Nostr notes by Kevin Beaumont

This thread summerised for normies ...

2026-10-28T15:32:27Z

In reply to nevent1q…fdmj
_________________________

This thread summerised for normies

Regarding the Danfoss fridge thing doing the rounds in the media ...

2026-10-12T19:06:47Z

Regarding the Danfoss fridge thing doing the rounds in the media - there’s several thousand of them that are directly internet facing.

The username is admin and the password changes every day automatically to.. the current date.

Every single one is like this. You can just log in and change the temperature. Anybody can do it, easily scriptable.

Thread update: Ahold Delhaize have been hit with ransomware ...

2026-10-12T12:13:10Z

In reply to nevent1q…faf9
_________________________

Thread update: Ahold Delhaize have been hit with ransomware again, they were last hit in 2024 https://newsroom.aholddelhaize.com/ahold-delhaize-takes-precautionary-measures-following-cybersecurity-incident/

If anybody is wondering what Simon AI is: https://www.simon.ai/

2026-10-08T14:54:00Z

In reply to nevent1q…l9ym
_________________________

If anybody is wondering what Simon AI is:

https://www.simon.ai/

ASOS are experiencing the exact same PR gaffs as Co-op and ...

2026-10-08T10:38:32Z

In reply to nevent1q…up2h
_________________________

ASOS are experiencing the exact same PR gaffs as Co-op and M&S by not being honest with customers. If you’re dealing with Advanced Persistent Teenagers you need much better crisis plans. https://www.bbc.co.uk/news/articles/c3zxjdw5ywgpo

I’ve said this many times - have a playbook for Advanced ...

2026-10-06T12:32:13Z

In reply to nevent1q…sj4m
_________________________

I’ve said this many times - have a playbook for Advanced Persistent Teenages, ransomware and extortion groups. Practice it.

It’s far more likely to need to be used than nation-state espionage playbooks - and those incidents are far more damaging if not well handled.

You need to flood the zone with messaging, put it on the front page of your website, be calm and upfront with customers. If you have 15 lawyers on a call debating legal risks, you’ll lose customer trust. Get the CEO on BBC News.

Very fun lessons for cyber incident response over the ASOS thing ...

2026-10-06T12:26:38Z

In reply to nevent1q…cnpu
_________________________

Very fun lessons for cyber incident response over the ASOS thing - the extortion groups push message has caused BBC News to clear the air waves for it, set up a dedicated YouTube stream for it, and the company has no media statement.

RE: https://cyberplace.social/@GossiTheDog/117393814293721056 Fun ...

2026-10-06T11:54:58Z

RE: https://cyberplace.social/@GossiTheDog/117393814293721056

Fun one - over half of the CVEs added to CISA KEV are over a year old, ie issued a year or more ago.

There’s this whole narrative around how GenAI will find zero day vulns and the apocalypse is coming. Slight issue - almost all incidents are caused by orgs not patching. Basically at all.

The cybersecurity industry never solved that.. and doesn’t even understand it is the case.

quoting
note14hp…hwr2

I still run firmware fingerprint scanning across the internet and regularly find US federal agencies that are over a year behind with updated on CISA KEV

I still run firmware fingerprint scanning across the internet and ...

2026-10-06T11:50:49Z

In reply to nevent1q…fzm9
_________________________

I still run firmware fingerprint scanning across the internet and regularly find US federal agencies that are over a year behind with updated on CISA KEV

https://www.bbc.co.uk/news/live/cjkg7205q9ret

2026-10-06T10:28:59Z

In reply to nevent1q…f0j0
_________________________

https://www.bbc.co.uk/news/live/cjkg7205q9ret

ASOS have a security incident, got a push notification from their ...

2026-10-06T09:59:56Z

ASOS have a security incident, got a push notification from their iOS App directing me to a Telegram channel.

I need @npub13vn…f849 to fact-check me here but I think ...

2026-10-05T10:14:31Z

In reply to nevent1q…f7jv
_________________________

I need watchTowr (npub13vn…f849) to fact-check me here but I think CVE-2026-88779 is a redux of CVE-2026-8452? At least based on this mitigation Citrix support are giving out, somebody posted it on their blog. https://www.deyda.net/index.php/de/2026/08/28/netscaler-cve-checkliste-updates-sicherheitspruefung-und-incident-response/

The 8452 patch locked SAML PrefixList to 512 byte or below string. But I think CVE-2026-8452 may be more than 15 items in PrefixList, space-separated, to trigger a vuln. Assuming Citrix support gave out the right mitigation.

The new Citrix Netscaler vuln from Friday is CVE-2026-88779, ...

2026-10-04T09:55:03Z

In reply to nevent1q…phrm
_________________________

The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

Although the vuln is labeled “Memory overflow vulnerability leading to Denial of Service”, that’s the same as CVE-2025–6543. You may remember that lead to RCE.

The Citrix support mitigations don’t appear to work, so admins ...

2026-10-03T01:40:24Z

In reply to nevent1q…hmwt
_________________________

The Citrix support mitigations don’t appear to work, so admins are firewall blocking known IPs of threat actors as a mitigation 😅

What a mess. Lots of people noting they can’t actually reach Citrix support as they’ve replaced people with AI chat bots.

https://pitscaler.com/ #PitScaler ...

2026-10-02T16:21:17Z

In reply to nevent1q…xhl8
_________________________

https://pitscaler.com/ #PitScaler

Well done to Microsoft for having two different mobile apps ...

2026-10-01T18:06:22Z

Well done to Microsoft for having two different mobile apps called Copilot which do different things.

Great IOCs on the follow up spray and pray activity on #PitScaler ...

2026-10-01T00:12:49Z

In reply to nevent1q…n2cq
_________________________

Great IOCs on the follow up spray and pray activity on #PitScaler so far.

For context this activity definitely is not related to the inital threat actor activity in early September. This is new stuff.

https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771

The Dutch government has shut down all Citrix Netscalers and is ...

2026-09-29T18:32:47Z

In reply to nevent1q…hs4a
_________________________

The Dutch government has shut down all Citrix Netscalers and is asking every gov org to perform incident response

HT [@bert_hubert](https://eupolicy.social/@bert_hubert )

https://berthub.eu/tkconv/document.html?nummer=2026D47262

#PitScaler

IR vendors have started sharing their #PitScaler write ups but ...

2026-09-29T16:12:45Z

In reply to nevent1q…dcwe
_________________________

IR vendors have started sharing their #PitScaler write ups but they’re sharing webshell names (.sig files) and attacker IPs - which are unique per victim, so it’s helping me map out the victim orgs via network traffic.

If they failed to remediate you can also then access with the webshell name. One also uploaded their IR investigation to VirusTotal.

#PitScaler is under mass exploitation, seeing it spray and pray ...

2026-09-29T04:39:21Z

In reply to nevent1q…38dk
_________________________

#PitScaler is under mass exploitation, seeing it spray and pray now.

I’ve done some firmware version scanning, fewer than 10% of boxes are patched as of an hour ago.

There are rumours swirling for the past week behind the scenes ...

2026-09-26T15:22:08Z

There are rumours swirling for the past week behind the scenes that there are two actively exploited zero days in Citrix Netscaler. The rumours have now broken containment to Reddit.

FWIW I’ve been trying to get Citrix to talk about it, they won’t.

If you use KiteWorks I suggest you temporarily remove internet ...

2026-09-25T11:58:48Z

If you use KiteWorks I suggest you temporarily remove internet access now. https://www.heise.de/en/news/Imminent-Zero-Day-Attack-KiteWorks-Urges-Customers-to-Shut-Down-Servers-11466375.html

BBC News has 4 YouTube videos up in the past day about OpenAI ...

2026-09-24T20:35:27Z

BBC News has 4 YouTube videos up in the past day about OpenAI hacking “governments”, with approaching a million views.

If you want to know the technical details of this elite frontier AI hacking - these are examples of the actual OpenAI agent requests.

It’s really dumb shit. The story here is OpenAI are utterly incompetent at cybersecurity, as are their victims.

Root cause analysis for the air traffic control outage in the UK ...

2026-09-18T20:02:50Z

Root cause analysis for the air traffic control outage in the UK has been published, for anybody interested.

Nothing to do with cybersecurity. It was just a software bug leading to data corruption for a single flight. https://www.nats.aero/news/nats-publishes-preliminary-report-on-technical-incident-of-8-september/

RE: https://cyberplace.social/@GossiTheDog/112479974357074203 ...

2026-09-06T07:51:32Z

In reply to nevent1q…983y
_________________________

RE: https://cyberplace.social/@GossiTheDog/112479974357074203

I'd love a tell all interview one day about what happened with this one, they somehow got the Microsoft CEO himself to unveil something that barely functions and hadn't been through proper securiy reviews to tier 0 outlets media.
nostr:note1r474mggawldmc7zc5h0jpyvdx3p7s2jg6xxf20fmwwumwlfvvkhsx5dw0s

Here's an example. Sometimes it stops saving screenshots ...

2026-09-06T07:49:20Z

In reply to nevent1q…7p55
_________________________

Here's an example. Sometimes it stops saving screenshots entirely. It doesn't tell you this, the systray icon just changes. When you investigate it says this... assuming a user knows what updating models means. You have to go and fix it yourself.

I don't know what the deal is with Microsoft Recall, but ...

2026-09-06T07:42:09Z

I don't know what the deal is with Microsoft Recall, but usage wise it appears to have fallen apart over the last year.

I still have it enabled on multiple systems from the security testing a few years ago, and it's gone from having a range of UI issues (e.g. being unusable due to having tutorial video get stuck, database needing reinitialising etc) to getting stuck in Windows Hello loops and UI issues.

It was supposed to be the flagship feature of Copilot+ PCs but it's barely functional.

For anybody the media covering the privacy beat, you might want ...

2026-08-23T22:01:52Z

For anybody the media covering the privacy beat, you might want to have a look at the Take2 court orders to Microsoft over the Grand Theft Auto 6 leaks. There’s a big story.

I’ll give you some hints - MachineGuid and MSA device identifiers.

I regret to inform you Elon Musk has made a 6 minute AI video of ...

2026-08-14T21:04:59Z

I regret to inform you Elon Musk has made a 6 minute AI video of himself as a superhero and it’s the cringiest shit I’ve ever seen.

Sense check for people working in cybersecurity in operations ...

2026-07-29T16:16:35Z

Sense check for people working in cybersecurity in operations roles in the trenches:

I’m not finding or seeing cyber incidents off the back of Generative AI still. Are you? Not ones you’ve read about online - I mean ones you’ve actually dealt with.

For anybody tracking the Microsoft outages... Azure West US is ...

2026-07-23T16:59:33Z

In reply to nevent1q…waaj
_________________________

For anybody tracking the Microsoft outages... Azure West US is the cause:

Starting at 14:44 UTC on 23 July, 2026, we began investigating a networking issue affecting connectivity to Azure services in the West US region. Impacted customers may be experiencing intermittent connectivity failures, increased latency, or difficulty accessing Azure services. Customers with traffic traversing the West US region may also experience downstream impact.

Microsoft 365 aka Microsoft Copilot aka Office 365 has jumped off ...

2026-07-23T15:46:49Z

Microsoft 365 aka Microsoft Copilot aka Office 365 has jumped off a cliff.

Good. Andy Burnham to scrap digital ID to focus on cost of living ...

2026-07-18T22:19:52Z

Good. Andy Burnham to scrap digital ID to focus on cost of living in first major policy pledge https://www.bbc.co.uk/news/articles/c5y08z25q8eo

The video game Quake is 30 years old today. I played it with a ...

2026-06-22T12:31:51Z

The video game Quake is 30 years old today.

I played it with a 14.4k (0.0144 mbit/sec) modem with a 200 millisecond ping. Also back then internet was billed by the minute, I think was 4p per minute at peak time. RIP my parents phone bill.

My mum got annoyed with me once being online all the time so she confesquated my modem cable for two weeks. Somebody from IRC rang my house to check if I'd died.

Truly evil lobbying example ...

2026-06-18T08:44:05Z

Truly evil lobbying example https://www.politico.eu/article/europe-choose-ai-climate-goals-data-center-chief-warns/

Zayo Group paid ShinyHunters ransomware group to hide their ...

2026-06-16T12:27:47Z

Zayo Group paid ShinyHunters ransomware group to hide their breach.

KPMG issued a report citing all the transformational ways GenAi ...

2026-06-12T09:45:54Z

KPMG issued a report citing all the transformational ways GenAi has transformed industry, it’s been widely cited.

One minor problem: it turns they used AI to write the report, and it made up all of the evidence. https://www.ft.com/content/b3828e92-4961-4b39-84f0-c42f33be3c3f

One of the public MS statements about the issue in this thread is ...

2026-06-08T21:04:19Z

In reply to nevent1q…7hjq
_________________________

One of the public MS statements about the issue in this thread is it's an "internal technical issue"

It looks like Microsoft's DevOps libraries for Azure ...

2026-06-05T21:38:45Z

It looks like Microsoft's DevOps libraries for Azure Functions might have been compromised. No statement yet but Github is nuking Microsoft's own repos.

https://opensourcemalware.com/blog/miasma-reaches-azure

According to SpaceX documentation filed with the SEC, Grok will ...

2026-06-01T20:03:49Z

According to SpaceX documentation filed with the SEC, Grok will be worth almost the entire economic output of the US (this isn’t a joke).

Well done to Epic Games, who tweeted and then deleted, when ...

2026-05-26T14:22:22Z

Well done to Epic Games, who tweeted and then deleted, when called out, this GenAI image of their Porsche partnership.

Butchers the Porsche logo, puts Riot Games logo on the balloon (a competitor) and other things.

RE: https://techhub.social/@Techmeme/116596312742431654 This is ...

2026-05-18T15:37:57Z

RE: https://techhub.social/@Techmeme/116596312742431654

This is the dumbest fucking thing I’ve read since the last AI thing.

quoting
note17y5…lmgq

Amazon's Alexa+ now produces AI-generated "podcasts" on various topics in the US, featuring chats between two AI "co-hosts", using content from media outlets (Todd Spangler/Variety)

https://variety.com/2026/digital/news/amazon-alexa-plus-ai-podcasts-1236752477/
http://www.techmeme.com/260518/p26#a260518p26

The consequence of going passswordless: ...

2026-05-18T08:01:16Z

The consequence of going passswordless:

https://www.reddit.com/r/cybersecurity/s/7KIJL7R0Zz

So I’ve just had a quick play with this and yes, it works. ...

2026-05-13T05:40:57Z

So I’ve just had a quick play with this and yes, it works. Essentially BitLocker has a backdoor. https://github.com/Nightmare-Eclipse/YellowKey

Mitigation = BitLocker PIN and BIOS password lock.

Remember those Microsoft employees protesting about Azure being ...

2026-05-11T23:20:03Z

In reply to nevent1q…zydz
_________________________

Remember those Microsoft employees protesting about Azure being used by Israel to help genocide? That got fired? And tutted at and laughed at by other MSFT employees?

Turns out they were right.

Several MSFT managers in Israel have been fired and management of MS Israel moved abroad about major problems have been uncovered with their relationship with the Israeli government. Staff were serving the government rather than Microsoft to facilitate a genocide. https://en.globes.co.il/en/article-microsoft-israel-chief-leaves-amid-ethical-controversy-1001542602

RE: https://furry.engineer/@soatok/116538637460986985 It's ...

2026-05-08T11:39:04Z

RE: https://furry.engineer/@soatok/116538637460986985

It's not a recession, it's an AI boom! /s

quoting
note1qzr…slxg

Seeing Cloudflare do a 20% layoff doesn't bode well for the tech industry which already has a problem of too many overqualified people looking for too few jobs.

elon's a fucking weirdo ...

2026-05-06T21:10:02Z

elon's a fucking weirdo https://www.bbc.co.uk/news/articles/c33243j44p8o

RE: https://infosec.exchange/@metacurity/116420216155655162 ...

2026-04-17T13:22:35Z

RE: https://infosec.exchange/@metacurity/116420216155655162

Mythos is quickly becoming its own mythological beast.

They’ve automated the vulnerability hype train - an expression I used where researchers would find real vulnerabilities, which had no real impact in the real world. People would get very excited for no reason. Now they’ve automated that process with execs.

quoting
note1e57…du0g

"Until just over a week ago, most policymakers had expected the IMF and World Bank meetings to focus on the conflict in the Middle East, tensions in the private credit market, and elevated levels of government debt," and instead they're focusing on Mythos.
https://www.ft.com/content/5760b56a-ec83-46da-a301-4b0e8c73c238?syn-25a6b1a6=1

9 days since Blue Yonder SaaS ransomware incident began, 6 days ...

2024-11-29T17:54:24Z

In reply to nevent1q…dvvr
_________________________

9 days since Blue Yonder SaaS ransomware incident began, 6 days since the last comms saying no ETA to recovery.

Nostr event nevent1qqsphcf37v5xxdgxfzmr0l8kpzzuw0cfvt8g5nzakhls9zxnznu28vqzyrlrrf6vu7nn26yks6j230dhvk50fku5tkgmvaqjcag932p2288l6m76ntk

2024-11-28T15:04:34Z

In reply to nevent1q…82z9
_________________________

Tabletop exercise, your major SaaS supplier got hit with ...

2024-11-28T15:01:33Z

Tabletop exercise, your major SaaS supplier got hit with ransomware 8 days ago and they're in the US, but you're in the UK, and you haven't had an update in 4 days, and they've gone on holiday as it's Thanksgiving. https://blueyonder.com/customer-update

I paid €285 for the collectors edition and all I got are the ...

2024-11-19T22:32:45Z

In reply to nevent1q…uwfy
_________________________

I paid €285 for the collectors edition and all I got are the online streams of a loading screen and broken gameplay. 🫡🤣 they didn’t even bother to post the collectors edition yet.

Admittedly I’m old enjoy that this shit is just hilarious. Feel bad for the devs obviously too, somebody is going to have the task of making this a soothing all green PowerPoint for Satya Nadella.

Microsoft Flight Simulator 2024 launches today! #GossiAirways ...

2024-11-19T17:17:29Z

Microsoft Flight Simulator 2024 launches today! #GossiAirways will be trying it.

The entire game is built around Azure and their AI services, with the whole planet streamed in live rather than a large local install - they call it a thin client.

So, strap in to find out if Microsoft face pies Azure marketing wise.

For those who aren’t aware, Microsoft have decided to bake ...

2024-05-21T16:16:42Z

For those who aren’t aware, Microsoft have decided to bake essentially an infostealer into base Windows OS and enable by default.

From the Microsoft FAQ: “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."

Info is stored locally - but rather than something like Redline stealing your local browser password vault, now they can just steal the last 3 months of everything you’ve typed and viewed in one database.