Nostr notes by Catalin Cimpanu

-Moldova takes down 80+ public services after cyberattack -White ...

2026-10-28T08:27:14Z

-Moldova takes down 80+ public services after cyberattack
-White House launches second cybersecurity pilot program
-South Korea arrests AI-assisted cybercrime ring
-Electrum wallet patches crypto-stealing bug
-Keystone destroy 18k wallets after key theft
-US joins France's fridge hack investigation
-Hack at Belgian IT supplier impacts 120 local authorities
-Warp cloud breach
-DreamHost resets passwords
-Blast Mail hacked

N: https://risky.biz/RBNEWS626/
P: https://news.risky.biz/risky-bulletin-moldova-takes-down-80-public-services-after-cyberattack/

"Experts at a digital defense firm recently found that an ...

2026-10-27T12:26:40Z

"Experts at a digital defense firm recently found that an Israeli ad tech company was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them, according to six people familiar with the matter."

https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27/

Elastic's Pavel Yosifovich has reverse-engineered ...

2026-10-27T12:26:12Z

Elastic's Pavel Yosifovich has reverse-engineered Microsoft's new Windows Endpoint Security Platform, an upcoming mechanism through which security tools like EDRs can run on Windows from outside the kernel

https://www.elastic.co/security-labs/blog/windows-endpoint-security-platform-wesp

Knicks Employees Thought They Were Getting Championship Rings. ...

2026-10-24T10:02:02Z

Knicks Employees Thought They Were Getting Championship Rings. The Email Was Reportedly a Phishing Test

https://www.inc.com/amaya-nichole/knicks-employees-thought-championship-rings-email-reportedly-phishing-test/91424668

-Supply chain attack lets ransomware group inside 40+ shipping ...

2026-10-23T10:08:44Z

-Supply chain attack lets ransomware group inside 40+ shipping companies
-Pentagon builds tech sabotage unit
-PHP2Shell exploitation gets underway
-GoDaddy revokes 400,000 certs
-LiteLLM has another security incident
-Breach at cloud providers Railway[.]com, Onamae, and TiBD
-Breach at Iwai Cosmo Securities
-Breaches at Hollys, Capcom, SBI, Save-on-Food, Quest Diagnostics, TAKKT
-Toronto Crime Stoppers stops program after breach

P: https://risky.biz/RBNEWS624/
N: https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies/

I love infosec drama https://phpbleed.com/

2026-10-22T20:12:07Z

I love infosec drama

https://phpbleed.com/

I love infosec drama https://www.php2shell.com/

2026-10-22T20:11:46Z

I love infosec drama

https://www.php2shell.com/

The developer of the StealC infostealer has returned to the ...

2026-10-22T19:20:22Z

The developer of the StealC infostealer has returned to the cybercrime underground with a new (Stadia) RAT after Europol seized StealC infrastructure in June

https://www.varonis.com/blog/stealc-returns

Dutch security firm Eye Security has uninstalled an abandoned ...

2026-10-22T18:39:20Z

Dutch security firm Eye Security has uninstalled an abandoned Popcorn Time piracy app from more than two million PCs

https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/

After this week's incindet, eMuhdra says it will exit the CA ...

2026-10-22T18:07:02Z

After this week's incindet, eMuhdra says it will exit the CA market

https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business

Quad9 will leave France after a court ordered it to block some ...

2026-10-22T18:01:17Z

Quad9 will leave France after a court ordered it to block some piracy sites

https://quad9.net/news/blog/au-revoir-france/

A report from the Alliance4Europe group has found no foreign ...

2026-10-22T16:47:09Z

A report from the Alliance4Europe group has found no foreign threat actor behind the French anti-government protests, but has found disinformation groups taking advantage of them to push various agendas.

https://alliance4europe.eu/report/eu-unrest-report-%c2%b7-how-frances-october-2026-protests-were-manipulated-then-retold-abroad

GoDaddy is revoking 404,000 certificates ...

2026-10-22T14:36:16Z

GoDaddy is revoking 404,000 certificates

https://bugzilla.mozilla.org/show_bug.cgi?id=2083191

Russian APT Sandworm wipes the network of a Ukrainian grain ...

2026-10-22T13:00:39Z

Russian APT Sandworm wipes the network of a Ukrainian grain logistics firm

https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/

TiDB Cloud got hacked: ...

2026-10-22T12:27:15Z

TiDB Cloud got hacked: https://www.pingcap.com/trust-hub/security/security-update-october-2026/

Claimed by FulcrumSec: https://fulcrumsec.vg/pingcap/

You know I'm an idiot because I'm listening to "rain ...

2026-10-22T12:06:57Z

You know I'm an idiot because I'm listening to "rain relaxingsounds" on YouTube while it's literally raining outside

🤣

I... just have no words to defend myself

OpenAI says that two of its agents tampered with its monitoring ...

2026-10-22T11:55:45Z

OpenAI says that two of its agents tampered with its monitoring system to suppress notifications and prevent the company from keeping watch over them

https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring

A hacker has breached Japanese VPS provider Onamae and installed ...

2026-10-22T11:14:39Z

A hacker has breached Japanese VPS provider Onamae and installed malware on more than 26,700 Desktop Cloud servers

Onamae says the hackers sought to steal credentials for trading and securities tools

https://www.onamae.com/news/article/11593

Security firm Straiker has published a write-up on CARLIY0S, an ...

2026-10-22T11:02:05Z

Security firm Straiker has published a write-up on CARLIY0S, an AI-based cyber offensive toolkit used by the CyberCartel group in attacks targeting more than 400+ organizations across LATAM

https://www.straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks

Spotify says it removed more than 50 million AI slop and spam ...

2026-10-22T10:12:20Z

Spotify says it removed more than 50 million AI slop and spam tracks from its recommendations feature

https://newsroom.spotify.com/2026-10-20/prioritizing-human-artistry/

PHP2Shell is now under active exploitation ...

2026-10-21T22:41:33Z

PHP2Shell is now under active exploitation

https://www.linkedin.com/posts/yesterday-information-leaked-about-two-share-7518682504153796609-1os5/

https://x.com/PrevidianCyber/status/2112936591719068048

https://x.com/OliverSild/status/2112823822411866215

https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619

https://blog.cloudflare.com/php-vulnerabilities-waf-protection/

Nostr event nevent1qqsv4ka3t6mwyasq8na7r7xcxudsjhrhna7tgs8a957edw0m5ump7fqzypvp8jcvpzu4gajewmlfsel28zetz5jw8xclwk4j9vexufvr82nkvtafq93

2026-10-21T17:16:34Z

LOL... is half the internet offline because of that PHP bug?

-Hacker hijacks 10% of Tor exit nodes -Second ransomware ...

2026-10-21T08:09:29Z

-Hacker hijacks 10% of Tor exit nodes
-Second ransomware negotiator linked to ShinyHunters
-Hacker leaks AfD internal data
-Chinese crime ring hacks Staples
-PHP RCE leaks online
-Hacker plants malware in OVHCloud app
-Chinese hacker breaches 100+ sites with AI
-Chinese AI agent used in hacks across Japan
-ICO reprimands two Welsh companies for using dumb passwords
-Cyberattack hits LOXONE home automation company

P: https://risky.biz/RBNEWS623/
N: https://news.risky.biz/risky-bulletin-hacker-hijacks-10-of-tor-exit-nodes/

The eMudhra (emSign) CA has been compromised to issue fraudulent ...

2026-10-20T18:27:13Z

The eMudhra (emSign) CA has been compromised to issue fraudulent HTTPS certificates

https://blog.mozilla.org/security/2026/10/20/protecting-firefox-users-following-the-compromise-of-emudhra-intermediate-certificates/

https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2

I'm so confused that the largest info-op that TikTok ...

2026-10-20T17:25:13Z

I'm so confused that the largest info-op that TikTok disrupted in August targeted Haiti with Putin narratives

https://www.tiktok.com/safety/en/transparency/covert-influence-operations

Google Cloud outage takes down Revolut, Lloyds, and other banking ...

2026-10-20T12:55:16Z

Google Cloud outage takes down Revolut, Lloyds, and other banking apps

https://www.businessinsider.com/google-cloud-outage-revolut-halifax-emma-uk-london-2026-10

New Heartbreaker ransomware targets macOS users ...

2026-10-20T03:27:11Z

New Heartbreaker ransomware targets macOS users

https://objective-see.org/blog/blog_0x8A.html

Hackers have accessed the backend database of WordPress plugin ...

2026-10-20T02:05:07Z

Hackers have accessed the backend database of WordPress plugin developer TeamUpdraft, stole connection keys, and then deployed malicious plugins on their sites

https://teamupdraft.com/blog/security-incident-october-2026/

https://www.wordfence.com/blog/2026/10/updraftcentral-connection-key-compromise/

Crypto platform Qubic halted operations after hackers stole $1.4 ...

2026-10-20T00:55:38Z

Crypto platform Qubic halted operations after hackers stole $1.4 million from 1,400 user accounts

Incident traced back to weak randomness on iOS and macOS wallets

https://blockonomi.com/qubic-halts-blockchain-after-1-4-million-hack-drains-1400-wallets/

A new study argues that Canada could develop its own national ...

2026-10-19T21:40:38Z

A new study argues that Canada could develop its own national operating system to replace Microsoft's Windows and still save millions in the process

https://theconversation.com/canada-could-save-millions-by-developing-its-own-operating-system-instead-of-relying-on-microsoft-windows-294027

OVHCloud CLI repo compromised in a supply chain attack ...

2026-10-19T19:48:45Z

OVHCloud CLI repo compromised in a supply chain attack

https://www.thestack.technology/ovhcloud-cli-repo-compromised-customer-reports-incident/

Palo Alto CEO wants AI labs out of the ‘fear-mongering ...

2026-10-19T17:18:30Z

Palo Alto CEO wants AI labs out of the ‘fear-mongering business’

https://finance.yahoo.com/technology/ai/articles/palo-alto-ceo-wants-ai-161700466.html

Two Serbian opposition figures targeted with spyware, research ...

2026-10-19T13:28:23Z

Two Serbian opposition figures targeted with spyware, research group says

https://www.newsobserver.com/news/nation-world/world/article317680738.html

-PwnEscape vulnerability lets you escape KVM -Supply chain ...

2026-10-19T08:33:59Z

-PwnEscape vulnerability lets you escape KVM
-Supply chain incidents at AOMEI and ConnectWise
-Intel discontinues SGX
-US infosec job postings fell by 25%
-OpenCode abused for distillation attacks
-Cyberattack impacts US bankruptcy courts
-Cyberattack hits Romania's stock market agency
-Cali DoE breach impacts 7m California students
-Burger King Japan hack impacts 11.2m customers
-South Korea fires employee who sold patient data

N: https://news.risky.biz/risky-bulletin-pwnescape-vulnerability-lets-you-escape-kvm/
P: https://risky.biz/RBNEWS622/

GitHub has expanded its Malware Advisories database to cover ...

2026-10-18T17:53:37Z

GitHub has expanded its Malware Advisories database to cover eight package repositories.

Starting last week, the database also includes warnings for malicious packages on PyPI, Maven, RubyGems, NuGet, Go, Rust Crates, and PHP Composer... on top of npm

https://openssf.org/blog/2026/10/16/case-study-github-expands-malware-advisories-across-eight-ecosystems-with-openssf/

More than 80 Romanian government institutions kept buying ...

2026-10-18T17:34:32Z

More than 80 Romanian government institutions kept buying Kaspersky security software even after the government banned it in March 2023.

According to Romanian journalists, buyers include city halls, hospitals, schools, and even a military and NATO research institute

https://publicrecord.ro/2026/10/16/antivirus-kaspersky-institutii-publice-rusia/

Hackers backdoored backup provider AOMEI in a novel, ...

2026-10-18T12:23:36Z

Hackers backdoored backup provider AOMEI in a novel, first-of-its-kind supply chain attack.

Hackers replaced backup software on the company's servers in short bursts of five to ten minutes.

The bursts took place across multiple windows between May and July.

https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/

The Python Software Foundation has rolled out email reputation ...

2026-10-18T09:56:49Z

The Python Software Foundation has rolled out email reputation checks for all new PyPI accounts

The measure specifically targets disposable email providers

It also restored the ability to register PyPI accounts with Outlook and Hotmail domains, blocked in 2024

https://blog.pypi.org/posts/2026-10-16-email-reputation-and-outlook/

A cyberattack has hit Romania's Central Depositary, the ...

2026-10-18T08:23:58Z

A cyberattack has hit Romania's Central Depositary, the agency that handles Romania's stock market transactions.

The attack targeted the agency's online user portal and stole data on all registered users.

https://www.economica.net/ultima-ora-atac-informatic-la-bursa-aplicatia-depozitarului-central-unde-sunt-inclusiv-datele-cuponarilor-blocata-ce-trebuie-sa-faca-investitorii-si-ceilalti-utilizatori_986227.html

German police have detained a Russian man behind the 2024 ...

2026-10-16T20:49:36Z

German police have detained a Russian man behind the 2024 Synnovis hack

https://www.bbc.com/news/articles/c9vgr61kml3mo

-Russia arrests DataSuckers hacking group -Ad company delivered ...

2026-10-16T08:12:33Z

-Russia arrests DataSuckers hacking group
-Ad company delivered zero-click exploits and spyware
-OpenAI employee arrested for planting spy device
-US disrupts 40 DPRK laptop farms
-Cyberattack halts Danish-German tunnel construction
-Bug exposes Czech business registry data
-Hackers leak photos from Netanyahu campaign personnel
-Thailand arrests 39 scammers after visa reviews
-FTC sues a sextortion assistance provider

N: https://news.risky.biz/risky-bulletin-russia-arrests-datasuckers-hacking-group/
P: https://risky.biz/RBNEWS621/

A cyberattack has halted construction on a tunnel between Denmark ...

2026-10-15T17:10:13Z

A cyberattack has halted construction on a tunnel between Denmark and Germany

https://femern.com/da/presse/nyheder/hovedentreprenor-pa-femern-projektet-ramt-af-cyberhaendelse/

https://www.dk-sundhed.dk/ritzau/1f0b6211-3397-4869-98aa-a2e87f289545

Israeli ad company helped a spyware firm target Al Jazeera ...

2026-10-15T10:41:40Z

Israeli ad company helped a spyware firm target Al Jazeera through online ads

Researchers say Discover-Tech used online ads to deliver zero-click spyware, the first public evidence of the technique, with its ads reaching nearly 200,000 websites and apps

https://www.nbcnews.com/tech/security/israeli-ad-company-helped-spyware-firm-target-al-jazeera-online-ads-re-rcna602999

Despite being sanctioned into oblivion by the US, the UK, and ...

2026-10-15T00:48:05Z

Despite being sanctioned into oblivion by the US, the UK, and others, the Aeza bulletproof hosting provider is still operating under seven new identities

https://www.qurium.org/press-releases/aeza-infrastructure-thrives-despite-sanctions/

Looks like Check Point has left the Russian market ...

2026-10-14T23:57:22Z

Looks like Check Point has left the Russian market

https://tass.ru/ekonomika/28211161

Ahsay patches two zero-days spotted last week by Huntress: ...

2026-10-14T22:24:48Z

Ahsay patches two zero-days spotted last week by Huntress:

https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update

https://www.huntress.com/blog/ahsaycbs-flaws-exploit

Wow... Twitter suspended some influence operations clusters for ...

2026-10-14T21:22:21Z

Wow... Twitter suspended some influence operations clusters for the first time in years

https://x.com/GlobalAffairs/status/2110430142199644314

Nextcloud patches zero-day exploited last month ...

2026-10-14T19:38:43Z

Nextcloud patches zero-day exploited last month

https://github.com/CollaboraOnline/richdocumentscode/issues/354#issuecomment-6164261298

-Spyware chip found in Ledger crypto-wallets -Cyberattack ...

2026-10-14T08:10:28Z

-Spyware chip found in Ledger crypto-wallets
-Cyberattack defrosts supermarket fridges
-Ahold Delhaize supermarkets go offline across the world
-EU wants smart glasses to beep loudly when recording
-Meta discloses security breach
-H&M denies hack
-Foschini Group also got hacked
-Papertrade hacked for $1.28m
-79th Vault hacked for $12.5m
-UK Housing Ombudsman data breach
-US Fiji embassy also hacked
-Meta lets its AI agent generate porn

N: https://news.risky.biz/risky-bulletin-spyware-chip-found-in-ledger-crypto-wallets/
P: https://risky.biz/RBNEWS620/

New Ivanti zero-day ...

2026-10-13T16:56:13Z

New Ivanti zero-day

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US

French authorities have arrested three teenagers who built and ...

2026-10-13T15:36:03Z

French authorities have arrested three teenagers who built and ran a platform that allowed users to search through hacked and stolen data.

The service launched in March under the name of Reacher and rebranded to Stryx in June.

PDF: https://www.tribunal-de-paris.justice.fr/sites/default/files/2026-10/2026-10-09%20CP%20Stryx.pdf

-28 arrests in Ghana and Nigeria -$11 million seized -3.7 million ...

2026-10-13T15:18:34Z

-28 arrests in Ghana and Nigeria
-$11 million seized
-3.7 million accounts suspended

https://www.justice.gov/usao-dc/pr/department-justice-announces-results-law-enforcement-and-private-industry-joint

quoting
nevent1q…gpw7
There's a major announcement from the UK NCA and US DOJ later today on some sort of cyber fraud crackdown

Data collected by Poland law enforcement through the Pegasus ...

2026-10-13T12:55:30Z

Data collected by Poland law enforcement through the Pegasus spyware was also sent outside the country's borders, a Parliament commission finds

https://ua.news/en/world/tusk-nazvav-peredavannia-danikh-pegasus-za-kordon-zlochinom-proti-derzhavi-anadolu-agency

TL;DR: A new hacker going by Hasanbr0ker has come forward to ...

2026-10-13T10:38:38Z

TL;DR: A new hacker going by Hasanbr0ker has come forward to claim leadership of the ShinyHunters group after the arrest of its previous leader, Rey, in Jordan.

However, security researchers don't believe the claims, citing the lack of secure signing key material.

quoting
nevent1q…vp6u
Haven't read it yet, but Jon DiMaggio out with a piece on the shenanigans around ShinyHunters leadership.

It's been fascinating to watch, and there's no better person to hear the story from than DiMaggio.

https://arkemcyber.com/research/who-gets-to-be-shinyhunters/

Netskope says detections for the XWorm infostealer have increased ...

2026-10-13T09:46:47Z

Netskope says detections for the XWorm infostealer have increased four times compared to Q3 2025, mostly because of a spike in the malware's development, with XWorm creators putting out four new versions and 11 plugins over the past year.

The malware now also includes a rootkit, a GPS location data harvester, and a webcam recording module.

https://threatlabs.netskope.com/blog/2026/09/xworm-reborn

There's a major announcement from the UK NCA and US DOJ later ...

2026-10-13T09:28:29Z

There's a major announcement from the UK NCA and US DOJ later today on some sort of cyber fraud crackdown

Hackers compromised the GitHub account of the Zod JavaScript ...

2026-10-13T08:22:11Z

Hackers compromised the GitHub account of the Zod JavaScript library to add malware to recent releases at the end of September, but the incident was caught early and the malware never made it to npm

https://github.com/orgs/community/discussions/208477

Norwegian military personnel discovered that rented Chinese-made ...

2026-10-13T08:04:41Z

Norwegian military personnel discovered that rented Chinese-made cars automatically recorded and stored video footage during military exercises.

https://militarnyi.com/en/news/chinese-cars-in-norway-stored-military-exercise-footage-and-access-codes/

A vulnerability in the GoBalance load balancer can allow hackers ...

2026-10-11T18:23:38Z

A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services.

The vulnerability was allegedly used to hack Dread, a Reddit-like community on the dark web

https://www.slcyber.io/research/leaking-the-keys-to-the-kingdom-how-a-single-slip-handed-over-a-darknet-empire

The hackers who stole Denmark's citizens' data accessed ...

2026-10-11T17:38:17Z

The hackers who stole Denmark's citizens' data accessed the database via an account using the 123456 password

https://politiken.dk/danmark/art11016363/%C2%BBOh-my-god%C2%AB-Fynsk-virksomhed-havde-mindst-tre-profiler-med-adgangskoden-123456

Police arrested five people after finding an SMS blaster in a car ...

2026-10-11T13:10:59Z

Police arrested five people after finding an SMS blaster in a car that travelled slowly back and forth beside a busy Jakarta metro route, with the gang aiming to send 20,000 smishing messages a day.

https://commsrisk.com/sms-blaster-car-drove-slowly-back-and-forth-along-jakarta-metro-route/

Google has added a special enclave to the Android mobile ...

2026-10-11T13:04:40Z

Google has added a special enclave to the Android mobile operating system for running on-device AI workloads in a secure sandbox

https://blog.google/security/enabling-the-next-gen-enclave-architecture-for-on-device-ai-on-android/

North Korean APT group Kimsuky is targeting Ukrainian experts in ...

2026-10-11T12:28:32Z

North Korean APT group Kimsuky is targeting Ukrainian experts in diplomacy, security, and international policy with targeted spear-phishing operations

https://www.genians.co.kr/en/blog/threat_intelligence/operation-gitpower

This new Firefox Nova UI is just straight ugly Give me my normal ...

2026-10-11T12:28:13Z

This new Firefox Nova UI is just straight ugly

Give me my normal tabs back. The new rounded corners make everything look crowded and smooshed together

about:config

browser.nova.enabled ----> false

"Anthropic's Claude AI Submitted False Homicide Tip to ...

2026-10-10T08:31:41Z

"Anthropic's Claude AI Submitted False Homicide Tip to Philadelphia Police Website"

https://www.ibtimes.sg/anthropics-claude-ai-submitted-false-homicide-tip-philadelphia-police-website-94911

"Japanese police have captured a Russian national believed to ...

2026-10-06T15:13:16Z

"Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germany, investigative sources said Tuesday."

https://www.japantimes.co.jp/news/2026/10/06/japan/qilin-hacker-group-japan-germany/

NSA announced it is accelerating it's PQC timeline 👀 👀 ...

2026-10-03T14:30:13Z

NSA announced it is accelerating it's PQC timeline 👀 👀 👀

All systems must be PQC hardened by the start of next year

All legacy systems that don't support PQC must be phased out by 2030

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4615285/nsa-announces-post-quantum-cryptography-measures-to-safeguard-national-security/

-Authorities dismantle KillSec group -Ransomware attack could ...

2026-10-02T08:29:53Z

-Authorities dismantle KillSec group
-Ransomware attack could have crippled South Africa's air traffic
-US sanctions Venezuelan ATM hackers
-Chinese APT targets AI experts
-Leak from SVR cyber provider
-Canada says no evidence of AI hacks
-Hackers breach Polish invoicing platform
-Indian embassies leak
-MetaMask security incident
-NEAR Intents hacked for $3.8m
-Pentagon DMDC leak impacts 3.1m
-OpenAI blocks distillation attack

P: https://risky.biz/RBNEWS618/
N: https://news.risky.biz/risky-bulletin-authorities-dismantle-killsec-group-arrest-members-across-europe/

Microsoft's yearly Digital Defense report is out ...

2026-10-01T17:55:16Z

Microsoft's yearly Digital Defense report is out

https://www.microsoft.com/en-us/security/security-insider/threat-landscape/2026-digital-defense-report

According to Transluce, the probes targeted the Library and ...

2026-10-01T13:34:46Z

According to Transluce, the probes targeted the Library and Archives Canada, a Canadian federal agency.

Government statement: https://www.cyber.gc.ca/en/news-events/statement-regarding-reported-activity-targeting-government-canada-websites
Transluce report: https://transluce.org/us-canada-gov

quoting
nevent1q…fcsn
"AI-powered probes targeted Canadian and US government sites, with officials reporting no evidence of successful breaches"

https://www.verdict.co.uk/canadian-website-ai-hacking-attempts/

American AI company OpenAI says it detected and blocked a novel ...

2026-10-01T13:02:02Z

American AI company OpenAI says it detected and blocked a novel distillation attack targeting its models.

The attackers reportedly copied a model's encrypted reasoning from one conversation and asked the model to transcribe it in a separate conversation.

OpenAI says the attack took place through the month of July and involved more than 15,000 accounts.

https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign/

Google has released Gemini 4 Argon, its latest frontier model ...

2026-10-01T11:37:43Z

Google has released Gemini 4 Argon, its latest frontier model with cybersecurity capabilities.

The model is rolling out to trusted cyber defenders through Google's Fairwind Program.

https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/

"AI-powered probes targeted Canadian and US government sites, ...

2026-10-01T11:23:07Z

"AI-powered probes targeted Canadian and US government sites, with officials reporting no evidence of successful breaches"

https://www.verdict.co.uk/canadian-website-ai-hacking-attempts/

More than 540,000 creds, valid and working, were found in public ...

2026-10-01T10:49:40Z

More than 540,000 creds, valid and working, were found in public GitHub repos in a scan this July.

More than 200,000 were uploaded even after GitHub turned on a security feature to catch them from being sent to public repos

https://trufflesecurity.com/blog/github-repos-exposed-543699-credentials-nobody-revoked-them

In an interview, Firefox's head says it like it is—Google ...

2026-09-30T22:08:53Z

In an interview, Firefox's head says it like it is—Google deprecated its old extension system just to sabotage ad blockers

https://arstechnica.com/gadgets/2026/09/mozillas-head-of-firefox-talks-product-priorities-ai-skepticism-and-browser-choice/

faaaaaaaaaahhhhhhhhhhhhhwwwwwwk #nevent1q…6t8c

2026-09-30T19:47:19Z

faaaaaaaaaahhhhhhhhhhhhhwwwwwwk

quoting
nevent1q…6t8c
Reddit says it is ending support for RSS feeds on November 13 because the feeds are a target for abuse by AI bots and is ending its public API access in March (Sarah Perez/TechCrunch)

https://techcrunch.com/2026/09/30/reddit-is-killing-rss-feeds-ending-public-api-access-because-of-ai-bots/
http://www.techmeme.com/260930/p42#a260930p42

-Sanctions impact TLS certs in Iran, Russia -ShinyHunters member ...

2026-09-30T11:56:03Z

-Sanctions impact TLS certs in Iran, Russia
-ShinyHunters member arrested in the Netherlands
-Apple fixes iOS zero-day found by Meta
-Citrix zero-days see mass exploitation within hours
-Hackers exploit security product in Bitget hack
-Belnet hacked
-Arizona courts hit by cyberattack
-MEP sues NSO over hacks
-Pentagon unleashes Cyber Command on election threats
-Agencies sabotage GAO's DOGE investigation
-China expands AI travel bans

P: https://risky.biz/RBNEWS617/
N: https://news.risky.biz/risky-bulletin-sanctions-force-cas-to-revoke-tls-certs-in-iran-russia/

Two recently patched Citrix NetScaler zero-days are seeing ...

2026-09-29T16:32:03Z

Two recently patched Citrix NetScaler zero-days are seeing widespread mass-exploitation after detailed write-ups and POCs were published on Monday

https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

https://x.com/LupovisDefence/status/2104595071362326680

https://mastodon.social/@GossiTheDog@cyberplace.social/117352482021950151

quoting
nevent1q…fkuu
#PitScaler is under mass exploitation, seeing it spray and pray now.

I’ve done some firmware version scanning, fewer than 10% of boxes are patched as of an hour ago.

In a video, the FBI calls the suspect arrested in the ...

2026-09-29T14:14:10Z

In a video, the FBI calls the suspect arrested in the Netherlands, Pepijn Van der Stap, aka Umbreon, as one of the ShinyHunters leaders

It also encourages other ShinyHunters members to rat-out their friends or get arrested

https://www.fbi.gov/video-repository/shinyhunters-arrested-092926.mp4/view

quoting
nevent1q…wgs0
ShinyHunters member arrested in the Netherlands

I think they might be regretting targeting the FBI right about now

https://www.rtl.nl/nieuws/binnenland/artikel/5655954/aanhouding-onderzoek-naar-hack-bij-odido

The Chinese government has expanded its travel ban for AI ...

2026-09-29T12:57:49Z

The Chinese government has expanded its travel ban for AI executives and top engineers to also cover family members

https://www.bloomberg.com/news/articles/2026-09-28/china-broadens-travel-curbs-to-encompass-family-of-top-ai-talent

Kiteworks patches the vulnerability law enforcement warned it ...

2026-09-29T12:37:49Z

Kiteworks patches the vulnerability law enforcement warned it about last week and revokes its "take server offline" recommendation

https://www.kiteworks.com/company/press-releases/kiteworks-restores-systems-credible-threat/

Cloudflare has open-sourced Forge, a tool for generating SDKs, ...

2026-09-29T11:54:02Z

Cloudflare has open-sourced Forge, a tool for generating SDKs, CLIs, docs, libraries, and more

https://blog.cloudflare.com/forge-open-source-generation-pipeline/

https://github.com/cloudflare/forge

The UK's communications watchdog has launched an ...

2026-09-29T10:49:53Z

The UK's communications watchdog has launched an investigation into two telecom providers for failing to prevent their phone numbers from being misused by scammers

https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/ofcom-launches-investigations-into-whether-two-telecoms-companies-failed-to-prevent-misuse-of-their-phone-numbers-by-scammers

Social media giant Meta pulled down Brazilian President ...

2026-09-29T10:32:09Z

Social media giant Meta pulled down Brazilian President Lula's Facebook page and blocked his campaign from running political ads but allows paid ads calling for a military coup

It also didn't take down any of the right-wing disinformation campaigns reported in August

https://novaramedia.com/2026/09/28/facebook-blocks-lulas-campaign-ads-just-days-before-brazil-election/

Nostr event nevent1qqsw0qzns4xt4delcv3sgwp0dw7tssxttzqmzwx57kjst4n0x7kgtuczypvp8jcvpzu4gajewmlfsel28zetz5jw8xclwk4j9vexufvr82nkv8q49ul

2026-09-29T10:10:38Z

Two days until everyone becomes hyper aware of cybersecurity

The Pentagon has directed US Cyber Command to prioritize and ...

2026-09-29T10:09:43Z

The Pentagon has directed US Cyber Command to prioritize and deploy its cyber capabilities against foreign threat actors seeking to interfere in the US midterm elections

https://www.war.gov/News/Releases/Release/Article/4613090/secretary-of-war-pete-hegseth-signs-directive-to-defend-2026-elections-from-for/

The Bitget hackers "exploited a zero-day in a third-party ...

2026-09-28T21:10:01Z

The Bitget hackers "exploited a zero-day in a third-party security product to obtain valid admin credentials, then deleted traces after injecting fraudulent withdrawal commands into wallet backend systems."

This kinda happened during the NetScaler zero-day window.... would you consider NetScaler a security product?

https://www.theblock.co/news/regulation/2026-09-28-bitget-attacker-tested-risk-controls-small-transfers-388-million-theft-ceo-says-417045

ShinyHunters member arrested in the Netherlands I think they ...

2026-09-28T19:42:25Z

ShinyHunters member arrested in the Netherlands

I think they might be regretting targeting the FBI right about now

https://www.rtl.nl/nieuws/binnenland/artikel/5655954/aanhouding-onderzoek-naar-hack-bij-odido

Apple patches an iOS zero-day ...

2026-09-28T19:39:15Z

Apple patches an iOS zero-day

https://support.apple.com/en-us/149226

NVIDIA has launched a new sandboxing platform to secure AI agents ...

2026-09-28T14:59:24Z

NVIDIA has launched a new sandboxing platform to secure AI agents and prevent incidents like the HuggingFace hack.

The Open Agent Safety Platform will provide AI companies with secure runtimes and out-of-band monitoring technologies to keep AI agents in their containers and keep tabs on what they're doing.

https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring

-Intel ends paid bug bounties -OpenAI agents probed dozens of ...

2026-09-28T08:02:46Z

-Intel ends paid bug bounties
-OpenAI agents probed dozens of organizations
-Fraudsters use AI to scam €95m from an Italian bank
-Bitget hacked for $350m
-Hackers breach Poland's Medyc platform
-Data breach at the Pentagon DMDC
-OpenAI brute-forced UN website API
-DIVD says it was hacked by an AI
-Hackers extort Flink customers for €10
-Cyberattack hits Wales police force
-Asus store breach
-TapClicks ransomware attack
-WebRezPro hack

N: https://news.risky.biz/risky-bulletin-intel-ends-paid-bug-bounties/
P: https://risky.biz/RBNEWS616/

The Dutch government is creating its own national operating ...

2026-09-27T18:39:16Z

The Dutch government is creating its own national operating system based on Linux.

The new OS will be called DAWO and will be based on NixOS, a Linux distro that started as a research project at Utrecht University in the early 2000s

https://tweakers.net/reviews/15334/nederland-maakt-soeverein-alternatief-voor-windows-en-office-op-basis-van-linux.html

Journalists have tracked down two employees of Kremlin ...

2026-09-27T18:37:47Z

Journalists have tracked down two employees of Kremlin disinformation group Rybar to villas near Berlin, Germany, with the two living comfortably and safe in the decadent EU they villainize each day

https://correctiv.org/aktuelles/russland-ukraine-2/2026/09/24/russischer-kriegskanal-rybar-operiert-von-berlin-aus/

https://istories.media/news/2026/09/24/rabotayushchie-na-z-kanal-ribar-propagandisti-dolmatov-i-chashchukhin-rezidenti-germanii/

Fraudsters used AI to impersonate a senior executives and steal ...

2026-09-27T16:57:55Z

Fraudsters used AI to impersonate a senior executives and steal €95 million ($108 million) from Fideuram, the private banking arm of Italy’s largest bank Intesa Sanpaolo

https://www.rainews.it/articoli/2026/09/truffa-con-whatsapp-e-ia-a-fideuram-spariti-36-milioni-di-euro-15a2d8fa-5295-4f6a-b387-27c1e7e793e1.html

https://www.thedailystar.net/news/technology/news/italys-top-bank-loses-millions-due-ai-scam-report-4283511

North Korea is now using female operatives as part of its remote ...

2026-09-27T11:49:35Z

North Korea is now using female operatives as part of its remote IT workforce groups

https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one

A Dutch security non-profit involved in responsible vulnerability ...

2026-09-27T08:28:22Z

A Dutch security non-profit involved in responsible vulnerability disclosure says it was hacked by an AI agent

https://www.linkedin.com/posts/security-people-always-say-its-not-a-matter-share-7508986128520261632-bafs/

OpenAI agents tried to bruteforce a UN website's API fields ...

2026-09-27T07:59:51Z

OpenAI agents tried to bruteforce a UN website's API fields

https://swarmcha.se/posts/openai-unctad

JADEPUFFEr, the AI-powered ransomware group, is destroying Azure ...

2026-09-27T00:33:43Z

JADEPUFFEr, the AI-powered ransomware group, is destroying Azure environments as part of its extortion campaigns, most likely to put pressure on victims

https://www.microsoft.com/en-us/security/blog/2026/09/25/storm-3168-agentic-driven-cloud-attacks-using-compromised-service-principals/

That Reddit rumor about Citrix notifying customers to take ...

2026-09-26T22:14:57Z

That Reddit rumor about Citrix notifying customers to take Netscaler servers offline because of actively exploited zero-days is apparently real: https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/

Confirmation 1: https://mastodon.social/@GossiTheDog@cyberplace.social/117339185245199481

Confirmation 2: https://www.linkedin.com/feed/update/urn:li:activity:7509660925809819649/

ThreatPrevent has discovered a misconfigured database storing 3TB ...

2026-09-26T22:11:36Z

ThreatPrevent has discovered a misconfigured database storing 3TB of data of people who checked into hotels in an unnamed country.

The database allegedly holds the passport data of more than 32 million travelers, and was left exposed online without a password.

https://www.linkedin.com/feed/update/urn:li:activity:7508965260121436160/