Live in 60 seconds.<br/><a href="https://www.swiss-gs.com/">https://www.swiss-gs.com/</a> 2026-10-26T15:20:00Z https://nostr.now/nevent1qqsrcuuxr6d0v7yr8ugyn5zlzcvygaenvwajckjga2ge4akaeyrfhxgzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5utz2wp0 Slovak security firm Nethemba discovered the campaign on three of its own WordPress sites in the early hours of 19 October and published the first analysis the same day.<br/><a href="https://www.cyberkendra.com/2026/10/updraftcentral-stolen-keys-wordpress-backdoor.html">https://www.cyberkendra.com/2026/10/updraftcentral-stolen-keys-wordpress-backdoor.html</a> 2026-10-26T01:00:00Z https://nostr.now/nevent1qqsdrrq8setzgsfrn9cy4rssdeg2yr6s03nujw57ddffw32nqqjarkszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uededgs Security firm Nethemba was first to publish a detailed analysis of the campaign on Monday, after an attacker pushed unknown plugins to two of its own websites. Nethemba CEO Pavol Lupták said the attacker had signed the commands with valid keys that had never been stored on the firm’s servers.<br/><a href="https://www.therepository.email/attacker-uses-stolen-updraftcentral-keys-to-backdoor-wordpress-sites-after-teamupdraft-breach">https://www.therepository.email/attacker-uses-stolen-updraftcentral-keys-to-backdoor-wordpress-sites-after-teamupdraft-breach</a> 2026-10-25T20:10:01Z https://nostr.now/nevent1qqsfqdq6qnxz80vn6ucncekkjf9w9vxlvz25ss4vth8rs3q807wrt9czyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uhtquqj Exposing AdFection<br/>How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware<br/><a href="https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/">https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/</a> 2026-10-23T01:00:01Z https://nostr.now/nevent1qqs8s7lg2gsxrug5all0wyqfxkm90s3fyghdsqy7w3zsm63zuu6dluczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ur4pnlx Max Hillebrand: Praxeológia súkromia<br/>Ekonomická logika v cypherpunkovej implementácii<br/><a href="https://towardsliberty.com/pop/sk/">https://towardsliberty.com/pop/sk/</a> 2026-10-22T20:10:01Z https://nostr.now/nevent1qqs9fqzf5qxgv5nkwg4znf8juwxr0rqccgsst4jj7jyszgtxtsd75agzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uysaerk Claude reveals ECDSA curve origins<br/><a href="https://www.anthropic.com/research/ecdsa-curve-origins">https://www.anthropic.com/research/ecdsa-curve-origins</a> 2026-10-22T15:20:01Z https://nostr.now/nevent1qqszkd3vdtwtkyh7eyqkq3rlz6hrrhjafetle8j234ptadcxgr5w0fqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ucpk0jk (Bind9) CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory <br/><a href="https://kb.isc.org/docs/cve-2026-94300">https://kb.isc.org/docs/cve-2026-94300</a> 2026-10-22T12:11:01Z https://nostr.now/nevent1qqsqlp6rhxcn9m7xa7ktm0t4u85vz2scyxcxpqsd90lqf98dkkfke9qzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uy5nlvp Snuffleupagus is a PHP7+ and PHP8+ module designed to drastically raise the cost of attacks against websites. This is achieved by killing entire bug classes and providing a powerful virtual-patching system, allowing the administrator to fix specific vulnerabilities without having to touch the PHP code.<br/><a href="https://snuffleupagus.readthedocs.io/">https://snuffleupagus.readthedocs.io/</a> 2026-10-21T14:18:53Z https://nostr.now/nevent1qqs9elyaru9cejp6ych7jaukwgsxnj849p86yrjafwumlfv40n2d5wqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uzknvel Switch off all your PHP websites NOW!<br/>Until you have the latest patch (which was not released yet)<br/><br/>The exploit <a href="https://jackalsyn.com/posts/php-up-2026.html">https://jackalsyn.com/posts/php-up-2026.html</a> 2026-10-21T12:17:08Z https://nostr.now/nevent1qqsv3eprk39l0auyjaelgkhqjamrnntza5dk47klg7yt8skdd8hr3fqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ujgeynq Open Source Intelligence (OSINT): Gathering Information on a WhatsApp Account<br/><a href="https://hackers-arise.com/open-source-intelligence-osint-gathering-information-on-a-whatsapp-account/">https://hackers-arise.com/open-source-intelligence-osint-gathering-information-on-a-whatsapp-account/</a> 2026-10-21T01:00:00Z https://nostr.now/nevent1qqsg8w298nj6at8f5kmehdsh66t3n80xkd4erqkkrx9h2nqcz4fd2xszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uvt9hvt The PHP security team would like to give advance notice of an upcoming security release.<br/>It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.<br/>It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.<br/>All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. <br/><a href="https://www.php.net/archive/2026.php#2026-10-20-1">https://www.php.net/archive/2026.php#2026-10-20-1</a> 2026-10-20T22:45:28Z https://nostr.now/nevent1qqs9lcqea5nk9wccvgxg06km46nkrmpph9qvtp65vlusmuk55dtwecszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ucl4ayu Privacy Tips from the Threema Team<br/><a href="https://threema.com/en/blog/privacy-tips-part-1">https://threema.com/en/blog/privacy-tips-part-1</a><br/><a href="https://threema.com/en/blog/privacy-tips-part-2">https://threema.com/en/blog/privacy-tips-part-2</a> 2026-10-20T20:10:00Z https://nostr.now/nevent1qqsprqts7gufj6935yh6ynpef6u0qsuw3c9gqwsar0l0xdhgts9739gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uslztpu An agentic AI red team checklist: 222 tests, WSTG-style<br/><a href="https://infosecravi.com/blog/agentic-ai-red-team-checklist/">https://infosecravi.com/blog/agentic-ai-red-team-checklist/</a> 2026-10-20T15:20:01Z https://nostr.now/nevent1qqsy800ymp4zh8520wr4xkvcmeyzxu03v6q52jaweqf3wmu8eyyvjaqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u2g9vg2 If you run WordPress with UpdraftPlus and your site is connected to UpdraftCentral, please delete the UpdraftCentral key today and check the site.<br/><br/>On the night of 19 October an attacker sent validly signed UpdraftCentral commands to three of our WordPress sites and installed a backdoor plugin on two of them. The sites were fully up to date, on UpdraftPlus 2.26.11, patched against the June vulnerability CVE-2026-10795. The attacker did not break into our servers. The commands were signed with the private dashboard keys that UpdraftCentral Cloud generates and keeps, keys that never existed on our side.<br/><br/>The backdoor waits for a secret link, then creates an account that looks like an ordinary Editor but can change every setting and install plugins, and logs the attacker straight in, bypassing the login form and two-factor authentication. A bug in its code made it crash our sites instead of working. A fixed version would take a few characters.<br/><br/>UpdraftPlus has more than 4 million active installations and every copy contains the UpdraftCentral client. Any site connected to UpdraftCentral is exposed, including the latest version. There is no fix yet.<br/><br/>What to do now:<br/>• delete the key in UpdraftPlus &gt; Advanced Tools &gt; UpdraftCentral<br/>• check the site with our free read-only WP-CLI script<br/>• do not reconnect until TeamUpdraft explains how the keys leaked<br/><br/>We reported it to TeamUpdraft the same day. Because the attack is active and publishing gives the attacker nothing new, we are publishing the analysis, indicators of compromise and the checker right away:<br/><a href="https://nethemba.com/updraftcentral-backdoor-analysis/">https://nethemba.com/updraftcentral-backdoor-analysis/</a><br/><br/>#WordPress #infosec #UpdraftPlus #cybersecurity 2026-10-19T06:09:32Z https://nostr.now/nevent1qqsyk4ywxa69hp9rlsplya9cfq88ymyvlzaj8fhehwzl3qltqm6372szyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u8r4xqj #89 Jarvis (HackTheBox) (Medium) How To Deal With Connection Issues... <br/>SQL injection (involving a WAF bypass) allows us to write a shell in the webserver root. We then abuse a custom python application to gain more rights as another user. Finally systemctl with SUID rights grants us root access after a period of losing my mind.<br/><br/><a href="https://www.youtube.com/watch?v=BoChqSyOi48">https://www.youtube.com/watch?v=BoChqSyOi48</a> 2026-10-19T01:00:01Z https://nostr.now/nevent1qqsvzkqsfz9smdq5ynwc6ugg33wtmsj4n8fq9f2l8plzf7l8vgpax9gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ux0zta5 Praxeológia súkromia: Ekonomická logika v cypherpunkovej implementácii<br/>Max Hillebrand · Slovenský preklad tretieho vydania<br/><a href="https://towardsliberty.com/pop/sk/">https://towardsliberty.com/pop/sk/</a> 2026-10-18T15:20:02Z https://nostr.now/nevent1qqspvjqlqfnxm8fhkwrrjdrvmynlhqftrkvy5uuuqklvmuy705xx06gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uz7evaa Agent skill for rigorous bug bounty report triage, validation, severity escalation, and submission-ready reporting.<br/><a href="https://github.com/Sequester-AG/bug-bounty-triage">https://github.com/Sequester-AG/bug-bounty-triage</a><br/><a href="https://x.com/Zaddyzaddy/status/2108649164615696874">https://x.com/Zaddyzaddy/status/2108649164615696874</a> 2026-10-15T20:10:00Z https://nostr.now/nevent1qqs224vwqt25xhtr0vnc7g57wwkapcxmnvycsslferetdj3wpgkpxjqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ug7h5zk How abliterated models can get you pwned<br/>Any open model whose weights have been edited can carry a backdoor, whether it&#39;s a task-specific fine-tune, a merged adapter or an abliterated build. <br/><a href="https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned">https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned</a> 2026-10-14T20:10:00Z https://nostr.now/nevent1qqsg69rw54ykkk42addymg8xlnnp52em5evhmdq7qwqu773czwh9l0qzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5umdwkfc During recent discussions about the security of decentralized inference through Routstr, people raised a valid concern: how can we be sure a provider doesn&#39;t read our prompts, or alter tool calls to backdoor the machine or the code it generates? Or how do we know the provider does not swap the model for a cheaper one and charge you full price? The usual answer is a TEE, a trusted execution environment. TEEs are hard to audit in practice. You trust the hardware vendor and re-verify a whole software stack after every update. We can do better, and now we do.<br/><br/>Routstr has a confidential mode. Your client talks TLS 1.3 directly to the upstream provider (Venice, for my node), and the Routstr node in between only relays encrypted records. Client and node compute the TLS keys together, so the node can add its API key without ever seeing your prompt or the answer, and it can&#39;t change a single byte of the response, tool calls included. Zero-knowledge proofs pin the model and the token cap, and you pay for the usage the provider itself reported. All of this rests on math and on the certificates you already trust, with no enclave or special hardware anywhere.<br/><br/>It works today on routstr.cypherpunk.today, through routstrd (I&#39;m running opencode agents on it) and right in the browser, where the page does every check itself. It&#39;s new and experimental, so please try it and tell me what breaks.<br/><br/>Blog: <a href="https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/">https://juraj.bednar.io/en/blog-en/2026/10/10/confidential-inference-on-routstr-without-trusted-hardware/</a><br/>Try it in the browser: <a href="https://jooray.github.io/routstr-confidential-pwa/">https://jooray.github.io/routstr-confidential-pwa/</a><br/>Paper: <a href="https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf">https://github.com/jooray/routstr-confidential/blob/HEAD/paper/paper.pdf</a><br/>Code: <a href="https://github.com/jooray/routstr-confidential">https://github.com/jooray/routstr-confidential</a> 2026-10-13T01:00:01Z https://nostr.now/nevent1qqs2rv6pkxrnjfsyc5aqxham0xhq0h0kxs589s6mpdaegc80g6yqz5szyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5udjs7ra Poľsko práve ukázalo, ako môže od januára vyzerať slovenská e-faktúra:<br/><br/>Fakturownia je poľský cloudový fakturačný softvér napojený na štátny KSeF a má vyše 600 tisíc firemných klientov. Je to presne ten typ firmy, akým sa od 1. 1. 2027 stáva každý slovenský „digitálny poštár“.<br/><br/>27. septembra o 3:20 ráno sa niekto dostal do ich systémov. Vyhodili ho až 28. Septembra o 17:45, teda po viac ako 38 hodinách. Odniesol si veľkú časť databázy: údaje firiem a používateľov, hashe hesiel, bankové účty, platobné údaje, session a API tokeny aj systémové kľúče. Podľa samotnej firmy sa únik v rôznej miere týka každého účtu.<br/><br/>A teraz Slovensko. V Poľsku bol takýto sprostredkovateľ aspoň voliteľný; firma mohla ísť do KSeF aj priamo. U nás bude súkromný poštár zo zákona stáť v ceste každej B2B faktúre. Týka sa to 530 726 subjektov a zhruba päťdesiatky firiem, ktoré uvidia kompletné obchodné vzťahy celej krajiny.<br/><br/>Poštári nemajú zákonnú povinnosť mlčanlivosti, zákaz používať dáta na vlastné účely ani limit, ako dlho ich môžu držať. NBÚ pre nich v pripomienkovom konaní žiadal bezpečnostné štandardy a ministerstvo to zamietlo. SIS si pre seba vybavila výnimku, lebo systém sama považuje za neprimerané bezpečnostné riziko. Vy výnimku nemáte. A ešte si za to zaplatíte.<br/><br/>Otázka nie je, či niektorého slovenského poštára hacknú. Otázka je, ktorého prvého.<br/><br/>V Nethembe sme pred dvoma mesiacmi napísali, že pre priemyselnú špionáž a ransomware je to najlukratívnejší cieľ, aký kedy na Slovensku vznikol. Poľsko to práve potvrdilo.<br/>🇵🇱 <a href="https://www.money.pl/biznes/wyciek-danych-klientow-duzej-firmy-od-faktur-ma-ponad-600-tys-klientow-7334707825813728a.html">https://www.money.pl/biznes/wyciek-danych-klientow-duzej-firmy-od-faktur-ma-ponad-600-tys-klientow-7334707825813728a.html</a><br/>🇵🇱 <a href="https://www.telepolis.pl/wiadomosci/fakturownia-wyciek-danych">https://www.telepolis.pl/wiadomosci/fakturownia-wyciek-danych</a><br/>Proti e-faktúre: <a href="https://nethemba.com/sk/proti-e-fakture-firemny-stockholmsky-syndrom/">https://nethemba.com/sk/proti-e-fakture-firemny-stockholmsky-syndrom/</a> 2026-10-12T20:10:01Z https://nostr.now/nevent1qqs9ktk9unhw3ccp3d5vh99ahn8etux4m6cynw4p5wgu834l8qsyfcczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ugzejll Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance<br/><a href="https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/">https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/</a><br/><br/>ARTEX - AI autonomous pentest system, English UI build (upstream: Autumn-27/ARTEX)<br/><a href="https://github.com/jfreemansh/Art">https://github.com/jfreemansh/Art</a>... 2026-10-08T20:10:01Z https://nostr.now/nevent1qqs8qmjnl0c7nnjfgrgqd4pa0usglc2mqsr90k66t8wtc8f2pptvj2qzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u7p0nu7 6 ways Advanced Protection on Android keeps you safe<br/><a href="https://blog.google/security/android-advanced-protection-updates/">https://blog.google/security/android-advanced-protection-updates/</a> 2026-10-05T20:10:01Z https://nostr.now/nevent1qqs8y255jvase043jyuw5rjuf6dt0uzq2upfrzgl4kcslvcy2f2y8nczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u33csry Bezpečnost v éře AI: Průlet zajímavými událostmi (Vašek Šraier, Standa Lukeš) <br/><a href="https://www.youtube.com/watch?v=1Sm54_ewMOg">https://www.youtube.com/watch?v=1Sm54_ewMOg</a> 2026-10-05T01:00:02Z https://nostr.now/nevent1qqszkpek644fvm5alefhvhvlz247r60tfdw9zcjpwegkpf5am2rx0jqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uwc5ums German Police Are Using Linked Devices to Read Messages from Messaging Apps Without Cracking the Encryption<br/><a href="https://www.privacyguides.org/news/2026/09/30/german-police-are-using-linked-devices-to-read-signal-messages-without-cracking-the-encryption/">https://www.privacyguides.org/news/2026/09/30/german-police-are-using-linked-devices-to-read-signal-messages-without-cracking-the-encryption/</a> 2026-10-04T15:20:02Z https://nostr.now/nevent1qqstsknun9gh8wv5mkrrvl06wlwsjzvg70lssul7rsl59tv4maa08dqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u8xjcdn German Police Are Using Linked Devices to Read Messages from Messaging Apps Without Cracking the Encryption<br/><a href="https://www.privacyguides.org/news/2026/09/30/german-police-are-using-linked-devices-to-read-signal-messages-without-cracking-the-encryption/">https://www.privacyguides.org/news/2026/09/30/german-police-are-using-linked-devices-to-read-signal-messages-without-cracking-the-encryption/</a> 2026-10-02T20:10:00Z https://nostr.now/nevent1qqswvk2vdm2a5pzyzg83phm5n3kmezk3k88rvr2p4h0cz7numjach0qzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ux5ca8m Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims<br/><a href="https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/">https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/</a> 2026-10-01T20:10:01Z https://nostr.now/nevent1qqsfc484yyu5crj5a55etc7dfduar5m8d89g5zpej90fvt3spgdw32szyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u2np84a There’s a new way to break RSA that’s faster than anything we’ve seen before:<br/>Until now, cryptographers thought factoring was the only way to break RSA. Not anymore. <br/><a href="https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/">https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/</a> 2026-10-01T15:20:00Z https://nostr.now/nevent1qqsxcgthm6csvy98r7cyux7u007ttldmxmsx7kgcsvcj02ar96agqrqzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5umfn9kd What is the most private messenger? I ranked every messaging app!<br/><a href="https://m.youtube.com/watch?v=fkjY1usppkM">https://m.youtube.com/watch?v=fkjY1usppkM</a> 2026-10-01T01:00:00Z https://nostr.now/nevent1qqsydq7aygzzfwvwpwac9tr75z4drsxgy729dqsn0zxkem5z8894c6czyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u35rktc #88 Knife (HackTheBox) (Easy) Not So Sharp... <br/><br/>A backdoored PHP version allowing RCE gives us a shell on this system, after which it died multiple times. We eventually managed to run elevated ruby code via the knife application.<br/><a href="https://www.youtube.com/watch?v=Z7W4gvmCmdA">https://www.youtube.com/watch?v=Z7W4gvmCmdA</a> 2026-09-30T20:10:01Z https://nostr.now/nevent1qqszmfukcgez4hmg4wuwt97hhfl7dseucmlc5phqym0wuy5aqj9hhxczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u2880cc NYMChat Decentralized. Pseudonymous. Unstoppable.<br/>Ephemeral identities. Censorship-resistant. No registration, no accounts.<br/><a href="https://nymchat.app/">https://nymchat.app/</a> 2026-09-25T20:10:01Z https://nostr.now/nevent1qqsrqleuemd2dk4yx398gef203jpja26s92y2n34gsfacnq3gtmw7xszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u54fwdr Of course, the issue lies with an inadequately secured government website, not with (Open)AI.<br/><br/>Australia launches urgent review after OpenAI program hacks government health portal<br/><a href="https://www.bbc.com/news/live/cvgl73pxgndwt">https://www.bbc.com/news/live/cvgl73pxgndwt</a> 2026-09-25T01:00:01Z https://nostr.now/nevent1qqstffmxfg4tawsvqx3a06wa2umzqq9nzvuj5qpw6k2tnz9hdjs28sczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uahkjna A AI general-purpose state-space search engine, validated first on autonomous penetration testing.<br/><a href="https://github.com/oritera/Cairn">https://github.com/oritera/Cairn</a> 2026-09-24T01:00:00Z https://nostr.now/nevent1qqs8wkumg30x0rwwzazu54snd4jzcwpmxhag7r8qhg34gwqajk5827gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5umnyug0 ‘We Hacked the FBI:’ Hackers Say They Have Data on All FBI Employees<br/>A sample of 5,000 alleged agents seen by 404 Media includes names, addresses, phone numbers, and details on FBI employees&#39; spouses.<br/><a href="https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/">https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/</a> 2026-09-23T01:00:00Z https://nostr.now/nevent1qqsz4rqanhur88hmpkpgnfkdmhkwwk6c90qts30qdgx27g4tvcpxlmszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u52tlzw A teraz si predstavte, že postupne budú hackovať všetkých poskytovateľov e-Faktury a zverejňovať všetky informácie o ich klientoch. A dovolím si tvrdiť, že je to len otázka času.<br/><br/>Na internet unikli údaje Slovákov. Finančný sprostredkovateľ vysvetľuje, čo sa stalo<br/><a href="https://zive.aktuality.sk/clanok/SiL4gVE/na-internet-unikli-udaje-slovakov-financny-sprostredkovatel-vysvetluje-co-sa-stalo/">https://zive.aktuality.sk/clanok/SiL4gVE/na-internet-unikli-udaje-slovakov-financny-sprostredkovatel-vysvetluje-co-sa-stalo/</a> 2026-09-22T20:10:00Z https://nostr.now/nevent1qqsvd07w90r03aj73lhvpl86w47nmayy3j3um489pm7tcjw0r7yzn5czyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uzed2tn Introducing Aikido Altar: the model that makes sovereign security intelligence possible<br/><a href="https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security">https://www.aikido.dev/blog/aikido-altar-open-weight-ai-sovereign-security</a><br/><br/><a href="https://huggingface.co/AikidoSec/altar-1">https://huggingface.co/AikidoSec/altar-1</a> 2026-09-22T15:20:01Z https://nostr.now/nevent1qqs97mqggy2np2mm4rtswfu2zc5n9ctxeudr04ncz6y52hwgkwrfscgzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uzv4j27 Update all your WPs to 7.1.1!<br/><br/>Click2Shell: Preauth WordPress Core Theme Preview Injection to RCE Chain<br/><a href="https://pwn.ai/blog/click2shell">https://pwn.ai/blog/click2shell</a> 2026-09-21T17:47:22Z https://nostr.now/nevent1qqsdcx3c3su2lw3hxe33ag9tr3ymjuxuwdafekxzzfa4edktjachdnczyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5u08g4hr Ten AI models vs embargoed Core Lightning: A case study of AI for security auditing<br/><a href="https://juraj.bednar.io/en/blog-en/2026/09/18/ten-ai-models-vs-embargoed-core-lightning-a-case-study-of-ai-for-auditing/">https://juraj.bednar.io/en/blog-en/2026/09/18/ten-ai-models-vs-embargoed-core-lightning-a-case-study-of-ai-for-auditing/</a> 2026-09-18T20:10:01Z https://nostr.now/nevent1qqsggllkgqvfcp6sxsmmkrw23q3279xk8quu4t52x3fz94ef0pe30mszyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5ukppyrm I haven&#39;t tested it yet, but it looks interesting:<br/><br/>PrivacyNotes.app Review: One Phrase. One Encrypted Workspace.<br/><a href="https://cr1337.substack.com/p/privacynotesapp-review-one-phrase">https://cr1337.substack.com/p/privacynotesapp-review-one-phrase</a><br/><a href="https://privacynotes.app/">https://privacynotes.app/</a> 2026-09-17T20:10:00Z https://nostr.now/nevent1qqs8tf29yxvtl7jmwrm7a3n66lvd3lur7lkhm0vw5a6p7tevgegz77gzyzysc9gmdmzp4gazw6vxe46hjldykzfnv24s9wzhu9uc4g48z3n5uh23tqe #87 OpenAdmin (HackTheBox) (Easy) No Luck With c99.<br/>This time we find a vulnerable version of OpenNetAdmin and use this to upload a webshell. <br/>Once we find credentials for the database, we find they are reused for SSH. <br/>After abusing an internal application to give the SSH key of another user we gain root via a sudo misconfiguration.<br/><a href="https://www.youtube.com/watch?v=pr6xaO-ZF2o">https://www.youtube.com/watch?v=pr6xaO-ZF2o</a> 2026-09-16T20:10:00Z