Zack Whittaker

Security editor, TechCrunch
Email: zack.whittaker@techcrunch.com
Signal: zackwhittaker.1337
New York, NY

Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

NIP-05 Address

zackwhittaker@mastodon-social.mostr.pub

Profile Code

nprofile1qqs9eknh8x6wrd92kega8j6htj7nz79mwr7ment2kca0vj4ls526rsqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds86u6mn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

Show more details

Last Notes

2026-10-28 20:03:43 UTC

NEW: U.S. Dept. of Homeland Security was breached, allowing a hacker to scrape personnel and contact information data from its Okta sign-on system. The stolen data includes 40,000+ records across DHS agencies, including CBP, ICE, and HSI, as well as DHS leadership — and is now online via DDoSecrets.
Read more: https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/
Bypass for ad-blockers: https://archive.is/9jTmV

2026-10-26 13:29:38 UTC

I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly didn't, but how the PHP-ocalypse is likely just the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time.
More: https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/
Bypass for ad-blockers: https://web.archive.org/web/20261026132130/https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/

2026-10-26 12:29:14 UTC

I filed a FOIA with the FBI earlier this year for all records from Jan 1, 2026 onwards (limited for responsiveness) relating to the Silent ransomware gang, which allegedly sent people to victims' offices to gain physical access to their systems. No records beyond its IC3 flash in May, some withheld. https://www.documentcloud.org/documents/28833639-silent-ransomware-groupfbi-foia/

2026-10-25 14:04:08 UTC

I'm not sure what else I can say about today's ~ this week in security ~ newsletter except to say, it's the "everything is on fire" edition.
Thanks so much for reading, sharing, and subscribing. https://this.weekinsecurity.com/this-week-in-security-october-25-2026-edition/

2026-10-24 16:50:35 UTC

This week was, to put it mildly, a cybersecurity clusterfuck. Every Sunday, I separate all the news from the noise in my free newsletter https://this.weekinsecurity.com, and this week is no exception. All of the stories you need to know, plus a reader-submitted cyber-cat for fun. 🐈‍⬛
Sign up (or RSS) today! No AI use, and no email open/link tracking for your privacy.

2026-10-23 14:23:09 UTC

Former Support King CEO, Scott Zuckerman, a spyware operator who was banned from the surveillance industry by the FTC after a data breach exposed people's private data... has been sued by the FTC *again* for allegedly running a government impersonation scheme for visa and passport seekers.
https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-sues-perpetrators-government-impersonation-scheme-over-deceptive-ads-misleading-promises-fake

2026-10-22 14:31:57 UTC

Railway, a vibe-coding platform for hosting apps and websites, was hacked and customer environment variables (think passwords, API keys, and other sensitive secrets for logging into cloud services and databases) were stolen *and* decrypted.
More: https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/
Bypass for ad-blockers: https://web.archive.org/web/20261022142947/https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/

2026-10-22 14:06:39 UTC

The Trump administration is weaponizing the U.S. government's economic sanctions powers — typically reserved for international criminals, hackers, and terrorists — to target its critics and political opponents, such as crimes investigators, and now a web host, forcing it to shut down. https://this.weekinsecurity.com/it-sure-looks-like-the-trump-administration-is-weaponizing-sanctions-to-silence-its-critics/

2026-10-22 11:11:40 UTC

Medical testing giant Quest Diagnostics said it's been hit by a cyberattack & has paused its Quanum LSM system that some of its customers use for placing tests & looking up results. In an SEC filing, the company said it believes hackers "accessed certain patient records." https://www.sec.gov/ix?doc=/Archives/edgar/data/0001022079/000094787126000941/ss6979200_8k.htm

2026-10-21 13:23:53 UTC

People who are sanctioned, like ICC judges investigating war crimes, get cut off from the U.S. — online accounts close, domain names vanish, and credit cards stop working.
Now with the forced shut down of a web host, there's never a better time (or a better reason) to rely less on American tech.
More: https://this.weekinsecurity.com/it-sure-looks-like-the-trump-administration-is-weaponizing-sanctions-to-silence-its-critics/

2026-10-19 14:28:03 UTC

Incredible reporting from @nprofile…2v4y on how local governments and police departments are able to secure Flock contracts without notifying the public. In several cases, the government bids were *just* under the threshold for public disclosure and council votes, which oftentimes probably would have voted them down.
https://www.nbcnews.com/tech/security/flock-cameras-safety-surveil-spread-location-where-contract-town-city-rcna595745
https://files.mastodon.social/media_attachments/files/117/468/031/020/118/051/original/546f0b67946b75ff.png

2026-10-17 14:17:02 UTC

Every Sunday, I sift through the most important and consequential stories in cybersecurity, national security, and privacy. My newsletter https://this.weekinsecurity.com covers all the news, research, hacks, and cyberattacks you need to know; plus, a new reader-submitted cyber-cat every week. 🐈‍⬛ Sign up/RSS today.

2026-10-16 13:48:01 UTC

You used to rely on MapQuest for printing out driving directions before GPS navigation was a thing. Now it's helping to fight mass surveillance. https://this.weekinsecurity.com/mapquest-now-lets-you-locate-nearby-surveillance-cameras-like-flock/

2026-10-15 14:49:53 UTC

FYI I have a detailed guide for paid subscribers of ~ this week in security ~ about why ad-blockers are a top tool in your online security and privacy defenses, how they work, and which ones are some of the best. https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/

2026-10-15 13:24:16 UTC

NEW: Governments are abusing online ads to infect people's phones and computers with zero-click spyware, per Citizen Lab. Al Jazeera had ~45 devices hacked this way, simply by visiting a website that displayed a malicious ad. Researchers say it's tip of the iceberg.
Read more: https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/
Ad-block bypass: https://archive.is/Smm3d

2026-10-15 04:13:56 UTC

During the interview, Flock CEO Garrett Langley deflected hard questions about the criticism Flock now faces... he tended to respond to questions with anecdotes from conversations and claims of crimes solved "rather than offer tangible solutions to people’s concerns." — @nprofile…jegr analysis on Flock CEO's interview.
"But pressed about abuse and the invasiveness of his company’s surveillance technology, Langley had no substantive answers."
Read more: https://techcrunch.com/2026/10/14/flock-ceo-defends-surveillance-technology-amid-national-backlash-we-shouldnt-pause-progress/

2026-10-14 21:36:45 UTC

Flock CEO Garrett Langley said the company's gunshot-detecting microphones (also deployed in U.S. cities) detect "just gunshots." Its website paints a much broader picture of the kind of ambient audio that its microphones pick up.
More: https://techcrunch.com/2026/10/14/flock-ceo-says-its-microphones-detect-just-gunshots-its-website-says-different/
Bypass for ad-blockers: https://archive.is/S06tI

2026-10-11 14:58:22 UTC

In this week's newsletter: The FBI closes in on the ShinyHunters hackers... Bad week if you're a ransomware negotiator... or Danish... or have a bank account in South Korea, or cyber in Japan. Plus: Hackers announce Asos' breach to customers via in-app notification; Flock cuts staff, and more.
Also: A CIA officer pleads guilty to using a fake secret program to steal $194M+ and hundreds of gold bars.
Plus a very cute, brand new reader-submitted cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-october-11-2026-edition

2026-10-09 15:15:52 UTC

NYT reports that the FBI have arrested a man in Pennsylvania, who is a Canadian citizen, on suspicion of carrying out the hack last month that exposed tens of thousands of FBI agents' personal information. https://www.nytimes.com/2026/10/09/us/politics/fbi-hack-shinyhunters-arrest.html

2026-10-09 13:51:44 UTC

Flock confirms it's cutting staff, as the company faces mounting backlash over its surveillance technology. When asked by TechCrunch, a Flock spokesperson wouldn't say if chief executive Garrett Langley took a pay cut as part of the workforce reduction.
By me: https://techcrunch.com/2026/10/09/surveillance-company-flock-cuts-staff-as-privacy-backlash-grows/
Bypass for ad-blockers: https://archive.is/epjKf

2026-10-07 15:07:34 UTC

Whether it's coincidence or just bad timing, the two recent data breaches of U.S. government personnel records comes after extensive cuts and layoffs at CISA, NSA, and the broader federal workforce. The White House can't now argue that less cybersecurity talent is better at protecting federal data. https://this.weekinsecurity.com/what-can-we-learn-from-the-data-breaches-of-fbi-and-pentagon-personnel-records/

2026-10-07 12:56:16 UTC

By me: I dug into the recent data breaches affecting U.S. military and FBI agents' personnel records, and found that multiple things went wrong over the course of several months that gave the hackers an advantage.
What can we learn from the U.S. government's cybersecurity mistakes?
Read more: https://this.weekinsecurity.com/what-can-we-learn-from-the-data-breaches-of-fbi-and-pentagon-personnel-records/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com/

2026-10-06 16:02:06 UTC

Good to see LibreOffice leaning into "no AI" as a software feature. https://techcrunch.com/2026/10/06/libreoffice-says-no-ai-is-now-a-software-feature/
Bypass for ad-blockers: https://web.archive.org/web/20261006154328/https://techcrunch.com/2026/10/06/libreoffice-says-no-ai-is-now-a-software-feature/

2026-10-06 13:49:07 UTC

That's one way to get a hacked company's attention. https://www.bbc.com/news/articles/cj62ylzpr6d3o (image via Bluesky)
https://files.mastodon.social/media_attachments/files/117/394/277/644/955/306/original/cab59603f160cbaf.png

2026-10-04 13:20:21 UTC

This was one of the busiest and most consequential weeks in cybersecurity in some time! I have a *packed* newsletter with everything you need to know from the past seven days of hacks, breaches, cyberattacks, crime, research, threats, and more.
Sign up/RSS to get the newsletter when it lands today: https://this.weekinsecurity.com/

2026-10-02 15:09:11 UTC

Wise words (as always) from Bruce Schneier: "Once we normalize a surveillance infrastructure, both friends and foes will take advantage of it." https://www.schneier.com/blog/archives/2026/10/unidentified-flock-cameras-in-florida.html

2026-10-02 12:11:14 UTC

"Microsoft has confirmed its X account has been compromised."
https://www.theverge.com/news/1003892/microsoft-x-twitter-account-clippy

2026-10-01 12:43:08 UTC

For my newsletter and blog, I break down how the anatomy of a voice-phishing call that allowed a hacker to steal millions of people's data. Voice phishing attacks are *highly* effective, and remain the go-to hacking technique by some of the most prolific hacking groups — no AI needed.
Read on! 🐈‍⬛ https://this.weekinsecurity.com/fear-the-phone-call-hackers-are-calling-for-your-personal-data/

2026-09-30 19:35:31 UTC

New, by me: The Pentagon is notifying millions of current and former U.S. military servicemembers and staff that hackers stole their *unencrypted* personal information during a months-long data breach. The agency that had the breach also handles ID and login/credential access to U.S. military systems and bases.
More: https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach/
Bypass for ad-blockers: https://web.archive.org/web/20260930193237/https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach/

2026-09-30 17:58:51 UTC

This is a major blow to the open web! For as long as I can remember, Reddit has embraced RSS feeds and public API access to users, apps, and developers, allowing the site to thrive. To start choking access after decades of open doors is really sad and feels like the start of Reddit's demise. https://techcrunch.com/2026/09/30/reddit-is-killing-rss-feeds-ending-public-api-access-because-of-ai-bots/

2026-09-30 13:52:33 UTC

New, by me for paid subscribers of ~ this week in security ~
I explore in this deep-dive blog how voice phishing — literally hackers calling people up and tricking them into giving over their passwords — has become a major underestimated threat. Hackers are breaching big tech giants to the tune of millions of people's data. 🐈‍⬛
More: https://this.weekinsecurity.com/fear-the-phone-call-hackers-are-calling-for-your-personal-data/

2026-09-29 17:33:43 UTC

New: FBI have confirmed Dutch police arrested a 24 y/o man in Amsterdam for being one of the "alleged leaders" of the ShinyHunters hacking gang. After seizing his laptop, Dutch authorities say he also had documents planning two murders.
More: https://techcrunch.com/2026/09/29/dutch-police-arrest-shinyhunters-hacker-accused-of-planning-two-murders/
Bypass for ad-blockers: https://web.archive.org/web/20260929173008/https://techcrunch.com/2026/09/29/dutch-police-arrest-shinyhunters-hacker-accused-of-planning-two-murders/

2026-09-28 14:56:03 UTC

This is more really important reporting here. It's not enough to just warn of the privacy risks, 404 is out there proving that it's actually happening. Also a reminder that what you upload to AI bots and whatnot is not private, and there's a real cost/toll on the people working behind the scenes. https://www.404media.co/humans-reading-copilot-prompts-images/

2026-09-27 19:56:16 UTC

CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

2026-09-27 15:44:50 UTC

In my latest newsletter: FBI declared cyber incident over agents' data breach; North Korea scores a new record-breaking crypto theft; Denmark spy agency on Russia's hybrid war; Kiteworks urges customers to shut down servers fearing hacking threat; at least two suspected NetScaler bugs exploited in the wild; and more. Plus: Hacker Drama between ShinyHunters and Clop, and much more.
Also: a very cute reader cyber-cat. 🐈‍⬛
Read online: https://this.weekinsecurity.com/this-week-in-security-september-27-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-09-26 13:57:43 UTC

It's been an *insanely* busy week in cybersecurity.
Need a catchup of all the top and most important stories that you need to know, hand-picked and written by a human (me 👋) ...plus, a roundup of good news, and a reader-submitted cyber-cat (or friend)? 🐈‍⬛
Sign up/RSS for my free weekly newsletter. No email open/link tracking (because privacy!): https://this.weekinsecurity.com

2026-09-26 13:43:12 UTC

The theft of the FBI agents/applicants' personal data is quickly becoming a major counterintelligence headache. I'm also aghast at how close to the internet this data was held. Call me old fashioned but some data shouldn't be stored in the cloud at all. https://www.reuters.com/world/shinyhunters-hackers-say-they-stole-psychiatric-medical-records-fbi-staff-2026-09-25/

2026-09-25 16:02:11 UTC

New, by me: Kiteworks (formerly Accellion) is urging customers to shut down their servers amid a threat of "imminent" cyberattack as soon as this weekend. Kiteworks' CISO confirmed the alert. An email to customers warns of a possible zero-day bug.
More: https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/
Ad-block bypass: https://web.archive.org/web/20260925155811/https://techcrunch.com/2026/09/25/kiteworks-urges-customers-to-shut-down-their-servers-amid-imminent-threat-of-cyberattack/

2026-09-25 13:34:54 UTC

North Korean hackers are suspected of being behind a $351 million heist from crypto exchange Bitget last night. The theft is a record-breaking amount for this year. https://www.theblock.co/news/markets/2026-09-24-more-than-170-million-in-crypto-moves-from-bitget-wallets-unidentified-address-416345

2026-09-24 12:44:35 UTC

Special shout-out to area shitbag Ben Halpern (ben@forem.com) and his team of arseholes who published fake AI-generated slop attached to my name on their site. I did not (nor would I) write this AI slop shit, and would encourage all to be mindful for fake bylines on shitty websites like this one.
https://files.mastodon.social/media_attachments/files/117/326/072/903/980/881/original/a42a35730696d57a.png

2026-09-23 11:31:26 UTC

FBI tells me it's "aware of claims" of a hack affecting its jobs site and is "currently investigating.”
ShinyHunters, meanwhile, tell me that they are confident that they have data "on mostly all of FBI" and a substantial amount of applicants' data.
More: https://techcrunch.com/2026/09/22/hacking-group-shinyhunters-claims-it-breached-the-fbi-stole-agents-and-applicants-data/
Ad-block bypass: https://web.archive.org/web/20260923112736/https://techcrunch.com/2026/09/22/hacking-group-shinyhunters-claims-it-breached-the-fbi-stole-agents-and-applicants-data/

2026-09-22 17:53:59 UTC

"We're sniffing out site updates for you!" is definitely one way to say "we were hacked and thousands of FBI agents and applicants had their information stolen." https://www.404media.co/we-hacked-the-fbi-hackers-say-they-have-data-on-all-fbi-employees/
https://files.mastodon.social/media_attachments/files/117/315/962/454/199/456/original/dbde39c88e61e167.png

2026-09-20 14:28:51 UTC

In my latest weekly cyber newsletter: Flock cameras are old and flawed, Coast Guard and FBI board hacked oil tankers, ClickFix hacks went viral, U.S. confirms it launched space weapons into orbit, a Google researcher infiltrated a hacking group, and why a digital fly brain had a great week. Plus, a brand new reader-submitted cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-september-20-2026-edition/
Sign up/RSS/subscribe: https://this.weekinsecurity.com

2026-09-11 13:01:47 UTC

Took this photo last night facing Manhattan of the twin beams of light in remembrance of today. Sending love and peace to everyone.
https://files.mastodon.social/media_attachments/files/117/252/518/928/910/085/original/39a78763994f66d8.jpeg

2026-09-03 16:13:20 UTC

U.S. attorney general Todd Blanche said the DOJ will "track down the criminals" behind the week-ass mass password reset attempt on X this week... but won't release the Epstein Files.
https://files.mastodon.social/media_attachments/files/117/207/985/777/875/685/original/c61517354e9ab277.png

2026-09-03 13:53:01 UTC

FBI tells me it's investigating the suspected breach at IDScan after a crime site let anyone to search the driver's licenses of 150+ million people, including the Secretary of Defense Pete Hegseth. A DOD spox. told me it's aware and "evaluating" the report.
Krebs' report: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
My story on TechCrunch: https://techcrunch.com/2026/09/02/it-sure-looks-like-hackers-breached-a-major-id-card-verification-service/
(Bypass for ad-blockers: https://archive.ph/5xFMq)

2026-09-03 12:12:42 UTC

Today's tech landscape is basically "the floor is lava" for trying to avoid fascism.
#nevent1q…p0tz

2026-08-30 14:10:28 UTC

In my latest ~ this week in security ~ newsletter: Medical device maker Boston Scientific hit by destructive hack; Aussie cops nab TeamPCP hackers; GTA 6 leaks are breaking the web; how journalists used a website bug to trace a prolific scammer; and the DOJ walks back Chinese botnet hack claims; plus, much more this week.
Read online: https://this.weekinsecurity.com/this-week-in-security-august-30-2026-edition/
Sign up/RSS/subscribe to support: https://this.weekinsecurity.com

2026-08-29 03:03:35 UTC

The elusive Toby wishes you a peaceful evening.
https://files.mastodon.social/media_attachments/files/117/176/573/050/903/222/original/65b05aa70d130999.jpeg

2026-08-25 22:31:52 UTC

The ferry from Manhattan to Jersey City was blasting Dolly at full volume tonight.
https://files.mastodon.social/media_attachments/files/117/158/517/712/739/911/original/55d807043cfea68c.jpeg

2026-08-23 14:37:54 UTC

In today's ~ this week in security ~ newsletter:
New details emerge about the hack that took down encrypted phone network Encrochat; an "unprecedented" number of Apple users got the recent spyware alert; Wirecutter hired a hacker to take on Wyze; and the hidden debt that Apple owes the CIA. Also: T-Mobile literally cut off Salt Typhoon in 2024; and much more.
Plus: a brand new (very cute) cybercat.
Read online: https://this.weekinsecurity.com/this-week-in-security-august-23-2026-edition/
Sign up/RSS/subscribe: https://this.weekinsecurity.com

2026-08-22 12:45:06 UTC

Tech giants and telcos are at war with residential proxy networks, which let hackers use your home/office internet connections for cyberattacks. In my latest, I explore why resproxies are a risk to you and your devices, how they enable crime, & what you can do to find and remove them.
Thanks so much to paid subscribers for supporting deep-dives like this one.
Read more: https://this.weekinsecurity.com/how-residential-proxy-networks-are-hiding-hackers-in-your-home
Sign up to my weekly newsletter: https://this.weekinsecurity.com

2026-08-21 14:00:52 UTC

Good morning from this snoozy boy.
https://files.mastodon.social/media_attachments/files/117/133/859/084/147/546/original/3c7d1fed3bc88886.jpeg

2026-08-21 13:45:31 UTC

New, by me: Private equity giant Apollo Global confirms hackers stole personal information, including Social Security numbers, during a July breach. This hack comes after Google researchers warned that an extortion crew was targeting financial giants.
More: https://techcrunch.com/2026/08/21/private-equity-firm-apollo-confirms-data-breach-amid-hacking-wave-targeting-financial-giants/
Ad-block bypass: https://archive.is/BucaL (Wayback is broken)

2026-08-19 15:54:37 UTC

Trump just told the White House pool that Kim Jong Un has "57 very powerful nuclear weapons," in case anyone, or country, is keeping track.

2026-08-18 20:10:29 UTC

Had a great time chatting & getting nerdy w/ Drew & JJ on how I use Burp Suite to find major security bugs in popular websites and apps (and earned me a CVE); how I approach data breach reporting; and why bullshit marketing claims about security puts people at risk. Plus, stick around to find out which company I say has a "perfect" privacy policy.
https://www.youtube.com/watch?v=df6vhUo1KnU
https://packetpushers.net/podcasts/packet-protector/pp122-using-burp-suite-to-understand-how-apps-collect-and-share-our-data/

2026-08-18 16:48:37 UTC

By enabling the new Xfinity Wi-Fi motion sensing tech, Comcast says it may disclose information generated from a customer’s use of the feature to outside parties under a broad array of reasons — and Comcast also says it doesn’t have to tell you.
More: https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/
Ad-block bypass: https://web.archive.org/web/20260818164350/https://techcrunch.com/2026/08/18/comcast-adds-motion-sensing-to-millions-of-its-newer-routers-with-a-privacy-catch/

2026-08-18 11:43:50 UTC

Not content with Meta making camera-equipped pervert glasses, now Apple is making camera-equipped headphones. PervertPods.
https://www.macrumors.com/2026/08/17/camera-equipped-airpods-macos-26-7/

2026-08-15 17:47:16 UTC

Don't fuzz the danger zone. #CatsOfMastodon
https://files.mastodon.social/media_attachments/files/117/100/775/526/427/612/original/0ab6476016e8aa3b.jpeg

2026-08-15 11:38:23 UTC

An absolutely insane story about when U.S. sanctions go wrong and seemingly name the wrong person.
https://conic.al/writing/the-other-sean-byrne-doesnt-exist/

2026-08-14 21:28:45 UTC

I wrote a few words about a brilliant investigation by Laura Shin, who asked a suspected North Korean spy during a job interview: "Can you say something negative about Kim Jong Un?" It's a surprisingly effective tactic that works even today as companies face the growing threat from fake North Korean IT workers.
https://this.weekinsecurity.com/this-quick-question-can-still-expose-north-korean-spies-in-an-instant/

2026-08-13 21:53:54 UTC

New, by me: Apple told me it's sending out threat notifications to customers in 110 countries saying they've been targeted with spyware. This latest batch also features a new push notification, warning users to take action and what to do next.
More: https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/
Ad-block bypass: https://web.archive.org/web/20260813215216/https://techcrunch.com/2026/08/13/if-apple-sends-you-a-push-notification-alerting-you-to-a-spyware-attack-take-it-seriously/

2026-08-11 13:42:01 UTC

FBI is investigating how a North Korean IT worker ended up working for a U.S. federal government agency, per an FBI official at a D.C. conference.
https://federalnewsnetwork.com/cybersecurity/2026/08/fbi-investigating-north-korean-remote-it-staffer-working-for-u-s-agency/

2026-08-10 11:29:07 UTC

Bill Swearingen spent the past year developing a pattern that can defeat being detected by surveillance cameras, including vehicles and people. At Def Con, for the first time, he demoed the pattern printed on a car against a Flock camera to prove it works. (One of my favorite talks from Def Con this year!)
More by me at TechCrunch: https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/
Ad-blocker bypass: https://web.archive.org/web/20260810033558/https://techcrunch.com/2026/08/09/this-adversarial-pattern-can-prevent-surveillance-cameras-from-detecting-you/

2026-08-08 22:57:05 UTC

FYI, probably the busiest https://this.weekinsecurity.com newsletter in a while dropping tomorrow, plus bonus bits on the blog and more. 🐈‍⬛
Sign up/RSS. (No email open/link tracking, because ew.)

2026-08-07 22:05:19 UTC

Microsoft wins "lamest vendor response" award at this year's Pwnie Awards, for publishing a blog post earlier this year threatening security researchers with legal action if they published zero-days.
Also: Meta wins "epic fail" award after its Meta AI hijack bug.
By me: https://this.weekinsecurity.com/microsoft-wins-lamest-vendor-at-pwnie-awards-2026-for-threatening-security-researchers-with-legal-action/

2026-08-07 21:12:47 UTC

Two researchers scanned Poland's internet out of a sense of patriotism and a desire to make it more secure, and found thousands of gov't and public bodies were at risk of very easy hacks. One bug let them take over two-thirds of Poland's court websites.
More: https://techcrunch.com/2026/08/07/security-researchers-scanned-the-polish-web-and-found-courts-hospitals-and-airports-at-risk-of-hacks/
(Bypass for ad-blockers: https://archive.is/pDB7Q)

2026-08-07 13:15:27 UTC

This was really important, powerful reporting by @nprofile…9hwj.
The US military’s cyberwarfare unit is scrutinizing an unusually high number of deaths by suicide among personnel over a month-long period this summer, according to government officials and other people familiar with the matter.
https://www.bloomberg.com/news/articles/2026-08-06/us-military-s-cyber-command-unit-grapples-with-cluster-of-deaths-by-suicide

2026-08-04 21:28:37 UTC

Another AI test gone awry, U.K. edition.
"An agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code."
More: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

2026-08-04 20:29:23 UTC

- reply

I wrote a very deep-dive for subscribers about how ad-blockers work, and why they're so effective at preventing web tracking, location surveillance, and malvertising. I also offer my favorite ad-blocker, and explore browser extensions and network-level ad-blockers. Check it out.
More: https://this.weekinsecurity.com/why-ad-blockers-are-a-top-security-and-privacy-defense-for-everyone/

2026-08-04 12:15:22 UTC

By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.
More: https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/
Sign up (or RSS!) for the weekly newsletter: https://this.weekinsecurity.com

2026-08-04 11:18:54 UTC

If there's one thing I've learned from publishing this story is that there is a very, very, very wide chasm between what the law says about all this... and what people *think* the law says and/or *should* say.
#nevent1q…eygt

2026-08-03 19:53:14 UTC

After Anthropic and OpenAI both admitted to their AI models hacking other companies, @nprofile…ynf4 and I wanted to find out: Who is legally to blame when an autonomous AI agent hacks something? Lawyers say it's really complicated; one called it "uncharted territory."
Read more: https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/
Bypass for ad-blockers: https://web.archive.org/web/20260803194912/https://techcrunch.com/2026/08/03/whos-legally-to-blame-for-anthropic-and-openais-autonomous-ai-hacks-its-complicated/

2026-08-03 12:36:35 UTC

New, by me: Samsung has banned smart TV apps that enlist owners' internet connections into residential proxy networks, which are increasingly linked to cybercrime. Samsung told me it's also removing apps containing resproxy code.
This comes as new research by Mnemonic found Samsung promoted barebone apps as "editor's choice," which allowed outsieders to rent access to a Samsung smart TV's internet connection.
Read more: https://techcrunch.com/2026/08/03/samsung-bans-smart-tv-apps-that-share-users-internet-connections-with-strangers/
Bypass for ad-blockers: https://web.archive.org/web/20260803121659/https://techcrunch.com/2026/08/03/samsung-bans-smart-tv-apps-that-share-users-internet-connections-with-strangers/

2026-07-31 11:01:40 UTC

- reply

@nprofile…524c we don't know that it hasn't happened already!

2026-07-31 11:00:08 UTC

- reply

Anthropic said its investigation was consistent with its "blameless postmortem culture." Bullshit! There's absolutely blame here; both OpenAI and Anthropic published blog posts literally detailing their crimes. If companies can't keep their own dangerous tech safe, they should face the consequences.

2026-07-31 10:47:50 UTC

I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

2026-07-30 20:35:06 UTC

CareCloud, which stores patients' medical records for 45,000+ hospitals & healthcare providers across the U.S., has begun notifying hundreds of thousands of people that their data was stolen in a March breach. The notices reveal new details, and the number of affected people is expected to rise.
More, by me: https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/
Bypass for ad-blockers: https://web.archive.org/web/20260730203017/https://techcrunch.com/2026/07/30/carecloud-begins-to-notify-hundreds-of-thousands-after-hackers-stole-medical-records/

2026-07-30 13:42:42 UTC

The U.S. FTC has sued Hims & Hers, which prescribes for sexual wellness and mental health conditions, alleging the company shared customers' sensitive medical data with advertising giants Meta and Snap through hidden website pixels.
More: https://techcrunch.com/2026/07/30/ftc-sues-hims-hers-for-allegedly-sharing-patients-medical-data-with-advertisers-meta-and-snap/
Bypass for ad-blockers: https://web.archive.org/web/20260730133200/https://techcrunch.com/2026/07/30/ftc-sues-hims-hers-for-allegedly-sharing-patients-medical-data-with-advertisers-meta-and-snap/

2026-07-26 14:10:27 UTC

In my latest weekly cyber newsletter: OpenAI admits to hacking Hugging Face, millions of cars with hidden alarms vulnerable to hacking, Iran's hacking water and energy systems, Russia's targeting nuclear scientists with an email zero-day, a healthcare hack sparks data theft fears, and much more.
Read online: https://this.weekinsecurity.com/this-week-in-security-july-26-2026-edition/
Sign up/RSS and support: https://this.weekinsecurity.com

2026-07-24 23:56:41 UTC

Incredibly detailed reporting by @nprofile…d3mc et al at Reuters on the OpenAI hack of Hugging Face, revealing new details on how it went down and how it took a week for OpenAI to notice one of its AI models was hacking into another company, citing multiple sources.
More: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/

2026-07-24 18:08:25 UTC

- reply

The person's attorney said feds are using a rarely used federal statute, and security experts said they hadn't heard of similar cases. This raises fresh questions about constitutional rights and device searches at the U.S. border.
Also: the DOJ's indictment had a notable typo. Read on for more.
https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search

2026-07-24 18:06:18 UTC

New, by me: The Justice Department is prosecuting an American for allegedly providing U.S. border agents with a "duress" passcode that wiped the contents of his phone when they entered it. We've confirmed the phone was running GrapheneOS.
Read more: https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search
Bypass for ad-blockers: https://web.archive.org/web/20260724175443/https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/

2026-07-22 12:03:33 UTC

Most popular smart watches and fitness trackers aren't end-to-end encrypted, nor say how often governments demand access to users' data.
My argument: If wearable makers don't want to disclose that they're turning over users' data to the feds, then the obvious fix is to end-to-end encrypt it.
More: https://this.weekinsecurity.com/most-fitness-wearables-lack-end-to-end-encryption-and-lack-transparency-reports/

2026-07-21 14:59:36 UTC

Woof. That data breach at Suno last year, but only just disclosed last week, affected over 55 million users, including their names, physical addresses, and phone numbers, according to Have I Been Pwned.
More: https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/
Bypass for ad-blockers: https://web.archive.org/web/20260721144937/https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/

2026-07-20 15:04:53 UTC

New, by me: A tech company called Craneware says it was hacked and that a "significant" amount of data stolen, including its customers. The company provides software to thousands of U.S. clinics, hospitals, and pharmacies around the world, sparking fears of a data breach of patient data.
More: https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/
Bypass for ad-blockers: https://web.archive.org/web/20260720150203/https://techcrunch.com/2026/07/20/hackers-stole-significant-amount-of-data-from-tech-firm-relied-on-by-thousands-of-us-hospitals-and-pharmacies/

2026-07-19 15:09:28 UTC

In this week's ~ this week in security ~
Spy vans are coming to U.S. police departments, how a London crew pulled off a brazen datacenter theft, Iran exploited phone bugs to track U.S. troops, Finnish therapy hacker wanted, and most fitness trackers lack basic security features. Also: WordPress bugs under active attack, and why librarians are helping people avoid AI. Plus: A brand new cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-july-19-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-07-17 15:42:27 UTC

This is really bad on its own, but again — it's an absolute travesty that a private company like Thomson Reuters can collect and store massive databases of Americans' private and personal data — from names, addresses, Social Security numbers, ethnicity, social media posts, and location information — and the government can just buy that data, no warrant needed. The data broker industry needs be shut down and privacy rights in the U.S. regulated. https://www.404media.co/ice-to-pay-thomson-reuters-125-million-to-find-voter-fraud/
#nevent1q…3ftq

2026-07-16 22:42:31 UTC

Today's dystopia is sponsored by BritBox, apparently.
https://files.mastodon.social/media_attachments/files/116/932/066/752/682/050/original/9d95361edc632194.jpeg

2026-07-16 21:30:19 UTC

New: Coca Cola discloses ransomware attack on its Fairlife dairy subsidiary, says it's "temporarily suspended" U.S. operations after its production systems were hit. Disruption to dairy systems could see potential product shortages on shelves.
More: https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/
Bypass for ad-blockers: https://web.archive.org/web/20260716212310/https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/

2026-07-16 14:42:32 UTC

- reply

Also, this was great reporting by BBC's @nprofile…43u5 on Mozilla's latest research out today on the many privacy problems with period trackers.
@nprofile…djff, who did the app testing for Mozilla, found one period tracker, Stardust, was sharing users' health data with a third-party.
More: https://www.bbc.com/future/article/20260715-how-period-trackers-share-womens-private-details

2026-07-16 13:00:35 UTC

Fantastic work by @nprofile…lx5n at EFF looking at the state of fitness tracker privacy.
Most wearable makers don't end-to-end encrypt your data, so police/feds (and hackers!) can get your health data — and almost none publish a transparency report, so we may never know if they do.
https://www.eff.org/deeplinks/2026/07/most-smart-watches-rings-and-bands-lack-basic-transparency-reports-and-key-privacy

2026-07-13 20:05:16 UTC

New, by me: Core to its complaint against OpenAI, Apple accused a former employee of allegedly exploiting a security bug to steal reams of confidential files from Apple's network over several weeks while working as an OpenAI employee
“LOL, I found out I can access the [network storage], so funny,” the ex-Apple employee allegedly wrote.
Read more: https://techcrunch.com/2026/07/13/apple-says-former-employee-exploited-rare-bug-to-download-confidential-files-after-leaving-for-openai/
(Bypass for ad-blockers: https://archive.is/rmPlh)

2026-07-13 14:26:33 UTC

New: The LAPD, the third-largest police department in the United States, let its contract with surveillance giant Flock expire this weekend, citing "serious concerns" with civil liberties and privacy.
Flock said it was surprised by the move, but it's not clear if the company's license plate readers will immediately cease recording.
More: https://techcrunch.com/2026/07/13/lapd-lets-contract-with-surveillance-giant-flock-expire-citing-serious-concerns-over-civil-liberties-and-privacy/
(Bypass link for ad-blockers: https://archive.is/zUou2)

2026-07-09 12:50:17 UTC

I think this raises an important point. I moved to the U.S. a few years ago to become a U.S. journalist. I've been very fortunate to have workplaces that let me do my job uninhibited. In America, a person's ability to access healthcare for themselves and their family is almost always linked to their employer. This means U.S. companies, including media outlets, hold way too much power & control over their employees. It's all the more crucial to support independent media.
https://mastodon.social/@randahl/116889333585143994
#nevent1q…04ac

2026-07-08 16:31:26 UTC

There's been *yet another* majot breach of U.S. driver's license numbers. Insurance giant AssuranceAmerica confirmed a breach affecting over 6.9 million people, making it the largest known spill of Americans’ driver’s license data this year.
By me at TechCrunch: https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/
Bypass for ad-blockers: https://web.archive.org/web/20260708162100/https://techcrunch.com/2026/07/08/another-massive-data-breach-exposed-millions-of-drivers-license-numbers/

2026-07-08 12:15:20 UTC

Smart glasses with cameras and microphones built-in and facial recognition to come are the latest fad in surveillance tech.
For my blog & newsletter ~ this week in security ~ I wrote about why the backlash against smart glasses — aka "pervert glasses" — is justified from a security and privacy perspective. Please read and share!
More: https://this.weekinsecurity.com/reframing-smart-glasses-as-pervert-glasses/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-07-07 13:18:55 UTC

The U.S. Army has fixed two of its websites that were hacked to display messages calling President Trump a "pedophile" and a "thief."
More: https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/
Bypass for ad-blockers: https://web.archive.org/web/20260707131135/https://techcrunch.com/2026/07/07/hacktivists-call-out-trump-by-hacking-and-defacing-us-army-websites/

2026-07-07 01:17:53 UTC

Took a photo of this license plate a few days ago while on vacation in Maine, seems apt today.
https://files.mastodon.social/media_attachments/files/116/876/054/582/649/826/original/eff43c120f8718da.jpeg

2026-07-06 14:52:27 UTC

New, by me: Canada's top eavesdropping agency said it conducted "active cyber operations" during 2025 against drug traffickers, a violent extremist group, and a ransomware gang, using offensive hacking operations to disrupt or degrade their ability to function and cause harm.
Read more: https://techcrunch.com/2026/07/06/canadian-spy-agency-says-it-hacked-drug-traffickers-extremists-and-a-ransomware-gang-last-year/
Bypass for ad-blockers: https://web.archive.org/web/20260706144429/https://techcrunch.com/2026/07/06/canadian-spy-agency-says-it-hacked-drug-traffickers-extremists-and-a-ransomware-gang-last-year/