Nostr notes by Zack Whittaker

Norway seeks to ban pervert glasses. More: ...

2026-09-02T13:22:59Z

Norway seeks to ban pervert glasses.

More: https://techcrunch.com/2026/09/02/norway-considers-ban-on-camera-enabled-wearable-pervert-glasses/

Ad-blocker bypass: https://web.archive.org/web/20260902131635/https://techcrunch.com/2026/09/02/norway-considers-ban-on-camera-enabled-wearable-pervert-glasses/

As promised, the video that Donut Media recorded at Def Con just ...

2026-09-01T16:44:31Z

In reply to nevent1q…kdr2
_________________________

As promised, the video that Donut Media recorded at Def Con just went up, showing a real-world demo of the pattern defeating a Flock camera's detections. Bill Swearingen (npub1kat…vu4j)

Watch: https://www.youtube.com/watch?v=znaA091_8-M

My earlier story: https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

Also, ICYMI: Last week I published a 3,200-word deep-dive ...

2026-08-31T12:26:07Z

Also, ICYMI: Last week I published a 3,200-word deep-dive explainer on a major threat to your home and office: Residential proxy networks allow hackers to use your internet connection for crime and cyberattacks. Find out why resproxies are a threat, how they work, and what *you* can do about them. 🤖

For subscribers: https://this.weekinsecurity.com/how-residential-proxy-networks-are-hiding-hackers-in-your-home/

(Here's a link to redeem a one-time 50% off discount for new subscribers: https://this.weekinsecurity.com/resproxy-insider-discount ❤️)

New: A cyberattack at medical device maker Boston Scientific is ...

2026-08-26T19:18:16Z

New: A cyberattack at medical device maker Boston Scientific is causing an ongoing "global disruption" to its operations, including its ability to ship and process customer orders.

When I asked, a spox. wouldn't say if patients are disrupted/affected.

More: https://techcrunch.com/2026/08/26/medical-device-maker-boston-scientific-says-a-cyberattack-is-causing-a-global-disruption-to-its-operations/

(Ad-block bypass: https://web.archive.org/web/20260826184012/https://techcrunch.com/2026/08/26/medical-device-maker-boston-scientific-says-a-cyberattack-is-causing-a-global-disruption-to-its-operations/)

Boston Scientific, which makes medical devices and pacemakers, ...

2026-08-26T12:04:02Z

Boston Scientific, which makes medical devices and pacemakers, says its IT systems were hacked on Tuesday and is experiencing a "global disruption" to its operations. Unclear if medical devices are affected (I've asked the company for comment.)

Here's the 8-K just filed: https://www.sec.gov/ix?doc=/Archives/edgar/data/0000885725/000088572526000056/bsx-20260826.htm

Tech giants and telcos are at war with residential proxy ...

2026-08-22T12:45:06Z

Tech giants and telcos are at war with residential proxy networks, which let hackers use your home/office internet connections for cyberattacks. In my latest, I explore why resproxies are a risk to you and your devices, how they enable crime, & what you can do to find and remove them.

Thanks so much to paid subscribers for supporting deep-dives like this one.

Read more: https://this.weekinsecurity.com/how-residential-proxy-networks-are-hiding-hackers-in-your-home

Sign up to my weekly newsletter: https://this.weekinsecurity.com

New, by me: Private equity giant Apollo Global confirms hackers ...

2026-08-21T13:45:31Z

New, by me: Private equity giant Apollo Global confirms hackers stole personal information, including Social Security numbers, during a July breach. This hack comes after Google researchers warned that an extortion crew was targeting financial giants.

More: https://techcrunch.com/2026/08/21/private-equity-firm-apollo-confirms-data-breach-amid-hacking-wave-targeting-financial-giants/

Ad-block bypass: https://archive.is/BucaL (Wayback is broken)

By enabling the new Xfinity Wi-Fi motion sensing tech, Comcast ...

2026-08-18T16:48:37Z

By enabling the new Xfinity Wi-Fi motion sensing tech, Comcast says it may disclose information generated from a customer’s use of the feature to outside parties under a broad array of reasons — and Comcast also says it doesn’t have to tell you.

More: https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/

Ad-block bypass: https://web.archive.org/web/20260818164350/https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/

Not content with Meta making camera-equipped pervert glasses, now ...

2026-08-18T11:43:50Z

Not content with Meta making camera-equipped pervert glasses, now Apple is making camera-equipped headphones. PervertPods.

https://www.macrumors.com/2026/08/17/camera-equipped-airpods-macos-26-7/

In a busy newsletter this week: U.S. will allow private companies ...

2026-08-16T15:40:46Z

In a busy newsletter this week: U.S. will allow private companies to hack-back; Flock flucked up; new Windows zero-day drops online; a bunch of companies have reported hacks and breaches; a North Korean got caught working in the federal government; and London face scans will continue until morale improves.

Also: a brand new two-for-one reader-submitted cybercats that you won't want to miss, and some fun things in the happy corner of good news. 🐈

Read online/sign up/RSS: https://this.weekinsecurity.com/this-week-in-security-august-16-2026-edition/

An absolutely insane story about when U.S. sanctions go wrong and ...

2026-08-15T11:38:23Z

An absolutely insane story about when U.S. sanctions go wrong and seemingly name the wrong person.

https://conic.al/writing/the-other-sean-byrne-doesnt-exist/

RE: https://infosec.exchange/@metacurity/117093610555674034 This ...

2026-08-14T11:41:14Z

RE: https://infosec.exchange/@metacurity/117093610555674034

This is insane. I wrote about the NHS leaking medical data over unencrypted pagers back in *2019*! https://techcrunch.com/2019/10/30/nhs-pagers-medical-health-data/

NHS was meant to phase out pagers by 2021, but apparently several NHS organizations didn't phase out their pager infrastructure, thus leading to the data leak of people's health data.

quoting
note19pd…yfvs

A BBC investigation found NHS Blood and Transplant (NHSBT) sent the names, dates of birth and types of organs being offered or needed to members of hospital transplant teams who were using pagers, unaware they were not encrypted
https://www.bbc.com/news/articles/clyj92j210do

New, by me: Apple told me it's sending out threat ...

2026-08-13T21:53:54Z

New, by me: Apple told me it's sending out threat notifications to customers in 110 countries saying they've been targeted with spyware. This latest batch also features a new push notification, warning users to take action and what to do next.

More: https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/

Ad-block bypass: https://web.archive.org/web/20260813215216/https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/

New: A security researcher called Nightmare Eclipse has published ...

2026-08-12T15:28:31Z

New: A security researcher called Nightmare Eclipse has published details of a new zero-day bug in Windows, seemingly undettered by Microsoft's legal threat earlier this year. The bug affects latest versions of Windows, and currently no patch.

More: https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/

Bypass for ad-blockers: https://web.archive.org/web/20260812152500/https://techcrunch.com/2026/08/12/after-microsoft-threatened-legal-action-a-security-researcher-publishes-a-new-windows-zero-day-bug/

Bill Swearingen spent the past year developing a pattern that can ...

2026-08-10T11:29:07Z

Bill Swearingen spent the past year developing a pattern that can defeat being detected by surveillance cameras, including vehicles and people. At Def Con, for the first time, he demoed the pattern printed on a car against a Flock camera to prove it works. (One of my favorite talks from Def Con this year!)

More by me at TechCrunch: https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

Ad-blocker bypass: https://web.archive.org/web/20260810033558/https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

Leading this week's newsletter is a rare one from me, looking ...

2026-08-09T19:15:40Z

In reply to nevent1q…l7dy
_________________________

Leading this week's newsletter is a rare one from me, looking at the highlights from Black Hat, Def Con, and BSides Las Vegas 2026 — especially if you couldn't make it.

Featuring the DOJ's POV on the CFAA, Cliff Stoll's incredible talk 40 years after catching Soviet hackers in the act, OpenAI breaks down its Hugging Face hack, and why popular sex toys on Amazon can be easily and remotely hijacked

Read more: https://this.weekinsecurity.com/the-top-highlights-from-black-hat-def-con-and-bsides-las-vegas-2026-if-you-couldnt-make-it-in-person

In my cyber newsletter ~ this week in security ~ The best from ...

2026-08-09T18:10:22Z

In my cyber newsletter ~ this week in security ~

The best from Black Hat, Def Con, and BSides Vegas (if you didn't go!); hackers predicted a hardware wallet's seed passwords; inside a China police spy dashboard; AI notetaker app exposed call recordings; Apple Private Relay leaked IP addresses; and much more. 🐈‍⬛

Read online: https://this.weekinsecurity.com/this-week-in-security-august-9-2026-edition/

Sign up: https://this.weekinsecurity.com

Microsoft wins "lamest vendor response" award at this ...

2026-08-07T22:05:19Z

Microsoft wins "lamest vendor response" award at this year's Pwnie Awards, for publishing a blog post earlier this year threatening security researchers with legal action if they published zero-days.

Also: Meta wins "epic fail" award after its Meta AI hijack bug.

By me: https://this.weekinsecurity.com/microsoft-wins-lamest-vendor-at-pwnie-awards-2026-for-threatening-security-researchers-with-legal-action/

Two researchers scanned Poland's internet out of a sense of ...

2026-08-07T21:12:47Z

Two researchers scanned Poland's internet out of a sense of patriotism and a desire to make it more secure, and found thousands of gov't and public bodies were at risk of very easy hacks. One bug let them take over two-thirds of Poland's court websites.

More: https://techcrunch.com/2026/08/07/security-researchers-scanned-the-polish-web-and-found-courts-hospitals-and-airports-at-risk-of-hacks/

(Bypass for ad-blockers: https://archive.is/pDB7Q)

This was really important, powerful reporting by ...

2026-08-07T13:15:27Z

This was really important, powerful reporting by Patrick Howell O'Neill (npub1m0g…ct7v).

The US military’s cyberwarfare unit is scrutinizing an unusually high number of deaths by suicide among personnel over a month-long period this summer, according to government officials and other people familiar with the matter.

https://www.bloomberg.com/news/articles/2026-08-06/us-military-s-cyber-command-unit-grapples-with-cluster-of-deaths-by-suicide

I'll be hosting an AMA with security researcher ...

2026-08-06T00:35:04Z

I'll be hosting an AMA with security researcher Runa Sandvik (npub1ukf…az95) on August 12th at 5pm PT / 8pm ET to answer questions about the recent case of an American charged by the DOJ for allegedly wiping his phone with a "duress" password during an airport interrogation. It's the first case of its kind. https://reddit.com/r/pwnhub/comments/1vgovkv/we_are_techcrunch_security_editor_zack_whittaker/

Another AI test gone awry, U.K. edition. "An agent tried to ...

2026-08-04T21:28:37Z

Another AI test gone awry, U.K. edition.

"An agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code."

More: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

By me: A major online ads company that claims to serve 1.5 ...

2026-08-04T12:15:22Z

By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.

More: https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/

Sign up (or RSS!) for the weekly newsletter: https://this.weekinsecurity.com

RE: https://mastodon.social/@zackwhittaker/117033323332487017 If ...

2026-08-04T11:18:54Z

RE: https://mastodon.social/@zackwhittaker/117033323332487017

If there's one thing I've learned from publishing this story is that there is a very, very, very wide chasm between what the law says about all this... and what people *think* the law says and/or *should* say.

quoting
note1pqa…7kdf

After Anthropic and OpenAI both admitted to their AI models hacking other companies, Lorenzo Franceschi-Bicchierai (npub1xvw…ksg7) and I wanted to find out: Who is legally to blame when an autonomous AI agent hacks something? Lawyers say it's really complicated; one called it "uncharted territory."

Read more: https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

Bypass for ad-blockers: https://web.archive.org/web/20260803194912/https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

After Anthropic and OpenAI both admitted to their AI models ...

2026-08-03T19:53:14Z

After Anthropic and OpenAI both admitted to their AI models hacking other companies, Lorenzo Franceschi-Bicchierai (npub1xvw…ksg7) and I wanted to find out: Who is legally to blame when an autonomous AI agent hacks something? Lawyers say it's really complicated; one called it "uncharted territory."

Read more: https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

Bypass for ad-blockers: https://web.archive.org/web/20260803194912/https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

U.S. biotech giant Amgen confirms July hack, and says proprietary ...

2026-07-31T20:30:12Z

U.S. biotech giant Amgen confirms July hack, and says proprietary data, patients' health data, and other information was exfiltrated from its cloud environments (Amgen runs largely on AWS). Amgen says volume & types of data stolen "could be sensitive."

Amgen says it serves 17 million patients. 🫠

From the SEC filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/0000318154/000031815426000119/amgn-20260729.htm

I'd be interested to see if any of the companies that were ...

2026-07-31T10:47:50Z

I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.

https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

CareCloud, which stores patients' medical records for 45,000+ ...

2026-07-30T20:35:06Z

CareCloud, which stores patients' medical records for 45,000+ hospitals & healthcare providers across the U.S., has begun notifying hundreds of thousands of people that their data was stolen in a March breach. The notices reveal new details, and the number of affected people is expected to rise.

More, by me: https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

Bypass for ad-blockers: https://web.archive.org/web/20260730203017/https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

Ah — an extortion racket called ExfilSquad took credit three ...

2026-07-29T22:35:14Z

In reply to nevent1q…tejw
_________________________

Ah — an extortion racket called ExfilSquad took credit three days ago for stealing ~570,000 records, allegedly containing customers' personal information and addresses.

Notably, the hackers' leak site doesn't currently list Analog, suggesting that the company may have paid a ransom. I asked, etc., but nada.

Analog Devices, which makes a shit ton of computer chips, ...

2026-07-29T22:23:53Z

Analog Devices, which makes a shit ton of computer chips, confirmed in an 8-K filing that it had a data breach in June where hackers exfiltrated data.The nature of the data is still under investigation, and nothing more for now, the company said.

"Separately and unrelated," the company goes on (👀), it's investigating a *second* security incident. I asked, but a spox. wouldn't comment beyond the statement.

Here's the filing: https://www.sec.gov/ix?doc=/Archives/edgar/data/6281/000119312526324223/d158253d8k.htm

RE: https://cyberplace.social/@GossiTheDog/117004159920714904 ...

2026-07-29T21:17:03Z

RE: https://cyberplace.social/@GossiTheDog/117004159920714904

Solid thread here from Kevin Beaumont (npub1lcc…lcye) and other defenders. ClickFix, phishing, and phone calls seem to be the big common threat themes, not AI.

quoting
note12un…5w7s

Sense check for people working in cybersecurity in operations roles in the trenches:

I’m not finding or seeing cyber incidents off the back of Generative AI still. Are you? Not ones you’ve read about online - I mean ones you’ve actually dealt with.

In my latest weekly cyber newsletter: OpenAI admits to hacking ...

2026-07-26T14:10:27Z

In my latest weekly cyber newsletter: OpenAI admits to hacking Hugging Face, millions of cars with hidden alarms vulnerable to hacking, Iran's hacking water and energy systems, Russia's targeting nuclear scientists with an email zero-day, a healthcare hack sparks data theft fears, and much more.

Read online: https://this.weekinsecurity.com/this-week-in-security-july-26-2026-edition/

Sign up/RSS and support: https://this.weekinsecurity.com

Incredibly detailed reporting by @npub1xx5…plnx et al at ...

2026-07-24T23:56:41Z

Incredibly detailed reporting by razhael (npub1xx5…plnx) et al at Reuters on the OpenAI hack of Hugging Face, revealing new details on how it went down and how it took a week for OpenAI to notice one of its AI models was hacking into another company, citing multiple sources.

More: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/

The person's attorney said feds are using a rarely used ...

2026-07-24T18:08:25Z

In reply to nevent1q…vk4q
_________________________

The person's attorney said feds are using a rarely used federal statute, and security experts said they hadn't heard of similar cases. This raises fresh questions about constitutional rights and device searches at the U.S. border.

Also: the DOJ's indictment had a notable typo. Read on for more.

https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search

New, by me: The Justice Department is prosecuting an American for ...

2026-07-24T18:06:18Z

New, by me: The Justice Department is prosecuting an American for allegedly providing U.S. border agents with a "duress" passcode that wiped the contents of his phone when they entered it. We've confirmed the phone was running GrapheneOS.

Read more: https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search

Bypass for ad-blockers: https://web.archive.org/web/20260724175443/https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/

Even if Hugging Face is fine with all this (and honestly, why ...

2026-07-22T10:22:50Z

Even if Hugging Face is fine with all this (and honestly, why should it be; OpenAI clearly can't control a technology of its own making?), there's room for the USG to bring criminal CFAA charges against OpenAI. It's not like OpenAI execs wrote a blog post describing their crimes or anything. 🙄

https://www.theguardian.com/technology/2026/jul/22/openai-says-its-models-went-rogue-and-hacked-startup-in-unprecedented-incident

Woof. That data breach at Suno last year, but only just disclosed ...

2026-07-21T14:59:36Z

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.

More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

New, by me: A tech company called Craneware says it was hacked ...

2026-07-20T15:04:53Z

New, by me: A tech company called Craneware says it was hacked and that a "significant" amount of data stolen, including its customers. The company provides software to thousands of U.S. clinics, hospitals, and pharmacies around the world, sparking fears of a data breach of patient data.

More: https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/

Bypass for ad-blockers: https://web.archive.org/web/20260720150203/https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/

In this week's ~ this week in security ~ Spy vans are coming ...

2026-07-19T15:09:28Z

In this week's ~ this week in security ~

Spy vans are coming to U.S. police departments, how a London crew pulled off a brazen datacenter theft, Iran exploited phone bugs to track U.S. troops, Finnish therapy hacker wanted, and most fitness trackers lack basic security features. Also: WordPress bugs under active attack, and why librarians are helping people avoid AI. Plus: A brand new cyber-cat. 🐈

Read online: https://this.weekinsecurity.com/this-week-in-security-july-19-2026-edition/

Sign up/RSS: https://this.weekinsecurity.com

RE: https://infosec.exchange/@josephcox/116936059609034986 This ...

2026-07-17T15:42:27Z

RE: https://infosec.exchange/@josephcox/116936059609034986

This is really bad on its own, but again — it's an absolute travesty that a private company like Thomson Reuters can collect and store massive databases of Americans' private and personal data — from names, addresses, Social Security numbers, ethnicity, social media posts, and location information — and the government can just buy that data, no warrant needed. The data broker industry needs be shut down and privacy rights in the U.S. regulated. https://www.404media.co/ice-to-pay-thomson-reuters-125-million-to-find-voter-fraud/

quoting
note107n…g4zd

New from 404 Media: ICE plans to pay Thomson Reuters $125 million for data to investigate what it calls 'voters fraud'. News comes day after Trump laying the groundwork to undermine the midterms. ICE says Thomson Reuters can continuously track millions of people.

https://www.404media.co/ice-to-pay-thomson-reuters-125-million-to-find-voter-fraud/

New, by me: Amazon said it's trying to fix a bug in its ...

2026-07-17T15:37:47Z

New, by me: Amazon said it's trying to fix a bug in its billing platform that kicked out incorrect estimates for Amazon Web Services cloud customers. How bad? Some AWS customers reported getting estimates into the billions of dollars. Whoops!

More: https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollars/

Bypass for ad-blockers: https://web.archive.org/web/20260717152958/https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollars/

Fantastic work by @npub1l3x…v4qu at EFF looking at the state of ...

2026-07-16T13:00:35Z

Fantastic work by Thorin Klosowski (npub1l3x…v4qu) at EFF looking at the state of fitness tracker privacy.

Most wearable makers don't end-to-end encrypt your data, so police/feds (and hackers!) can get your health data — and almost none publish a transparency report, so we may never know if they do.

https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

ding ding ding, exactly

2026-07-15T14:32:26Z

In reply to nevent1q…twna
_________________________

ding ding ding, exactly

U.K. government says it's not taking action to restrict on ...

2026-07-15T14:23:11Z

U.K. government says it's not taking action to restrict on VPNs for now, as ministers sought to limit them under its age verification laws.

https://www.bbc.com/news/articles/c982857nlrlo

New, by me: Core to its complaint against OpenAI, Apple accused a ...

2026-07-13T20:05:16Z

New, by me: Core to its complaint against OpenAI, Apple accused a former employee of allegedly exploiting a security bug to steal reams of confidential files from Apple's network over several weeks while working as an OpenAI employee

“LOL, I found out I can access the [network storage], so funny,” the ex-Apple employee allegedly wrote.

Read more: https://techcrunch.com/2026/07/13/apple-says-former-employee-exploited-rare-bug-to-download-confidential-files-after-leaving-for-openai/

(Bypass for ad-blockers: https://archive.is/rmPlh)

New: The LAPD, the third-largest police department in the United ...

2026-07-13T14:26:33Z

New: The LAPD, the third-largest police department in the United States, let its contract with surveillance giant Flock expire this weekend, citing "serious concerns" with civil liberties and privacy.

Flock said it was surprised by the move, but it's not clear if the company's license plate readers will immediately cease recording.

More: https://techcrunch.com/2026/07/13/lapd-lets-contract-with-surveillance-giant-flock-expire-citing-serious-concerns-over-civil-liberties-and-privacy/

(Bypass link for ad-blockers: https://archive.is/zUou2)

New, by me: A federal court has jailed a Florida man for helping ...

2026-07-10T14:23:31Z

New, by me: A federal court has jailed a Florida man for helping a notorious ransomware gang extort U.S. companies while working for a cyber company as a *ransomware negotiator*. He's the third security person to be jailed for this (batshit) extortion scheme.

More, by me: https://techcrunch.com/2026/07/10/florida-ransomware-negotiator-convicted-for-helping-ransomware-gang-extort-us-companies/

(Bypass for ad-blockers: https://archive.is/lDVxf)

I think this raises an important point. I moved to the U.S. a few ...

2026-07-09T12:50:17Z

I think this raises an important point. I moved to the U.S. a few years ago to become a U.S. journalist. I've been very fortunate to have workplaces that let me do my job uninhibited. In America, a person's ability to access healthcare for themselves and their family is almost always linked to their employer. This means U.S. companies, including media outlets, hold way too much power & control over their employees. It's all the more crucial to support independent media.

https://mastodon.social/@randahl/116889333585143994

quoting
note1d0d…7m7q

Danish journalists eat American journalists for breakfast.

This is Rasmus Svaneborg from Ritzau showing how it is done.

My hand-written cybersecurity newsletter ~ this week in security ...

2026-07-09T01:47:42Z

In reply to nevent1q…2jnx
_________________________

My hand-written cybersecurity newsletter ~ this week in security ~ goes out every Sunday with all of the major news you need to know from the week and much more, plus some levity in the happy corner of good things, and a reader-submitted cyber-cat. 🐈‍⬛

No email open/link tracking — because I care about your privacy! Sign up/RSS for the weekly email: https://this.weekinsecurity.com/

There's been yet another majot breach of U.S. driver's ...

2026-07-08T16:31:26Z

There's been *yet another* majot breach of U.S. driver's license numbers. Insurance giant AssuranceAmerica confirmed a breach affecting over 6.9 million people, making it the largest known spill of Americans’ driver’s license data this year.

By me at TechCrunch: https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/

Bypass for ad-blockers: https://web.archive.org/web/20260708162100/https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/

Smart glasses with cameras and microphones built-in and facial ...

2026-07-08T12:15:20Z

Smart glasses with cameras and microphones built-in and facial recognition to come are the latest fad in surveillance tech.

For my blog & newsletter ~ this week in security ~ I wrote about why the backlash against smart glasses — aka "pervert glasses" — is justified from a security and privacy perspective. Please read and share!

More: https://this.weekinsecurity.com/reframing-smart-glasses-as-pervert-glasses/

Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

Took a photo of this license plate a few days ago while on ...

2026-07-07T01:17:53Z

Took a photo of this license plate a few days ago while on vacation in Maine, seems apt today.

Layoffs are a failure of leadership. ...

2026-07-06T14:15:53Z

Layoffs are a failure of leadership.

https://www.theverge.com/news/961528/microsoft-layoffs-july-2026-sales-xbox

New, by me: A politician who was part of a European Parliament ...

2026-07-03T11:23:49Z

New, by me: A politician who was part of a European Parliament committee tasked with investigating spyware abuses had his own phone hacked with Pegasus spyware. Stelios Kouloglou told me the hacking was "reckless" and likely due to his work. He plans to sue NSO, which develops Pegasus.

More: https://techcrunch.com/2026/07/02/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware/

RE: https://mastodon.social/@zackwhittaker/116032232185026857 ...

2026-07-02T00:09:37Z

RE: https://mastodon.social/@zackwhittaker/116032232185026857

Nice to be back home and online after a relaxing few days away, went outside to water the plants on the deck and OH FOR FU... guys, c'mon, AGAIN?!

nostr:note1kq862cax9ljsz0g5eygs7epqpxdp8ldcu4hvalq8xcmchu7rt5equfg4su

Trump is threatening to refuse to sign a bipartisan(!)-agreed ...

2026-06-24T15:44:47Z

Trump is threatening to refuse to sign a bipartisan(!)-agreed bill that aims to tackle the ongoing housing affordability crisis unless Congress passes his insane voter ID law. Last week it was FISA & now this. Trump doesn't care about natsec, the economy, or you. It's all so he can stay in power.

https://apnews.com/article/trump-capitol-republican-senators-968c1454ede461d2db413790670c07df

New, by me: Klue says hackers used a credential from a 2022 pilot ...

2026-06-23T19:55:20Z

New, by me: Klue says hackers used a credential from a 2022 pilot that allowed the recent mass-theft of customers' data. Lots of unknowns, but raises questions about how long the credential was active & what could've been done to mitigate.

More: https://techcrunch.com/2026/06/23/klue-says-hackers-stole-credential-from-2022-that-led-to-customer-data-breaches/

Bypass for ad-block users: https://web.archive.org/web/20260623194503/https://techcrunch.com/2026/06/23/klue-says-hackers-stole-credential-from-2022-that-led-to-customer-data-breaches/

In a new privacy policy, Anthropic says Claude will soon require ...

2026-06-22T19:53:48Z

In a new privacy policy, Anthropic says Claude will soon require you to upload your driver's license or passport for a variety of reasons. The ID checker is Persona, a firm funded by Trump ally Peter Thiel. As a U.S. company, Persona is also subject to gov't demands for people's verification data. 👀

https://techcrunch.com/2026/06/22/anthropic-says-claude-may-want-to-see-your-id/

A cybercrime gang took credit for a hack at Klue, allowing them ...

2026-06-22T14:44:53Z

A cybercrime gang took credit for a hack at Klue, allowing them to steal data from a bunch of major cybersecurity companies.

My story: https://techcrunch.com/2026/06/22/klue-hack-results-in-data-breach-at-several-cybersecurity-firms/

But you might not have seen Klue CEO's blog post because it included "noindex" code in the HTML, which hides the page from search engine results: https://web.archive.org/web/20260622144218/https://klue.com/blog/an-update-on-recent-klue-security-incident

To anyone and everyone who also has complicated or painful ...

2026-06-21T19:32:21Z

To anyone and everyone who also has complicated or painful feelings on days like today for Mother's or Father's Day, you are seen and you are loved.

My adorable large adult cat son Theo had high blood pressure ...

2026-06-18T11:50:46Z

My adorable large adult cat son Theo had high blood pressure (what reason does he have to be stressed? he's a cat, he doesn't even pay rent). After some medication, he's doing great.

Still something hilarious about cats having their own blood pressure machines. His brother Toby was being very sweet.

I wrote some words for TechCrunch about the Anthropic ban ...

2026-06-15T23:05:34Z

I wrote some words for TechCrunch about the Anthropic ban shitshow. https://techcrunch.com/2026/06/15/the-us-governments-anthropic-models-ban-was-never-about-an-ai-jailbreak/

New, by me: In a rare rebuke for Trump, Republicans balked at ...

2026-06-12T11:57:47Z

New, by me: In a rare rebuke for Trump, Republicans balked at voting to reauthorize the U.S.' warrantless spying powers over Trump's pick to oversee the intelligence agencies.

Critics said Bill Pulte would weaponize the job of top spy, so lawmakers let the powers expire instead. Trump caved and picked someone else over Pulte, but by then most lawmakers had left Washington DC for the week.

Due to a quirk in the law, the government's spy programs won't stop overnight.

https://techcrunch.com/2026/06/12/us-spy-law-to-expire-for-first-time-after-lawmakers-reject-trumps-controversial-pick-to-lead-spy-agencies/

New, by me: ServiceNow appears to have notified some enterprise ...

2026-06-10T14:15:23Z

New, by me: ServiceNow appears to have notified some enterprise customers that there was outside access to their data, after a security bug left instances exposed to the web.

The company has hidden its notice behind a login wall, but was shared by network defenders on Reddit.

https://techcrunch.com/2026/06/10/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet/

Microsoft confirmed it's notified a "small number of ...

2026-06-08T20:47:33Z

Microsoft confirmed it's notified a "small number of customers" who may have pulled password-stealing malware from some of its GitHub-hosted open source repos, while many affected repos are still down.

I've asked for a specific number. Even a "small number" of Microsoft's many, many customers could be significant.

https://techcrunch.com/2026/06/08/microsofts-open-source-tools-were-hacked-to-steal-passwords-of-ai-developers/

New, by me: Meta has filed a data breach notice confirming that ...

2026-06-06T11:52:21Z

New, by me: Meta has filed a data breach notice confirming that *thousands* of people had their Instagram accounts hacked as part of a months-long campaign abusing its Meta AI chatbot.

Meta's breach notice shows the hacks were far more widespread than first thought.

More: https://this.weekinsecurity.com/meta-confirms-thousands-of-instagram-accounts-were-hacked-by-abusing-its-ai-chatbot/

Sign up/RSS for my free weekly newsletter: https://this.weekinsecurity.com/

RE: https://infosec.exchange/@cR0w/116692776221622923 Last year I ...

2026-06-04T20:37:43Z

RE: https://infosec.exchange/@cR0w/116692776221622923

Last year I said this, and it's still true.

"If there's one thing I've learned about covering cybersecurity over the past decade or so, is that the cybersecurity community (the fixers and breakers) and the cybersecurity industry (profits above all else) are two very, very different things."

quoting
note1le8…4h0s

Reminder: Security companies exist to protect the wealthy. Community protects community.

Personally I think Dashlane's update to its 2FA-busting data ...

2026-06-04T20:33:34Z

Personally I think Dashlane's update to its 2FA-busting data breach notice is still lackluster and doesn't explain that much beyond its original post. That said, Dan Goodin (npub1z3l…qvzu) does a solid job of reading between the lines and filling in the gaps. tl;dr: Bruteforcing Dashlane customer account 2FA codes was relatively easy.

https://arstechnica.com/security/2026/06/dashlane-explains-how-attackers-managed-to-download-encrypted-password-vaults/

while the decision is above my paygrade, I agree with you, and ...

2026-06-04T15:22:10Z

In reply to nevent1q…773t
_________________________

while the decision is above my paygrade, I agree with you, and you shouldn't have to ever switch off your ad blocker.

You know things are bad when Chinese spies are also spending ...

2026-06-04T15:07:00Z

You know things are bad when Chinese spies are *also* spending their entire day on LinkedIn.

https://techcrunch.com/2026/06/04/chinese-spies-are-using-linkedin-to-lure-westerners-into-sharing-sensitive-information/

It's rare to see near-universal condemnation from the infosec ...

2026-05-30T12:48:37Z

It's rare to see near-universal condemnation from the infosec community, but Microsoft threatening a security researcher has done it.

Notable exceptions: When Keeper Security sued Ars Technica over a story (2017); NSA's mass surveillance uncovered (2013); and FBI demanding an Apple backdoor (2016).

https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/

PostHog says it's currently experiencing a security incident. ...

2026-05-30T02:34:02Z

PostHog says it's currently experiencing a security incident. The analytics company said it's "rotating keys after a security research team was able to confirm an exploit in one of our AWS environments," referring to Amazon Web Services.

Incident page: https://www.posthogstatus.com/incidents/01KSV6HJYKG5QJAP8HVTSQVSM1

It's a day ending in "y," so there's another ...

2026-05-28T18:09:22Z

It's a day ending in "y," so there's another 300,000+ driver's licenses and other sensitive documents publicly exposed to the web. This time it's Pay Tel, a prison phone calling service, which hasn't responded to requests for comment or said if it plans to notify those whose data was exposed.

https://techcrunch.com/2026/05/28/a-security-lapse-at-prison-payphone-service-pay-tel-publicly-exposed-over-300000-callers-drivers-licenses/

Condé Nast shit the bed so hard when it fired four journalists ...

2026-05-27T16:59:57Z

Condé Nast shit the bed so hard when it fired four journalists last year that it's now settled with the union and given three out of the four reporters "two years’ pay and furnished [them] with positive letters of recommendation."

UNIONS, PEOPLE. UNIONS!

https://www.hollywoodreporter.com/business/business-news/conde-nast-union-settlement-fired-four-exclusive-1236606293/

New, by me: A person notified us that a website called UK Visa ...

2026-05-26T23:57:19Z

New, by me: A person notified us that a website called UK Visa Portal is publicly exposing 100,000+ passports & selfies of applicants who paid the site to obtain a UK immigration visa. We emailed the company to share details about the security lapse — but didn't hear back from its management.

https://techcrunch.com/2026/05/26/uk-visa-portal-spilled-thousands-of-applicants-passports-and-selfies-online-and-hasnt-fixed-the-leak/

New, by me: Health wearable giant Oura says it has received ...

2026-05-23T12:40:16Z

New, by me: Health wearable giant Oura says it has received government demands for users' information (because Oura does not use end-to-end encryption).

Will Oura say how often it gets demands for user data, and how often Oura hands over users' data to authorities?

Read online: https://this.weekinsecurity.com/oura-says-it-gets-government-demands-for-user-data-will-it-share-how-many/

Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

"I have been a professional tech journalist for nearly ...

2026-05-23T02:03:11Z

"I have been a professional tech journalist for nearly fifteen years, and before today, I cannot think of a single time when a Bing search result was more valuable than the Google equivalent. There really is a first time for everything!"

https://techcrunch.com/2026/05/22/you-can-no-longer-google-the-word-disregard/

If someone wants to leak me a copy of this app (either .apk or ...

2026-05-23T01:37:11Z

If someone wants to leak me a copy of this app (either .apk or .ipa), please reach out on Signal — my username is zackwhittaker.1337 — and I would be keen to run this app through Burp Suite to see how it works. Happy to grant anonymity.

https://www.govexec.com/management/2026/05/white-house-ordering-agencies-place-its-new-app-all-employees-government-phones/413738/

Cognizant again?!

2026-05-22T22:23:03Z

In reply to nevent1q…wsvy
_________________________

Cognizant *again?!*

Oh no! BASED APPAREL, the online store run by FBI director Kash ...

2026-05-22T12:41:33Z

Oh no! BASED APPAREL, the online store run by FBI director Kash Patel (for some reason?), was hacked to serve ClickFix attacks (🎻).

Website visitors see a fake Captcha-style screen, and are then tricked into hacking themselves by copying and pasting malware code.

How this hack works: https://this.weekinsecurity.com/clickfix-attacks-are-increasingly-devious-dangerous-and-can-get-you-hacked-in-an-instant/

New, by me: Scammers are abusing a legitimate internal Microsoft ...

2026-05-21T11:56:18Z

New, by me: Scammers are abusing a legitimate internal Microsoft account (used for sending critical account alerts and MFA codes to users logging in) to send spam and scam emails.

We first saw a flood of these emails last week, but anti-spam project Spamhaus says this has been going on for months.

More: https://techcrunch.com/2026/05/21/scammers-are-abusing-an-internal-microsoft-account-to-send-spam

I get there's a lot of buzz and excitement about AI's ...

2026-05-20T15:14:04Z

In reply to nevent1q…fqcm
_________________________

I get there's a lot of buzz and excitement about AI's cyber capabilities at the moment. But if the government assessments of AI today are anything to go by, it's *all the more reason* to invest in strong cyber foundations and best practices to make it more difficult for attacks to succeed.

Let me know what you think, and please share if you found this blog useful.

https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/

GitHub says thousands of its internal repos were compromised in a ...

2026-05-20T13:27:41Z

GitHub says thousands of its internal repos were compromised in a recent attack. The Microsoft-owned company said it "detected and contained a compromise of an employee device involving a poisoned VS Code extension."

https://techcrunch.com/2026/05/20/github-says-hackers-stole-data-from-thousands-of-internal-repositories/

For my newsletter & blog, I wrote about why many in ...

2026-05-20T12:07:39Z

For my newsletter & blog, I wrote about why many in cybersecurity are talking about AI — but crucially, why I think it's also all the more important to *not forget* about the cybersecurity basics and best practices, which are still the leading causes of damaging breaches.

More: https://this.weekinsecurity.com/ai-can-find-bugs-and-flaws-but-do-not-forget-the-cybersecurity-basics/

Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

Here it is: Within 60 days, Treasury shall propose changes to the ...

2026-05-20T00:05:28Z

In reply to nevent1q…a5nd
_________________________

Here it is:

Within 60 days, Treasury shall propose changes to the Bank Secrecy Act to strengthen risk-based customer due diligence requirements, including information relevant to whether account holders possess lawful immigration status & to "collect and verify" customer identity information.

https://www.whitehouse.gov/presidential-actions/2026/05/restoring-integrity-to-americas-financial-system/

We have yet to normalize booing billionaires in public, but we ...

2026-05-18T12:24:23Z

We have yet to normalize booing billionaires in public, but we should definitely start.

https://techcrunch.com/2026/05/17/if-youre-giving-a-commencement-speech-in-2026-maybe-dont-mention-ai/

CNN's Sean Lyngaas back once again with a belter story: ...

2026-05-15T21:11:25Z

CNN's Sean Lyngaas back once again with a belter story: Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple U.S. states.

Per Lyngaas: the hackers "exploited automatic tank gauge systems that were sitting online and unprotected by passwords."

A little louder for the folks in the back:

...."UNPROTECTED BY PASSWORDS."

https://www.cnn.com/2026/05/15/politics/iran-hackers-tank-readers-gas-stations

Filed under "shit I can't believe is still happening in ...

2026-05-15T19:47:45Z

Filed under "shit I can't believe is still happening in 2026 but here we are": 1+ million photo IDs and selfies from a hotel check-in system left publicly exposed online for anyone to find.

This is the latest example of a company leaking government-issued IDs in recent months.

https://techcrunch.com/2026/05/15/a-hotel-check-in-system-left-a-million-passports-and-drivers-licenses-open-for-anyone-to-see/

In a Wednesday blog post, Cisco CEO Chuck Robbins announced ...

2026-05-14T14:11:38Z

In a Wednesday blog post, Cisco CEO Chuck Robbins announced layoffs of 4,000 employees (5% staff) so that the company can spend more on AI and cybersecurity. He also touted Cisco's "record revenue" and "double-digit growth."

Robbins' total executive compensation is ~$52 million for 2025.

https://techcrunch.com/2026/05/14/cisco-cuts-nearly-4000-jobs-to-spend-more-on-ai-reports-record-quarterly-revenue/

Malware research group vx-underground has 30 terabytes of ...

2026-05-13T18:17:54Z

Malware research group vx-underground has 30 terabytes of malware. VirusTotal has 31 *petabytes* of malware in its bank.

We were curious how tall these datasets would be if stacked as hard drives, so we did some rough back-of-a-napkin math to figure it out.

https://techcrunch.com/2026/05/13/this-is-what-some-the-worlds-largest-banks-of-malware-look-like-stacked-as-hard-drives

Looks like hackers/scammers/asshats are abusing Microsoft's ...

2026-05-12T15:41:03Z

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails.

Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.

In this 3,000+ word deep-dive for my blog and newsletter ~ this ...

2026-05-11T13:07:02Z

In this 3,000+ word deep-dive for my blog and newsletter ~ this week in security ~ I explore the most pressing threats to face the internet this year. This includes surveillance and choking online access to governments going rogue, and more, and why they pose a risk.

https://this.weekinsecurity.com/the-most-dangerous-threats-to-the-internet-in-2026/

Edtech giant Instructure was hacked (twice) — and finally put ...

2026-05-09T22:16:58Z

Edtech giant Instructure was hacked (twice) — and finally put up a security incident page after the mass-defacement of Canvas school login pages.

But you might not find the page because right now it has a "noindex" tag in the page's HTML code, which prevents it from being listed in search results.

The page is here, FYI: https://www.instructure.com/incident_update

SEC filing: Identity/security firm SailPoint said it detected a ...

2026-05-08T21:55:28Z

SEC filing: Identity/security firm SailPoint said it detected a breach of some of its GitHub repos on Apr 20. Says the root cause was a vulnerability in a third-party application, without saying more. "No evidence" of a customer data breach, but said it notified each customer that had data accessed.

What did you (or someone you know) do this week that you're ...

2026-05-08T14:47:10Z

What did you (or someone you know) do this week that you're incredibly proud of?

NEW w/ @npub1xvw…ksg7: Hackers have defaced a bunch of school ...

2026-05-07T21:02:22Z

NEW w/ Lorenzo Franceschi-Bicchierai (npub1xvw…ksg7): Hackers have defaced a bunch of school login pages for Canvas, the student portal made by ed-tech giant Instructure.

This appears to be the latest effort by the ShinyHunters to apply pressure on the company.

https://techcrunch.com/2026/05/07/hackers-deface-school-login-pages-after-claiming-another-instructure-hack/

Police arrested three men accused of driving around an SMS ...

2026-05-07T15:17:04Z

Police arrested three men accused of driving around an SMS blaster across downtown Toronto, which allegedly blasted tens of thousands of phones with spammy text messages over several months.

https://techcrunch.com/2026/05/07/police-arrest-sms-blaster-crew-that-sent-malicious-messages-to-thousands-across-toronto/

Per The Register, cybersecurity vendor Arctic Wolf has laid off ...

2026-05-06T18:41:02Z

Per The Register, cybersecurity vendor Arctic Wolf has laid off 250 workers, or ~10% staff, to save money amid an AI push. https://www.theregister.com/ai-and-ml/2026/05/06/arctic-wolf-cuts-250-jobs-in-ai-push/5231213

Arctic Wolf is worth billions of dollars. Will execs take a paycut? Also, it doesn't have any women on its executive leadership team. Shameful. https://arcticwolf.com/company/companyleadership/

I heard more from Disc-Soft, the maker of Daemon Tools, which was ...

2026-05-06T16:11:14Z

I heard more from Disc-Soft, the maker of Daemon Tools, which was backdoored by suspected Chinese-language hackers and used to compromise thousands of users.

Disc-Soft tells me the backdoor was "limited to the free DAEMON Tools Lite" and v12.6 removes the backdoor; investigation ongoing.

My earlier story: https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

NEW: Kaspersky says hackers planted and activated a backdoor in ...

2026-05-05T15:25:16Z

NEW: Kaspersky says hackers planted and activated a backdoor in the popular Windows disk imaging app Daemon Tools a month ago, infecting thousands of computers around the world in a n ongoing, "widespread" attack.

The attack appears to be ongoing. A representative for Disc Soft, which makes Daemon Tools, said it was aware of Kaspersky's report and was investigating.

This is the latest supply chain attack targeting software used by a large number of people.

https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/