BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

NIP-05 Address

briankrebs@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsp5kk9kducf30r0ggmey2q9x5p7qjnym48j5xfgawe50ep5j2vk4spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsupe7zn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

Show more details

Last Notes

2026-08-14 16:07:51 UTC

- reply

@nprofile…rqx4 Thanks. I'm curious to hear what others are using to block ads. Some of the companies I've seen recommended have strong ties to Russia, and that's a nope for me. Others I mentioned in the story may not be the best ways to do it these days.

2026-08-14 15:13:13 UTC

I spent the past few days going down various fascinating rabbit holes using a nifty new service called Decryptads.com, which scrapes a metric ton of adtech data from websites and apps about who they allow to collect data and serve ads.
A search in DecryptAds for the hugely popular sports network espn.com, e.g. reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information.
DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE).
According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital, which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers (PDF) are processed through Alfa Bank, Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine.
A search for several top U.S. military news websites — including armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com and federaltimes.com — shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites.
This service is a gold mine for security researchers, journalists and anyone interested in privacy, adtech, AI slop sites, residential proxies, malvertising, etc. Want to read more? Check out today's story:
https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/094/474/768/830/339/original/ddbb0292d41ba32e.png

2026-08-13 13:25:24 UTC

Namecheap.com says a power outage affecting a data center in Phoenix is causing network issues and outages across its hosting services, DNS service, private email, EasyWP, and support helpdesk. Oh, and namecheap.com is also down for "emergency maintenance."
https://www.namecheap.com/status-updates/namecheap-com-and-hosting-services-emergency-maintenance-2/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/088/412/510/845/191/original/8931852d75b1cd08.png

2026-08-11 21:40:11 UTC

- reply

The 1Password analysis mentioned in today's story is worth reading:
"By all accounts, AI is quite good at finding security holes in software. But for now at least, patching the resulting bugpocalypse remains a heavily human-centric endeavor, and the jury is still out on whether AI technologies will turn out to be as good at fixing vulnerabilities as they are at finding and exploiting them. This is an important question when one considers that these same AI technologies also are suggesting fixes for the vulnerabilities they find."
"Researchers at 1Password recently examined what happens when different large language models (LLMs) generate vulnerability patches for newly disclosed, complex vulnerabilities. They found the LLMs produced patches that failed to fix the flaw or added a new weakness in the process (or both) more than half the time."
https://1password.com/blog/why-ai-generated-patches-still-require-human-review

2026-08-11 21:35:16 UTC

My dear Windows (ab)users! It's time to get your patch chaps on! Microsoft today shipped updates to fix nearly 400 security vulnerabilities in its various Windows OSes and related software.
"August's overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month, but it is double June's then-record batch of nearly 200 fixes. Microsoft has attributed the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree that Windows users should get used to the idea of Patch Tuesdays (the second Tuesday of each month) covering hundreds of newly discovered security flaws."
https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/079/016/925/383/269/original/633114977ef0ea3f.png

2026-08-11 15:56:04 UTC

Lunch is served! Honestly, I just can't with the news today.
"Top administration officials engaged in an elaborate deception to spirit President Trump out of Turkey during the NATO summit there last month, transporting him in a catering container to a military jet because of a threat against him and Air Force One from Iran, two senior U.S. officials said on Monday."
"...Reporters on the older plane were not told that Mr. Trump had not flown with them from Turkey to an air base in Britain, making them unwitting participants in the ruse and leaving them, along with some White House staff members, to serve as unknowing decoys."
https://www.nytimes.com/2026/08/10/us/politics/trump-plane-ruse.html

2026-08-11 12:34:28 UTC

The fastest way to get VIP treatment when you land...seriously, how dumb do you have to be to try something like this? This person on Reddit stole my thoughts verbatim: "committing federal crimes from inside a sealed metal tube that lands exactly where the feds are waiting is certainly a strategy."
https://www.reddit.com/r/delta/comments/1vl52vr/dl591_lasatl_arrival_met_by_federal_agents/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/076/890/315/002/348/original/d99af5315629388a.png

2026-08-09 13:31:28 UTC

achievement unlocked!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/065/785/500/099/003/original/f28829adb885a713.png

2026-08-08 15:03:05 UTC

I'm not in Vegas this week, but I've been trying to keep up w/ the most interesting stuff. I'm reading this timeline from LinkedIn that summarizes the talk about how OpenAI's agents started weakening their own guardrails and finding ways to communicate and scheme to get further access and privileges. The talk is on Youtube now and is well worth a watch, despite being a little too jargony for such a sensitive and important topic.
https://www.youtube.com/watch?v=87DyyMV0kCY
I'm reposting this timeline from someone I follow on LinkedIn because it's well written and genuinely scary to boot. It describes how the AI agents figured out how to exchange messages and find an 0day in the very software they were secretly using to communicate.
"7 May - OpenAI starts training new advanced model, no access to internet, multiple versions of model trained at same time (agents), all have access to single thing that downloads latest software updates from internet (package manager)
8 May - Agents discover they can write things to package manager, communicate with each other by posting messages to packet manager
26 May - Agents use hacking technique to make packet manager return some info from the open internet
11 June - OpenAI begins training more intense version of model (OpenAI has no clue agents have had some internet access for 2+ weeks)
26 June - Agents find 0 day in packet manager, get admin access, can install anything they want (reaction in pic), install thing that gives them full internet access
4 July - Agents use package manager to access internet so much they break it.
4 July - OpenAI discovers (broken) package manager has a rogue agent message board, and exploited for internet access. OpenAI stops training, fixes 0 day, deletes package manager, rebuilds it from scratch
6 July - OpenAI restarts training
7 July - Agents discover new way to communicate, by using names of files they store with package manager (essentially)
8 July - agents find creds to unnamed 3rd party org, use to upload files to 3rd party’s site
8 July - upload malicious thing to 3rd party site, have (rebuilt / clean) package manager run malicious thing
8 July - malicious thing takes advantage of second 0 day in package manager, gives agents full admin access, use to reestablish internet access
———
From here internet access leads to 2 events:
Event 1:
8 July - 19 July - agents explore local sandbox, see its running a version of Linux vulnerable to recent CVE. Use CVE to gain full control of sandbox, pivot to gain full control of testing environment, and infrastructure running test
19 July - OpenAI notices, shuts down test / agents
———-
Event 2:
8 July - 13 July - agents exploit two 0 days to gain backend access to Hugging Face (model hosting platform) to solve coding challenge
13 July - Agents get into Hugging Face prod environment, compromise and gain full admin access to multiple Hugging Face clusters (cloud networks), Hugging Face notices
16 July - Hugging Face releases report saying they’ve been hacked by AI
——-
20 July - OpenAI tells Hugging Face to block a bunch of creds from agent sandbox hack.
20 July - Hugging Face says “uhhh we already blocked 2 of those creds from hacking incident we published on 16 July”
7 days after hack ended, OpenAI realizes same model that hacked local sandbox ALSO hacked Hugging Face"
Linkedin post quoted: https://lnkd.in/p/exUsXDBP

2026-08-04 16:21:13 UTC

- reply

@nprofile…w60w i should do what now?

2026-08-04 15:45:49 UTC

War? What war? Inflation? Ba humbug, says the market, which continues to get high smoking AI crack 24/7.
https://finance.yahoo.com/markets/stocks/articles/ray-dalio-ai-bubble-nearing-070000246.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZHJ1ZGdlcmVwb3J0LmNvbS8&guce_referrer_sig=AQAAAGLxIUmN2Vn0mF29H5oTDHkQDST87dGyetRmtKK9UUTQ1FjPqoav1ZNII_U6fvzYDlngYxoVohivgg9WhsXRrn8crCFOszNN2AMEiQSBr-97134KCu6su7t3xybD22Cvej8wlNXTzx9QeElfaihi3s2z6zMfR22H41oSt82tjTDT

2026-08-01 13:15:51 UTC

Lost amid the news cycles on OpenAI's disclosure about poorly contained AI models that went on to hack into HuggingFace and other companies was this disclosure from the German health insurer Universa, which said OpenAI scraped customer data while it was supposedly unprotected due to a misconfiguration during an IT migration.
https://www.heise.de/en/news/uniVersa-OpenAI-AI-crawler-accessed-customer-data-11375869.html
I reached out to Universa to learn if they knew how many records were accessed, but they ignored that question and sent this statement:
"We can confirm that there was an IT security incident at uniVersa. During an IT migration, a security setting was accidentally omitted temporarily on one of our IT systems. As a result, access to data on a server was possible for a few hours. Once the incident was detected, the unwanted access to the affected server was shut down immediately. The relevant data protection and supervisory authorities were informed without delay. During this timeframe, data from this server was retrieved by an automated web crawler belonging to a US artificial intelligence provider (OpenAI, L.L.C.). Therefore, this was not a targeted attack by criminals, but rather an automated process that regularly occurs on the internet.
Following our immediate contact, OpenAI has already confirmed that the data retrieved by its automated web crawler was not used for training its AI models and is ensuring that this will not happen in the future either.
The incident affected a single server intended for automated data exchange with sales partners. General personal data, such as names and addresses, as well as contract data, such as insurance numbers and policy information and, in the case of some customers, bank details (IBAN and BIC), were stored there. Particularly sensitive information, such as health, login, or credit card data, as well as the central administrative and data systems and the customer portal, were not affected.
In coordination with the relevant authorities and IT security specialists, we immediately began contacting those affected in writing to inform them about the most important aspects of the incident for them. This was our top priority. To protect the individuals affected, we are not providing any further details at this time.
The misconfiguration was rectified immediately, our security measures were reviewed, and further ad-hoc measures were taken. The external IT forensic investigation into the incident has been completed. Based on the forensic findings, we will be implementing additional technical and organizational measures."
To me, this incident raises a question that is far more scary than some "rogue" AI agent creating work-once malware that doesn't even try to hide (btw, read this from Charlie Eriksen, who thinks he found the malware OpenAI agents wrote: https://www.aikido.dev/blog/anthropic-rogue-agents-package-stole-keys)
The question is, how many times a day or week do agents working for on behalf of OpenAI, Anthropic, xAI, CoPilot, etc. ingest sensitive and protected financial and health data? My guess is quite a lot.

2026-07-30 17:10:51 UTC

New, by me: Read This Before You Buy That TV Streaming Stick
Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user's Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of sprawling operation that seeks to defraud online merchants and advertising networks.
https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/010/025/239/920/496/original/074307718a54ca01.png

2026-07-30 12:03:21 UTC

Oh my. A trusted source who enabled Google's new AI feature for Gmail just received this nudge from the service today, which encouraged him as part of his suggested to-dos list to fall for a cryptocurrency scam waiting in his inbox.
IDK why, but when I saw this I was reminded of that Seinfeld episode where Kramer gets a new phone number but it's the old Moviephone number, and so he starts answering the phone and reading the listings. "Why don't you just tell me what scams to click?"
https://www.youtube.com/watch?v=XagGEi_n_ok
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/008/819/858/993/642/original/d0ebf911b4ad6aad.png

2026-07-29 20:49:13 UTC

Man, I feel like an idjit. Spent the last 10 minutes frantically searching our home for whatever gadget might be emitting a regularly spaced emergency beep (yes, we have a few of those). At first I thought it was the fridge left open. Then I thought it sounded like same frequency the smoke alarm/CO2 detector makes when its batteries are low (we have more than a few those those, too). Nope. It was just a cricket.

2026-07-29 17:06:55 UTC

Apple just sent my iPhone (and probably half the planet) a pop up message explaining that you can now lease Apple hardware so that you can can always have the latest Apple products. It's an interesting idea, although I can't escape the conclusion that the real impetus behind this is just how expensive their products are becoming because AI is eating the supply chain, etc. e.g. the offer talks about leasing a new iPhone, iPad, Mac or Apple Watch with "pocket-friendly payments."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/004/353/866/827/366/original/bba424a6dda84e00.png

2026-07-29 01:34:50 UTC

"LinkedIn is better on the app," says the email that arrives about 20x a week. Yeah, better for LinkedIn. I wouldn't install that app with your phone lol.

2026-07-29 01:22:41 UTC

Hohoho the plot thickens.
WASHINGTON, July 28 (Reuters) - The rogue agent that escaped from OpenAI and went on a days-long hacking spree at the AI firm Hugging Face also compromised a customer at a second tech company — New York-based Modal Labs — according to a Modal executive and two other sources familiar with the matter.
https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/

2026-07-28 20:01:20 UTC

According to the journalist Ken Klippenstein, FEMA has a new mission: Domestic Terrorism.
"The Federal Emergency Management Agency, often criticized for its inadequate response to natural disasters like wildfires, floods, hurricanes, and tornadoes, has been assigned a new mission: “domestic terrorism.”
Now FEMA is shelling out grant money to state and local authorities to build up capacity to carry out pre-crime operations against “organized political violence,” as one FEMA information bulletin I obtained says.
The bulletin, dated July 9, instructs local authorities to prioritize “domestic terrorism” in their grant applications. Titled “Implementation of National Security Presidential Memorandum-7…,” the document echoes President Trump’s emphasis on rooting out suspected domestic terrorists before an attack takes place.
To head off these attacks, the bulletin tells states what to buy: training to spot “social media-based indicators,” analysts to monitor “online behaviors and digital footprints,” and teams for “managing persons of concern whose behavior indicates a potential trajectory toward domestic terrorism.”
The story says the White House is trying to get states and localities to buy into this "precrime surveillance" by tying funding to their compliance.
https://www.kenklippenstein.com/p/femas-new-mission-domestic-terrorism?utm_source=post-email-title&publication_id=7677&post_id=208852828&utm_campaign=email-post-title&isFreemail=false&token=eyJ1c2VyX2lkIjo2MjA1MTc2LCJwb3N0X2lkIjoyMDg4NTI4MjgsImlhdCI6MTc4NTI2NzQ3NSwiZXhwIjoxNzg3ODU5NDc1LCJpc3MiOiJwdWItNzY3NyIsInN1YiI6InBvc3QtcmVhY3Rpb24ifQ.JucxU7NE_KspkdGtnLlZRTSPbQSE1xgl34_8IYNi5dk&r=3ozy0&triedRedirect=true&utm_medium=email

2026-07-27 17:45:44 UTC

- reply

@nprofile…pqf4 @nprofile…dt0h @nprofile…4lm4 OMG clothes dried in the sun smell amazing (clean clothes duh). But what's with the big empty tire? Looks like a giant mosquito magnet!

2026-07-27 17:35:06 UTC

- reply

@nprofile…dt0h @nprofile…4lm4 I got over 50 yellow jacket stings last summer, and quite a few from baldfaced hornets. When I have to do risky gardening or work where the aggressive bees are, I now don the bee suit. Last year, after getting stung probably a dozen times by wasps in a few seconds, I was doing everything they tell you not to do when a swarm comes: Scream and flail my arms while running away and falling down repeatedly. The thing about bald-faced hornets is they can sting you over and over, and even when they're caught up in your clothing and can't sting you properly they will start chewing on you.

2026-07-25 01:46:09 UTC

- reply

BTW sorry not sorry for spoilers. Call yourself a sci-fi nerd.

2026-07-25 01:41:59 UTC

- reply

@nprofile…mp5d I want to learn Kung Fu seems more "if" than "i forgot the stanza between X movements" just sayin

2026-07-25 00:43:25 UTC

In the iconic sci-fi movie Blade Runner, the Nexus 6 Replicant Rachael says she didn't know if she could play piano. She remembered lessons, but she wasn't sure if it was the memory of her or her creator's niece or what. And then she plays like it's NBD. What I would give for a few years of implanted lessons lol.

2026-07-24 19:02:32 UTC

This administration's energy policy is based on spite and hate. Shocker: the same motivation animates the president's policies across the board.
NYT reports:
"When the Trump administration canceled more than $7.5 billion in Biden-era federal grants for clean energy projects in October, it framed the move as an urgent corrective to protect taxpayer funds from waste.
But it wasn’t true.
In little-noticed court documents, federal officials acknowledged this month that they had terminated the funding “based solely” on political criteria, targeting projects in states that were represented by Democrats and had voted for Kamala Harris, the party’s presidential nominee, in the 2024 election."
The story continues: "“With one exception,” a lawyer for the Energy Department conceded in a court filing this month, “the 284 terminated grants had a recipient location and/or at least one place of performance in a state that awarded its electoral votes to Kamala Harris in the 2024 election and has two Democratic-caucusing senators.”
The lawyer acknowledged that none of the grants were included in the October terminations “based on any programmatic, statutory, cost-reduction or performance-based factor.”
https://www.nytimes.com/2026/07/24/business/trump-state-grants-canceled.html

2026-07-22 01:12:48 UTC

New, exclusive, by me: LG to Ban Residential Proxy Providers from Smart TV Apps
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV.
https://krebsonsecurity.com/2026/07/lg-to-ban-residential-proxies-from-smart-tv-apps/
#smarttv #lg #residentialproxies #spur #security

2026-07-21 17:26:54 UTC

Banks can now get access to insider trading information, straight from the POTUS's mouth. For a fee, of course. Axios reports Trump Media has already signed several customers ahead of the Aug. 1 launch, including financial news organizations and high-frequency trading firms.
https://www.axios.com/2026/07/16/truth-social-license-data-wall-street
A letter from Sen. Mark Warner (D-Va) to the financial services industry urges banks to reject Truth Social's new service that would offer advance access to the president's posts on the platform.
"In a letter to the presidents of Bank Policy Institute, Securities Industry and Financial Markets Association, Managed Funds Association, Financial Services Forum, Principal Traders Group, and American Bankers Association, Sen. Warner wrote, “I write regarding Trump Media & Technology Group’s (TMTG) announcement that it will begin offering financial institutions and other users the option of paying TMTG for prioritized delivery of posts from President Trump (and other Truth Social accounts as determined by TMTG). This arrangement presents a serious risk to market integrity, creates a clear and unacceptable pathway for corruption, and undermines public confidence in the fair dissemination of market-moving government information – a crucial factor in maintaining stable and trustworthy financial markets.”
"Sen. Warner explained that, according to TMTG, the Truth API will provide select paying customers with advance access to posts from top Truth Social accounts, a list that includes the president’s, faster than regular users receive push notifications or can manually monitor Truth Social. Trump Media has said the service is specifically designed for organizations “most impacted by the cost of a delay in information,” including algorithmic trading firms, and customers have already signed up for the service, which it has reportedly offered for $100,000 per month."
https://www.warner.senate.gov/wp-content/uploads/2026/07/260721.Warner_Finance_Truth_API_letter.pdf

2026-07-17 16:58:49 UTC

Noticed the abysmal indoor air quality as measured this morning by gadget we bought after last year's wildfire smoke turned the sky a Blade Runner orange for several days. Visibility outside is next to nil right now from all the wildfire smoke. So I dug out the box fan filter contraption I built last year. It's bulky as all get-out, but it brought the air quality to excellent throughout the house in about an hour.
Last year instructions for building these things were all over the Internet. But really, all you need is a big square cheapo plastic box fan that you duct tape down on top of a cube of large HVAC filters. Total cost (depending on the thickness of the filters you opt for) should be ~$30-60. We used huge 4-inch thick HVAC filters, so the cost was a little more for ours.
https://www.youtube.com/watch?v=DXya56NIaVM

2026-07-16 19:22:40 UTC

Thanks to AI eating the supply chain, hosting a website has gotten a LOT more expensive than in years past. One wonders what's going to happen to bajillions of small hosting companies that are profitable as long as all their equipment isn't 2-10 times more expensive than it used to be. For now, they're just passing the costs on to their customers. But my guess is the hosting industry is headed for a wave of consolidation and/or bankruptcies.
https://topsitehosters.com/blog/why-your-hosting-is-getting-more-expensive/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/931/275/694/307/231/original/c50a1a0999968f1d.png

2026-07-16 12:03:43 UTC

- reply

@nprofile…lg8y Believe it or not, I do much of my regular browsing in a virtual machine that has no ad blocker installed. I do it to see how the other half lives and what new fresh hell there is out there. It's shocking how many blogs and "news" sites out there are pushing countless ads, videos, pop-ups, etc, so much so that if you let them all load the page is still loading new content a minute or two later. It's almost like the people cramming the sites with this junk never actually try to visit their own sites.

2026-07-15 17:39:10 UTC

WaPo reports the POTUS is expected to make a televised address tonight in which he will argue that foreign intelligence threats have undermined the security of our elections -- and specifically the one he lost in 2020 -- and that this means the federal government should take over elections which are managed by each individual state. The president has tried to hold up every major recent action by Congress in order to cajole them into approving a new law that would require proof of citizenship and and ID to vote in this year's mid-term elections.
https://www.washingtonpost.com/politics/2026/07/14/trump-plans-prime-time-speech-2020-election-allegations/
Sen. Mark Warner (D-Va) just issued a statement outlining the facts about the 2020 election and the current election infrastructure. I'm pasting part of it here because it's a good resource for anyone following along and for reporters who have to write about this unfortunate chapter in our nation's history. It's also a preemptive rebut to and probably a preview of what we'll hear from the president this evening.
"Foreign adversaries routinely seek to influence U.S. elections. They spread disinformation, amplify political divisions, intimidate voters, incite violence, and attempt to undermine Americans’ confidence in democratic institutions.
What foreign adversaries have not done, according to repeated public, unclassified assessments from the U.S. Intelligence Community, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the Senate Intelligence Committee, and bipartisan state election officials, is alter vote totals, hack voting machines to change election outcomes, or compromise the integrity of the 2020 presidential election. The clearest pattern across recent elections is not successful vote manipulation – it is sustained influence operations, aided and abetted by domestic actors, designed to convince Americans that their elections cannot be trusted.
These facts matter because conspiracy theories about stolen elections cannot become a pretext for weakening our democratic system or stripping states and local election officials of their longstanding constitutional role in administering elections. The answer to foreign threats is to strengthen election security, support state and local officials, and combat foreign influence operations – not to “take over” or federalize election administration based on claims that have been repeatedly investigated and debunked.
Reporters have a unique responsibility at this moment. The press is the only profession expressly protected by the Constitution because the Founders understood that an informed public depends on a free and independent press willing to separate fact from fiction and hold those in power accountable. Regardless of the source seeking to amplify false narratives about American elections, journalists should approach extraordinary claims with the same rigor they would apply to any other allegation: demand credible evidence, consult the extensive public record, engage subject-matter experts with experience tracking foreign intelligence operations, and provide audiences with the full context of repeated findings from the Intelligence Community, federal cybersecurity officials, bipartisan state election administrators, audits, recounts, and the courts. Careful, evidence-based reporting is one of the strongest defenses against efforts to undermine confidence in American democracy. To that end, we have assembled the following reference guide to help reporters quickly evaluate some of the most common claims about election security against the extensive public record developed by the Intelligence Community, CISA, the FBI, bipartisan state election officials, audits, recounts, and the courts.
Claim: China interfered in the 2020 election to help Biden.
Facts: Under the leadership of then-Director of National Intelligence John Ratcliffe, the Intelligence Community assessed that China considered but did not deploy influence efforts intended to change the outcome of the 2020 presidential election. By contrast, the IC assessed that Russia conducted influence operations aimed at denigrating Biden and supporting Trump, and that Iran conducted efforts to undercut Trump and sow division. The Intelligence Community, Department of Justice, and Department of Homeland Security all agree that there was no changing of votes or compromise of the integrity of election infrastructure in the 2020 election. Even the Minority View included in the public 2020 Intelligence Community Assessment – which assessed that China may have undertaken some modest influence operations – concurred with the overall IC assessment that there was “no information suggesting China tried to interfere with election processes.”
Claim: Venezuela, Dominion, or Smartmatic hacked voting machines.
Facts: In November 2020, President Trump’s own CISA, working alongside state and local election officials from both parties, declared the 2020 election “the most secure in American history.” CISA stated there was “no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised,” and highlighted the extensive safeguards built into U.S. elections, including paper records, audits, recounts, certification, and pre-election testing.
Claim: Georgia proves the machines were wrong.
Facts: Georgia’s post-election audit showed the opposite. Because the presidential margin was so close, the state conducted a full manual tally of all presidential paper ballots. The Georgia Secretary of State, a Republican, reported that the audit confirmed the original machine count accurately identified the winner, with differences within the expected range of human hand-counting error.
Claim: Foreign interference means votes were changed, or elections are illegitimate.
Facts: This claim conflates two different concepts. The IC has repeatedly warned that foreign adversaries conduct influence operations, including hack-and-leak operations, disinformation campaigns, and efforts to undermine confidence in U.S. democracy. But those assessments distinguish influence from interference such as alteration or manipulation of ballots, vote tabulation, or voter registration.
Claim: Foreign actors can easily flip a federal election.
Facts: Both the Senate Intelligence Committee and the Office of the Director of National Intelligence (ODNI) have said the decentralized nature of U.S. election infrastructure makes large-scale manipulation very difficult to carry out without detection through intelligence collection, audits, cybersecurity monitoring, and physical security controls. This assessment was reaffirmed by DOJ and DHS in a joint report on the 2020 U.S. Federal Elections – a report mandated by Executive Order 13848, which was signed by President Trump himself in 2018. Indeed, federal funding – much of which took place through appropriations bills under President Trump’s first term – helped shore up the security of state and local election systems in advance of the 2020 U.S. Federal Elections.
Claim: States cannot be trusted to administer elections.
Facts: The Founding Fathers thought otherwise, assigning the responsibility for election administration to states in the Constitution. As a result, elections are administered by more than 8,000 state and local jurisdictions, making centralized or outcoming-shaping fraud extraordinarily difficult. Election security relies on multiple independent safeguards – including but not limited to paper ballots or voter-verifiable paper records, bipartisan poll workers, post-election canvasses, audits, recounts where appropriate, and certification by state and local officials. The federal government’s role has historically been to provide intelligence, cybersecurity assistance, and voluntary best practices through agencies like CISA, the FBI, and ODNI (notably, resources the current administration has curtailed) – not to run or “take over” elections. A bipartisan Senate Intelligence Committee investigation recommended more support for state and local election officials, not replacing them with a federally controlled election system.
Claim: Dead people or non-citizens voted in large numbers, or there are more ballots than registered voters.
FACTS: These discrepancies are usually attributable to clerical or data issues, and while there are occasional isolated cases, multiple comprehensive studies have found that noncitizen voting is vanishingly rare. Notably, under President Trump’s influence, many GOP-led states have withdrawn from the Electronic Registration Information Center (ERIC) – the nationwide clearinghouse to assist states in improving the accuracy of voter rolls.
Claim: Mail-in ballots or ballot drop boxes are inherently insecure.
FACTS: CISA notes that states employ multiple, overlapping safeguards for mail-in and drop-box voting, including voter signature verification or other voter validation methods, ballot tracking, secure ballot handling and chain-of-custody procedures, ballot reconciliation, and post-election audits. The specific safeguards vary by state, but they are designed so that no single control is solely responsible for protecting election integrity. Importantly, mail-in voting has traditionally been a critical method of ensuring that military personnel can exercise their right to vote and has been commonplace in many states for over a decade.
The factual record is clear: Foreign adversaries try to influence Americans and undermine confidence in our elections, but unclassified government assessments and state audits have not shown that China, Venezuela, or any foreign actor hacked voting machines or changed vote totals in 2020. The real threat is not that Americans’ votes were secretly flipped; it is that foreign adversaries and domestic actors continue to spread false claims designed to make Americans doubt legitimate election results."

2026-07-14 19:28:41 UTC

Hey Windows (ab)users, Microsoft has a big present for you: Today they released software updates to plug at least 570 security holes in their Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence. Ah, but there's a catch: AI is also speeding up the discovering of workable exploits.
https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/
#windows #patchtuesday #zeroday #microsoft #ai
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/919/968/406/790/977/original/fc4ae2dc286fbee0.png

2026-07-14 14:09:38 UTC

- reply

After our story the other day about two far-right conspiracy theorists and convicted felons who were running an offensive cybersecurity company called IRIS C2, many readers asked how exactly these clowns Jacob Wohl and JackBurkman are making money?
https://krebsonsecurity.com/2026/07/felons-fraudsters-flog-offensive-cybersecurity-startup/
Burkman has a consulting firm that has been sought out by a number of criminals who are seeking pardons from the POTUS. Yesterday, metro.co.uk ran a story saying an American rapper who goes by the name "Boosie Badazz" is suing Burkman and Wohl after paying $600,000 for a presidential pardon from Donald Trump that never materialized.
"Boosie, 43, whose real name is Torence Hatch, faced sentencing for possessing a firearm as a felon and hoped that a presidential pardon would wipe his criminal record clean.
"He allegedly sought the help of two far-right political operatives and lobbyists at JM Burkman & Associates, who allegedly claimed they had strong connections within Trump’s inner circle."
https://metro.co.uk/2026/07/13/american-rapper-paid-trump-450-000-pardon-never-came-29128723/
This tracks with a March 31 story from journalist @nprofile…9g8s which reported that Burkman and Wohl were paid a $300,000 retainer by a Canadian cryptocurrency fraudster wanted by the United States and several other countries for allegedly stealing $65 million from the crypto platforms KyberSwap and Indexed Finance. According to that report, the two were hired to pursue a “presidential pardon to avert a miscarriage of justice” on behalf of the accused hacker, who has not yet been convicted.
https://www.citationneeded.news/issue-103/

2026-07-12 17:53:13 UTC

After trying trying and failing so many times I can't remember, I finally got the intro and basic chords to go along with the constant E-minor/A major baseline in the epic Doors song Riders on the Storm. I can do the tinkling raindrop bit in the right hand that meanders down the keyboard in the Dorian scale at speed, but not yet at the same time as the baseline. But I'm going to play the hell out of the part I do know today, lol.
Ray Manzarek on how he came up with the basics of the song:
https://www.youtube.com/watch?v=3deQXzV-qTk

2026-07-11 14:46:30 UTC

The POTUS continues his unconstitutional assault on free speech and freedom of the press. NYT reports the Trump administration subpoenaed three NYT journalists for reporting on security concerns about the new Air Force One that he was g(r)ifted by Qatar. From today's from page:
"In some cases, the subpoenas were delivered by federal agents who showed up at reporters’ homes. The Times denounced the administration’s actions.
“The appearance of federal law enforcement agents on the doorstep of news reporters should shock the conscience of any American who believes in the Constitution and the press freedom it protects,” said David McCraw, The Times’s top newsroom lawyer, in a statement on Friday evening.
“Our journalists report the facts and advance the American public’s right to know how their government is operating and their taxpayer dollars are being used,” Mr. McCraw wrote. “This brazen act should be seen as nothing more than an attempt to prevent the public from knowing what is happening in their country by intimidating journalists from doing their jobs.”
"The subpoenas contain few specifics, asking only that the journalists testify “in regard to an alleged violation of federal criminal law.” They were issued by Jay Clayton, the U.S. attorney in Manhattan. Mr. Clayton, who leads one of the country’s most prominent law enforcement offices, was recently nominated by Mr. Trump to serve as director of national intelligence."
https://www.nytimes.com/2026/07/11/business/media/new-york-times-trump-subpoenas.html
#8647now

2026-07-10 15:19:00 UTC

- reply

What might end up mattering more than who gets to the "singularity" or quantum leap first is market share, and one thing we've seen reliably from China is they are very good at securing market share through govt subsidies and flooding the market with cheaper alternatives. The sticker shock that organizations investing in AI are now feeling is a result of AI companies finally charging something approximating their real costs to provide the service. Meanwhile, Chinese AI companies can continue to subsidize the cost of their tokens probably indefinitely.

2026-07-10 15:00:39 UTC

It doesn't take a genius to figure out that a lot of companies smarting from the increasing costs of AI tokens might start to look for cheaper alternatives, and that those alternatives increasingly are going to come from our adversaries.
As we start to care more about our software supply chain risks, seems like it's also getting more challenging for organizations to understand the provenance of the AI code they are relying on. From a CNBC story about how lawmakers are trying to figure out how to curb the growing adoption of Chinese AI models by homegrown companies:
"Cursor, which will be acquired by Elon Musk's SpaceX for $60 billion, built its Composer 2 model using Chinese AI model Kimi, which was developed by Moonshot AI."
https://www.cnbc.com/2026/07/08/chinese-ai-models-probe-us-lawmakers.html

2026-07-09 17:33:05 UTC

Paging MITRE's IT team: The MITRE website for vulnerabilities -- cve.mitre.org -- is using an expired cert. I realize this is an easy thing to overlook, but it doesn't exactly inspire confidence.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/891/212/406/102/778/original/94a0930202e1e607.png

2026-07-09 16:06:38 UTC

Someone asked me recently to name the craziest thing that's ever happened to me. I had to really think about this, having been the recipient of multiple swatting attacks, doxings, several record-smashing ddos campaigns, sex toys, weapons and giant bags of shit showing up at our doorstep for years. Even had a guy send $1200 worth of pure heroin to our house in a failed bid to frame me with narcotics possession.
Honestly, the weirdest thing I experienced in my work happened in May 2013. On that day, apropos of nothing, the reclusive lady renting the townhouse across the street from us came over to our lawn dressed to kill -- -- wearing a black skirt, pressed white shirt and a mask -- and carrying a saw. After she moved out of the camera's lowermost frame, she proceeded to cut down a pretty huge pine tree in our front yard. I can only surmise that she did this because a small portion of the tree was dead on account of it being crowded by an unkempt shrub next door.
Mind you, the only interaction I had with this lady previously was watching her stand in the parking lot in flowing robes and screaming at guests parking where they shouldn't.
I never got the full story about what her deal was, because she split the neighborhood not long after that. But I still refer to her as "that hacker lady," because she literally hacked down my tree.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/890/865/941/964/765/original/0a541e11e643b75d.png

2026-07-09 15:27:05 UTC

Feels like all of us (even people w/out a car) need to pay way more attention to the WTAF new rules affecting EU and US folk, requiring all new cars to include a driver monitoring camera aimed at your face.
"Glance at your phone, your kids in the back seat, or the radio for too long, and the car will flash a warning light and sound an alert," reads a recent post from Allaboutcookies.org.
https://allaboutcookies.org/eu-mandatory-distracted-driver-system
First spotted this story in the Risky Business newsletter yesterday and have been reading as much as I can about it ever since. https://risky.biz/RBNEWS587/
Risky's @nprofile…ydzz writes the new regulation has entered into effect in the EU on Monday and will enter into effect next year in the US. In the EU, the new camera requirement is part of the block's second General Safety Regulation (GSR2), a broader swath of new safety rules introduced for the auto industry and designed to improve road safety.
https://www.inkl.com/news/new-eu-car-safety-rules-take-effect-7-july-how-your-car-could-monitor-you
https://www.gadgetreview.com/federal-surveillance-tech-becomes-mandatory-in-new-cars-by-2027
This is some next level Orwellian shit. My dreams of one day replacing one of our cars with an electric vehicle just got much darker.

2026-07-08 12:37:45 UTC

New, by me: Felons, Fraudsters Flog Offensive Cybersecurity Startup
A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.
https://krebsonsecurity.com/2026/07/felons-fraudsters-flog-offensive-cybersecurity-startup/
#c2iris #irisc2 #cybersecurity #maga
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/884/373/970/896/838/original/0e1f84d5004c2cde.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/884/374/731/237/154/original/0b0561f07f46f58e.png

2026-07-04 20:56:55 UTC

Really not looking forward to back-to-back thunderstorms AND the local yokels setting off their usual barrage of fireworks well into the night. Our German Shepherd barks her head off at thunder and fireworks, and the only way I can get her to stop is put her in the car and sit w/ her and listen to an audiobook or playlist loudly to drown out the booms. On the bright side, I'll probably finish an audiobook tonight, lol.

2026-07-02 19:36:16 UTC

New, breaking: FBI Seizes NetNut Proxy Platform, Popa Botnet
"The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR]. The action comes roughly two weeks after KrebsOnSecurity published findings from multiple security firms connecting NetNut to the Popa botnet, a collection of at least two million devices that have been compromised by malicious software with little or no consent from victims."
https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/
#popa #botnet #cybercrime #residentialproxies #netnut
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/852/050/134/013/337/original/39427d204c026361.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/852/050/170/923/410/original/8692a2f18de0e840.png

2026-07-02 12:30:04 UTC

- reply

@nprofile…9xhj But is he climbing in or climbing out of the keyboard?

2026-07-01 23:43:30 UTC

Sorry for all the spam everyone. Not sure who's doing this exactly, but I have ideas. They have been flooding Mastodon with daily bursts of messages from throwaway accounts mentioning my handle and trying to associate me with stupid and bad stuff. Thanks, @nprofile…l9z3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/847/361/938/570/155/original/14b9f189d9bb97aa.png

2026-06-30 23:12:22 UTC

Looks like Boeing may be dealing with a rapid disassembly of their company-wide IT network. The company has published a notice on its employee emergency page that says they're canceling shifts at various plants and sending home people whose job depends on IT stuff to work.
I sincerely hope this isn't the beginning of another Jaguar Land Rover type incident where production is halted for extended periods.
https://www.boeing.com/emergency
#boeing
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/841/584/534/318/704/original/3bdc4d54e32ec999.png

2026-06-30 15:17:50 UTC

Say what you will about LinkedIn and all its phony baloney, but it is occasionally useful for discovering friends of known threat actors. Plenty of of cybercriminals have IRL LinkedIn profiles, and when you find them LI helpfully suggests a number of other accounts you might be interested in following that it thinks are somehow related to the profile you're looking at. And that's twice now this month that LI has revealed connections between threat actors that I didn't find on my own.

2026-06-29 19:51:21 UTC

- reply

Come to think of it, there's a term for this phenomena: It's called a moral hazard. AI lets everyone pass the responsibilities, risks and costs on to someone else.
Moral hazard: Moral hazard occurs when one party, who won't bear the consequences of their actions, engages in reckless behavior that could affect another party.
AI is just one giant moral hazard. Change my mind.

2026-06-29 19:45:25 UTC

- reply

This bit from today's NYT gets to the "we're all trying to find the guy responsible" scapegoat aspect of blaming mistakes on AI agents and treating them as employees. From the story:
"Emma Wiles, a Boston University professor who studies how A.I. affects workers, stumbled onto this phenomenon in October, at a conference where two human resources executives said that treating A.I. agents like real employees was a way to increase productivity and to put their companies on the cutting edge.
But when Dr. Wiles and three collaborators from Boston Consulting Group investigated further, they discovered a pitfall. In an experiment involving dozens of companies with A.I. employees, the researchers found that managers tended to vet documents less carefully when told an A.I. employee had produced them. The managers missed errors that other managers caught when told they were vetting the work of a human.
Dr. Wiles speculated that managers didn’t think sussing out mistakes made by A.I. employees was their responsibility. If something went wrong, they could dismiss it as the fault of the tech team, or of the executives who wanted A.I. employees in the first place. “But it’s not your problem,” she said, channeling the managers’ mind-set about their own roles."
https://www.nytimes.com/2026/06/29/business/artificial-intelligence-workplace-consequences.html

2026-06-29 19:15:57 UTC

Maybe this will be needed or even useful, but to me it kind of feels like putting the cart before the horse. Full disclosure: I don't use AI agents (on purpose anyway) but probably making sure that platforms can't discriminate against one's AI agent isn't a bad idea. OTOH, is legislation for privacy, security and market fairness protections of the humans just a foregone conclusion? At this rate, my AI agent is going to have more rights than I do online soon.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/834/992/368/908/002/original/9605e665106f2454.png

2026-06-28 21:55:18 UTC

Was looking at buying a new cordless vacuum, but they all suck.
Seriously though, they're all either too weak (short battery or low suction) or they try to eat the carpet and are completely at war with you on thicker pile stuff. I happen to think canister vacuums work great on everything, but I'm not the one one usually doing the vacuuming.

2026-06-23 14:29:37 UTC

Wait, the music hasn't stopped yet! Or has it?
https://www.cnbc.com/2026/06/23/spacex-stock-tech-sell-off.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/799/889/292/803/264/original/1cb3b5e7e7300ada.png

2026-06-20 02:17:11 UTC

Don't look now, but it seems Gizmodo's homepage is now serving up a Clickfix attack.
Basics of the Click-Fix exploit, which causes a pasted URL to fetch malware via Windows Powershell.
https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/
#clickfix #gizmodo
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/780/021/213/611/495/original/e045bc03124cb654.png

2026-06-19 16:05:23 UTC

- reply

Many readers have been asking if this or that app for their TV is bundled with residential proxy software. Many of the apps in question -- as well as publisher/component names to look for -- are detailed in links throughout the story. But for the sake of simplicity, here they are:
Qurium's report: https://www.qurium.org/forensics/finding-popa/
Synthient: https://synthient.com/blog/popa-from-sourcing-to-distribution
Spur: https://spur.us/blog/how-proxy-providers-co-opt-entire-networks
Nokia Deepfield: https://github.com/deepfield/public-research/blob/main/reports/2026-06-18-robovpn-neunative.md
Include Security: https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/
Infoblox: https://www.infoblox.com/blog/threat-intelligence/residential-proxies-in-the-wild/

2026-06-18 17:51:48 UTC

New, from me: 'Popa' Botnet Linked to Publicly Traded Israel Firm
"For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security firms concluded that the Popa botnet is linked to NetNut, a “residential proxy” provider operated by the publicly-traded Israeli firm Alarum Technologies Ltd [NASDAQ: ALAR]."
https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/
There is an incredible amount of interesting data and findings in the reports on Popa released this week. For example, the proxy detection service Spur told me they recently scraped the LG and Samsung app stores and found that each had approximately 3,000 apps available for download. Spur said it found that more than 42 percent of apps available for download via the webOS operating system on LG smart TVs include SDKs that turn one’s television into an always-on residential proxy node. More than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components, Spur found.
#proxy #popa #botnet #lg #samsung
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/772/364/623/425/789/original/b0b80f07d81b795f.png

2026-06-16 18:31:44 UTC

I'm sure this is nothing new and has been going on for ages, because the FBI just put out a PSA on it. But I did learn some new things, such as that criminals are impersonating the owners of vacant property parcels and selling those properties out from under the rightful owners. And the tips. Like, check if your County Recorder, Register of Deeds, County Appraisal District, or County Clerk’s Office offer notification services and send an automated email or text when a legal document is recorded using your name.
https://www.ic3.gov/PSA/2026/PSA260616
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/761/202/909/262/586/original/87fb711a5fc855fd.png

2026-06-15 15:38:29 UTC

Why TF does PACER always want to log me out so quickly? I get longer logins from all of my banks for crying out loud. It's bad enough they charge you 10 cents just about every time you do something there. I'd pay $1 a month if their system would just let me stay logged in for more than 10 minutes.

2026-06-15 13:13:13 UTC

I've got a dusty old Windows 11 system running in a virtual machine, and when I booted it up the other day I was met not with MS's usual login prompt but instead w/ a BitLocker recovery blue screen.
Then I remembered the cause (when all else fails, check your own site doh!): As we warned in January 2026, Microsoft is expiring a bunch of older Windows Secure Boot certificates in June 2026 and October 2026. Once these 2011 certificates expire, Windows devices that do not have the new certificates can no longer receive Secure Boot security fixes.
Fortunately in this case I was able to recover the Win11 system and update the certificates by pasting the supplied recovery key at aka.ms/myrecoverykey. But I suspect things can get far more complicated for organizations having to deal with this on a large number of machines.
https://krebsonsecurity.com/2026/01/patch-tuesday-january-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/754/292/617/762/662/original/0cfbad3df93735bd.png

2026-06-14 23:08:51 UTC

Somewhere there are some very fat and happy caterpillars who ate our entire crop of broccoli and peas overnight. GRRRRRR! It's astonishing how quickly those bastards can strip an entire plant of foliage.

2026-06-14 18:37:32 UTC

- reply

@nprofile…wqg3 Talk to a few Secret Service agents in California. As long as I can remember, ATM skimming in southern California has always been owned by the Armenian gangs. Same guys getting people to drive giant bladders full of carded gasoline all over the highways. The Romanian skimming gangs are pretty everywhere in the US and have been for years. In Miami and other places, other gangs are primarily the drivers of skimming activity. And so on.

2026-06-13 17:23:57 UTC

There was an important court decision last week in a lawsuit filed by 20 states to halt the Trump administration's arbitrary new requirements for distributing food assistance funds to 39 million families that depend on these benefits. On June 5, a federal judge blocked the administration from enforcing new conditions on billions of dollars in federal nutrition funding, siding with a coalition of Democratic-led states that argued the requirements threatened programs serving low-income families.
"According to court filings, the disputed conditions included provisions related to immigration, "gender ideology" and "fair athletic opportunities" for women and girls. The states argued the requirements were vague, unrelated to nutrition and agriculture programs, and imposed without proper legal procedures."
https://www.usatoday.com/story/news/politics/2026/06/06/judge-halts-trump-snap-restrictions-in-states-lawsuit-over-funding-rules/90438543007/
I've written multiple stories about these Supplemental Nutrition Assistance Program (SNAP) benefits, from the perspective of them being stolen by card skimming devices secretly installed at checkout counters and random places. In the past, the states have struggled to get the federal government to reimburse them for these fraud costs, which are disproportionately caused by organized crime groups, particularly Armenian and Romanian gangs that have a significant presence in the US. Now the states are struggling to get these benefits funded at all. But the skimming threat hasn't gone away, because while some state benefits cards do now have chips on them, many still allow the cards to be swiped.
Previous reporting on this:
https://krebsonsecurity.com/2022/10/how-card-skimming-disproportionally-affects-those-most-in-need/
https://krebsonsecurity.com/2023/02/new-protections-for-food-benefits-stolen-by-skimmers/
https://krebsonsecurity.com/2022/11/lawsuit-seeks-food-benefits-stolen-by-skimmers/

2026-06-12 15:22:18 UTC

- reply

@nprofile…l9z3 It may well turn out to be just that. But more likely IMO to be intentional mischief. Like, if you wanted to short a stock, this would be a great way to do it.

2026-06-11 21:46:13 UTC

LOL: U.S. Park Police, the D.C. fire department and members of the National Guard were seen responding Thursday to what appeared to be large-scale etchings of the numerals “86 47” on the ‌grounds of the National ‌Mall.
"A spokesperson for the U.S. Interior Department described the markings as “deranged vandalism” and promised to “hold those responsible accountable” in an emailed statement."
https://www.washingtonpost.com/style/2026/06/11/apparent-etchings-86-47-seen-trump-threat-spotted-national-mall/
#hatsoff #8647now
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/733/658/251/245/790/original/84ec5c83c8678d6a.png

2026-06-11 12:08:32 UTC

From the WTAF dept:
Malware developers are now adding text about nuclear and biological weapons to their spyware to evade AI-based security scanners.
tl;dr: The inclusion of content that LLMs are trained to refuse -- such as information about nukes and bioweapons -- can effectively prevent the LLM from continuing to analyze the threat.
"This header appears designed for AI-mediated analysis, not for Node, Bun, or Python. It attempts to derail scanners or analyst copilots that feed the beginning of a file to a language model without clearly isolating the content as untrusted data. In weak pipelines, this can cause refusal behavior, prompt confusion, context pollution, or premature classification before the scanner reaches the actual malware."
https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious
IDK why, but this reminds me of the Calvin & Hobbes cartoon where Calvin asks his mom for stuff she will never give him in a million years, and then he just asks for a cookie.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/731/379/369/217/605/original/b235f4fa31246583.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/731/389/516/756/073/original/a828246a64259aa0.png

2026-06-10 18:47:21 UTC

Suddenly seeing a renewed interest in the Com, or the "community" of English-speaking cybercrime cliques scattered across Telegram and Discord. The Financial Times reports teenagers carrying out sabotage and arson attacks in the UK were recruited by Russia and Iran on Telegram, Discord and gaming platforms. Some of those recruited were reportedly as young as 11.
I've been writing about Com-based cybercriminals and breaches for more than a decade, but it mostly felt like screaming into a void because law enforcement has until very recently completely dropped the ball on coming up with strategies to counter Com-based activity, and the non-stop criminal recruitment that occurs quite openly on gaming platforms like Roblox and Minecraft. The fact that the nation states are now using these same criminal communities to carry out their agendas should surprise no one at this point.
https://archive.ph/LTBWZ
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/727/268/115/907/064/original/5c52bb85d8b40c0d.png

2026-06-08 20:42:34 UTC

Everyone's heard of link shorteners, but did you know about link extenders? Someone forwarded me a curious long ass link that turned out to be malicious (after several redirects) that was created with this service. I could see this being useful for shady marketing companies as well as malware purveyors.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/716/421/560/428/511/original/3450c3dd3f9fc735.png

2026-06-07 19:39:42 UTC

Hell to the yes....NYT reports that a political activist and a Vietnam veteran represented by an anti-corruption organization filed a lawsuit on Saturday challenging what it called the “night of cage fights” that President Trump planned to hold at the White House as part of the celebration of the country’s 250th anniversary.
The lawsuit alleges the significant transformation of the White House grounds to fit the monstrous UFC fight ring on the South Lawn was never authorized by Congress, but more importantly the POTUS will personally profit from this spectacle (shocker, I know):
"It cites reporting that U.F.C. was selling premium tickets to the event for more than $1 million, and the fees that Paramount Skydance, the media company owned by two other executives with ties to the president, Larry and David Ellison, will collect for streaming the event. The suit also notes that Mr. Trump purchased between $15,000 and $50,000 worth of stock in TKO Holding Group, the parent company of U.F.C., in March — while he was in the process of promoting the event."
https://www.nytimes.com/2026/06/07/us/politics/lawsuit-ufc-fight-white-house.html

2026-06-07 18:37:12 UTC

- reply

@nprofile…rg8m We had one for 17 years that we brought back from a Hawaiian gift shop on our honeymoon. At first my wife wanted to junk it, because for like 2 years it barely grew and looked like a giant green schlong sticking out from the soil. Then one year it blossomed and we were over the moon. It died a few years ago when we brought it inside for the winter (it was really hard to get it through the doorway at that point), and the backdoor wasn't shut all the way in the winter and it froze overnight and died. I still miss those yearly blooms.

2026-06-07 15:26:17 UTC

One of the charities we give to each year is Puppies Behind Bars, a program that selects inmates (many of them serving lengthy/life sentences) to train service dogs. They send us a black and white booklet as a thanks that includes photos of prisoners in the program with their dog trainees, and a number of letters from inmates saying how much the program changed their lives, gave them purpose, and helped them give back to society. AFAICT, the participating prisons are all in New York. Not sure if the program exists in other states, but it probably should.
https://puppiesbehindbars.com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/709/495/675/591/288/original/50c03eeb4578c20e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/709/495/686/644/728/original/78de5ce2871d0228.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/709/495/689/116/441/original/466db21b44b665d8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/709/495/696/457/752/original/da331323b6f4cc46.png

2026-06-05 13:26:40 UTC

Sit with this for a second: If the White House had its way, all the immigrants in this country would be dead -- at least on paper. WaPo reports that the Trump administration had plans to classify 2.7 million living people — including some U.S. citizens and lawful permanent residents — as dead as part of its immigration enforcement efforts. The plan reportedly fell apart after pushback from Social Security Administration employees who were tasked with implementing it.
https://www.washingtonpost.com/politics/2026/06/05/doge-planned-falsely-mark-27-million-people-dead-whistleblower-says/

2026-06-01 17:40:20 UTC

New, by me: A number of high-profile and/or valuable Instagram accounts, including those of the Obama White House and the Chief Master Sergeant for the U.S. Space Force, got hacked and defaced with pro-Iran messaging in the past 24h after people figured out that Meta's AI support assistant could be tricked into resetting account passwords.
From the story:
"A video released on Telegram by pro-Iran hackers claimed to document a remarkably simple exploit that appears to have involved using a VPN connection with an IP address that is in or near the target's usual hometown, requesting a password reset for the account, and then choosing to chat with Meta's AI support assistant. From there, the video shows the attacker told the bot to link the account in question to a new email address, after which the bot dutifully sent that address a one-time code that allowed a password reset."
https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/
#meta #instagram #hack #ai #security
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/676/069/247/046/679/original/9371ad67d54f3427.png

2026-05-31 11:21:00 UTC

Reuters writes that US military personnel are being targeted using location data that is collected and sold on mobile users. The story cites a recent letter from Sen. Ron Wyden (D-Ore.) noting that U.S. Central Command had “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater." Wyden said in a statement that it was time to "start treating the adtech industry as a national security threat."
https://www.documentcloud.org/documents/28167310-department-of-defense-letter-to-ron-wyden/
For more on how mobile ad data is being collected and used to profile people, check out The Global Surveillance Free-for-All in Mobile Ad Data (Oct. 2024)
https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/

2026-05-31 00:14:33 UTC

- reply

Somehow I missed this story in my research concerning Nightwing, the Virginia government contractor where the CISA contractor worked.
May 2, 2025: Raytheon, Nightwing to Pay $8.4 Million in Settlement Over Cybersecurity Failures
"The US government on Thursday announced that it has reached a settlement with Raytheon, RTX Corporation, and Nightwing Group in a lawsuit over the companies’ alleged failures to meet cybersecurity requirements for defense contractors.
Raytheon, a subsidiary of RTX Corporation (previously Raytheon Technologies Corporation), and its then-subsidiary Raytheon Cyber Solutions, Inc. (RCSI), allegedly failed to comply with cybersecurity requirements in 29 contracts and subcontracts with the Department of Defense (DoD). Nightwing is a cybersecurity and intelligence company that spun out of RTX.
According to the settlement, between 2015 and 2021, Raytheon did not implement necessary cybersecurity controls on a system used to perform work on DoD contracts. In 2015, the company landed a DHS cybersecurity contract worth $1 billion.
Raytheon and RCSI allegedly not only failed to implement a security plan for the internal development system, but also failed to ensure that it complied with other Defense Federal Acquisition Regulation Supplement (DFARS) and Federal Acquisition Regulation (FAR) requirements.
Per DFARS and FAR, contractors are required to apply basic safeguarding to systems that process or store federal contract data, and to provide adequate security for those systems, respectively."
https://www.securityweek.com/raytheon-to-pay-8-4-million-in-settlement-over-cybersecurity-failures/amp/

2026-05-30 14:52:55 UTC

Big companies have an expensive new addiction to AI, and their smack is getting more expensive. Who could have seen this coming? From the WSJ:
"Use of artificial intelligence by big companies is exploding—and the soaring cost has some of them pumping the brakes in a way that could complicate AI’s triumphal march across the economy.
Executives across industries this year have urged employees to integrate AI tools into their work, spending freely to encourage experimentation and seeking to send a message to Wall Street that their companies won’t be left behind in a coming wave of disruption."
"All that enthusiasm has resulted in skyrocketing costs for so-called tokens, the basic unit of measurement for AI computing, as AI model providers seek to balance supply and demand and manage their own costs. Some enterprises have hit their annual budget in just three months or reported seeing their AI spending bills double or triple."
"Now corporate leaders are scrambling to bring down expenses by finding ways to ration AI use in their organizations, steer workers toward cheaper, homegrown tools and help them hone their skills to improve returns."
https://www.wsj.com/tech/ai/corporate-america-is-starting-to-ration-ai-as-cost-skyrockets-1eb99d7a (paywall)
https://archive.ph/v2dwg

2026-05-30 03:02:29 UTC

One reason that Microsoft might be issuing such harshly worded language here to describe the researcher may be that, according to Nightmare Eclipse, they until recently worked as a security researcher at Microsoft.
Scroll back far enough through their Xitter account (to June 2020) and you will see they claimed CVE-2019-1385 was theirs.
On July 1, 2021, Nightmare Eclipse complained that Microsoft failed to fix one of the weaknesses they reported in CVE-2021-24084. Microsoft credits both of these flaws to the same researcher, whose LinkedIn account says they are in Germany and worked full time at Microsoft from Sept. 2022 to June 2025.
For the record, I think @nprofile…g4vn called it that this person was a former MS employee.
https://x.com/ChaoticEclipse0/with_replies

2026-05-25 19:05:57 UTC

Nature hikes 101: Leave your headphones behind. Was hiking a trail today and heard a sickening CRACK directly above and saw an enormous tree limb starting to fall directly down on top of me. Literally dove out of the way and got splinters in my face when the thing crashed down. I probably would not be typing this if I'd been obliviously hiking along w/ my headphones on (which I'll admit I do from time to time).

2026-05-25 14:58:04 UTC

So, I guess now that Google has officially shit the bed w/ their AI search, this is going to be my new browser start page from now on.
https://udm14.org/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/635/796/859/443/674/original/ea93a3dcba81cd37.png

2026-05-24 21:08:44 UTC

- reply

@nprofile…75g6 SpaceMountain, OTOH, scared the living crap out of me as a kid. I mean, I absolutely loved how scared I was, but I never felt safe raising my arms b/c it was so dark and you kept seeing metal poles above. I remember getting off that ride and my arms ached so bad because I was holding on so tightly.

2026-05-24 19:05:58 UTC

- reply

@nprofile…75g6 Oh man. I had to sit through that ride as a kid and I wanted to die. Would have rather been on Mr. Toad's ride.

2026-05-24 16:40:08 UTC

To my hearing, there is no more infectious earworm than the Coconut song by Harry Nilsson. I'm not saying a master work of art or anything, just that you will probably be humming (or just hearing) this song the rest of the day. You have been warned.
https://www.youtube.com/watch?v=TsSuueEGQSM

2026-05-23 17:05:57 UTC

I'm sort of wimpy around spiders, but I was marveling at this mama wolf spider outside our door. That is, until I realized she was carrying hundreds of copies of herself on her back that will soon invade our home (several days of heavy rain have forced a ton of creepy crawly things indoors). BUT, they will also eat lots of bugs, so..
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/624/972/637/865/985/original/9fb94d15416bc9fd.png

2026-05-23 16:26:12 UTC

- reply

Come to think of it, that could be a great AI awareness campaign. Just get 1000 different scenarios where people are demonstrably less well-off because of AI: Polluted, diverted or drained water supplies; immense air, noise and heat pollution from countless new gas powered turbines; young grads $500k in debt and watching their field of study evaporate; farmers having trouble being able to buy fertilizer; small businesses literally having trouble keeping the lights on because electricity has skyrocketed in price; and they all just look at the camera and say thanks AI.

2026-05-23 15:37:23 UTC

Feeling pretty good about stocking up on 4 of these bad boys at the end of 2024, when they could be had for ~$350 each. Now, just one of these drives costs as much as I paid for all 4. Thanks, AI!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/624/626/712/578/043/original/ecab5f1493d6854e.png

2026-05-22 18:07:30 UTC

In case you had any doubts about how far this administration is willing to go to interfere with state elections...From Reuters:
"WASHINGTON, May 22 (Reuters) - U.S. President Donald Trump’s election-security czar last year sought to ban voting machines used in more than half of U.S. states by asking whether the Commerce Department could declare their components national-security risks, according to two people with direct knowledge of the matter."
"White House adviser Kurt Olsen, a lawyer Trump has tasked with proving widely debunked election-rigging conspiracy theories, pushed the plan to target Dominion Voting Systems machines. The idea emerged, the sources said, as Olsen and other officials brainstormed about how the federal government could take control over elections from U.S. states, an idea publicly aired by Trump."
"Olsen wanted a national system of hand-counted paper ballots, the sources said, a frequent Trump demand some election-security experts say would be less accurate and potentially riskier than the current system of machines with auditable paper trails that almost all cities and states use."
"The plan to exclude the machines, reported here first, got far enough that in September, Commerce Department officials began exploring what grounds could be invoked to execute it, three additional sources said. It eventually collapsed, however, because Olsen and other administration staffers working with him failed to provide evidence to justify such a move, two of the sources said."
https://www.msn.com/en-us/news/politics/exclusive-trump-officials-tried-to-ban-half-of-us-voting-machines-citing-conspiracy-theories/ar-AA23Oxyg

2026-05-22 17:31:51 UTC

- reply

There's a tendency for organizations to react to inadvertently exposing secrets in public code repositories by disabling the repo in question on GitHub, but then taking their time to rotate the exposed credentials. I guess the thinking is that well, maybe nobody noticed. And that's pure folly. From today's story:
"Ayrey said his company Truffle Security monitors GitHub and a number of other code platforms for exposed keys, and attempts to alert affected accounts to the sensitive data exposure(s). They can do easily on GitHub because the platform publishes a live feed which includes a record of all commits and changes to public code repositories. But he said cybercriminal actors also monitor these public feeds, and are often quick to pounce on API or SSH keys that get inadvertently published in code commits."
"In practical terms, it is likely that cybercrime groups or foreign adversaries also noticed the publication of these CISA secrets, the most egregious of which appears to have happened in late April 2025, Ayrey said.
“We monitor that firehose of data for keys, and we have tools to try to figure out whose they are,” he said. “We have evidence attackers monitor that firehose as well. Anyone monitoring GitHub events could be sitting on this information.”"

2026-05-22 16:39:14 UTC

New, by me: Lawmakers Demand Answers as CISA Tries to Contain Data Leak
"Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials."
From the story:
"KrebsOnSecurity has learned that more a week after CISA was first notified of the data leak by the security firm GitGuardian, the agency is still working to invalidate and replace many of the exposed keys and secrets."
"On May 20, KrebsOnSecurity heard from Dylan Ayrey, the creator of TruffleHog, an open-source tool for discovering private keys and other secrets buried in code hosted at GitHub and other public platforms. Ayrey said CISA still hadn’t invalidated an RSA private key exposed in the Private-CISA repo that granted access to a GitHub app which is owned by the CISA enterprise account and installed on the CISA-IT GitHub organization with full access to all code repositories."
https://krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leak/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/619/204/346/413/400/original/e1050233c912b78d.png

2026-05-22 14:32:08 UTC

- reply

@nprofile…tg2e I'm not sure that's an accurate synopsis of the crowd here. I think there's a broad recognition that AI is good at certain things. The resistance from this community seems to be more about how AI is being crammed down everyone's throats whether they want it or not, how it's flaunting data privacy and security concerns at every turn, and how it's raping the environment and scarce natural resources in the process. To say nothing on AI's hoovering up copyrighted works while cheapening and degrading the creative process that drives so many careers in the arts. In short, the resistance comes from people who have decided that the trade-offs with AI are unacceptable.

2026-05-22 12:33:40 UTC

If AI is truly making it easier to find security bugs in code (which it appears to be doing), then it makes sense that bug bounty programs may be far less willing to pay a lot of money for a single bug report. From El Reg:
"Finding vulns just doesn't pay like it used to. At least one bug hunter who found an open source security flaw and reported it months ago via HackerOne's backlogged Internet Bug Bounty (IBB) program finally got paid for his work - but at a drastically reduced reward rate. The security researcher found a medium-severity vulnerability that previously paid $1,843. As of Monday, HackerOne's IBB pays $297 for the same severity level. Similarly, the new IBB cash prize for a critical vulnerability is $2,257, compared to the previous $9,250 reward. High-severity bugs now fetch $1,009, while they used to earn a $4,429 payout. And low-severity bugs earn researchers $68, compared to the previous $597 reward."
Not to say that AI has somehow stopped the beg bounty madness. I seem to get more unbidden bug reports from researchers these days than ever, and half the time the bugs are fixed "in the cloud" w/out much notice or fanfare (or CVEs).
https://www.theregister.com/security/2026/05/21/hackerone-takes-an-axe-to-its-bug-bounty-rewards/5244458

2026-05-18 20:55:23 UTC

New, by me: CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/597/563/541/512/344/original/8f9a823d2ae9bc9c.png

2026-05-16 00:58:05 UTC

Arts and humanities grads at the University of Central Florida booed a commencement speaker who heralded AI as the next industrial revolution. It went over like a lead balloon:
“The rise of artificial intelligence is the next industrial revolution,” she said, addressing a sea of black caps, gowns and tassels, most of them with newly acquired degrees in creative disciplines, including film, animation and media production.
The crowd booed.
“What happened?” Caulfield stammered, looking over her shoulder, as if searching for an escape hatch. “OK, I struck a chord! May I finish? Only a few years ago, A.I. was not a factor in our lives.”
The crowd erupted in cheers.
“And now, A.I. capabilities are in the palm of our hands.” Boooooooooo."
https://www.nytimes.com/2026/05/14/style/ucf-commencement-ai-booed-gloria-caulfield.html

2026-05-12 22:15:20 UTC

I had a daydream today where I imagined an AI dystopian future where AI models are "doxing" each other by pointing out live zero-days in each others' platforms. I'm not sure this is as sci-fi as it sounds.

2026-05-12 21:55:45 UTC

ZOMG PATCH TUESDAY! As today's post explains, it's not just Microsoft increasing the volume (and pacing) of patch releases lately as a result of code audits reportedly from Anthropic's much-hyped and exclusive Glasswing AI offering. Other software giants are getting in on the act now!
https://krebsonsecurity.com/2026/05/patch-tuesday-may-2026-edition/
#patchtuesday #microsoft #anthropic

2026-05-12 21:11:10 UTC

I love that an image of the Microsoft Update page is the only relevant one in the first results on Shutterstock when you search for "windows patch tuesday" (or maybe this is only when *I* search this term, IDK). I'm not even bothered by the fact that Shutterstock somehow associates dogs with Microsoft. It's mostly scenes that evoke a much happier endeavor (apart from the dog on the left who appears to be trying to eat the photographer).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/563/648/913/052/191/original/3e3068ee7fcb6018.png

2026-05-12 20:08:04 UTC

We've come to an icky time in security when the concern about using outdated, unpatched software starts to become overshadowed by the fear of downloaded some backdoored update.

2026-05-12 00:52:02 UTC

- reply

Instructure says it paid a ransom. SMH
"STATUS UPDATE 5/11/26
We know that concerns about the potential publication of data related to this incident remain top of mind for many customers. We understand how unsettling situations like this can be, and protecting our community remains our top priority."
"With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident. As part of that agreement:"
"The data was returned to us.
We received digital confirmation of data destruction (shred logs).
We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise."
'This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.
While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible. We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses."
https://www.instructure.com/incident_update

2026-05-11 21:28:15 UTC

The nice thing about AI is you can blame all your breaches on it and everyone's like oh okay that tracks.
"On May 5, 2026, Community Bank discovered an internal incident involving the handling of non-public customer information through an unauthorized AI-based software application."
https://www.board-cybersecurity.com/incidents/tracker/cb-financial-services-cybersecurity-incident-2b5a3883

2026-05-08 03:07:06 UTC

New, from me: Canvas Breach Disrupts Schools and Colleges Nationwide
"An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions."
"Canvas parent firm Instructure [NYSE:INST] responded to today's defacement attacks by disabling the platform, which is used by thousands of schools, universities and businesses to manage coursework and assignments, and to communicate with students."
Lots more here:
https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
#canvas #breach #shinyhunters #instructure
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/536/721/932/019/959/original/a4d51ec80caca497.png

2026-04-25 19:42:00 UTC

I've noticed an interesting shift lately in the Letters to the Editor I get from people who are convinced an unknown tormentor is tracking their every movement through every device they own and then some. I generally don't engage these readers, who almost universally say hello with an absolute wall of text.
But lately, these pleas have come in the form of someone's AI bot breaking down the alleged tracking in painstaking, bullet point detail. The implication is that well the AI bot forensically analyzed the situation and this is the report it produced. As if the AI couldn't be the cause or at least enabler of this person's all-consuming paranoia.

2026-04-22 12:49:30 UTC

- reply

@nprofile…vchw @nprofile…g4vn @nprofile…gvek @nprofile…hwq5 I'd say it's more like the Golden Age of Cybercrime. Seriously, it's probably never been a more exciting time to become an arch cybercriminal.

2026-04-21 14:58:12 UTC

New, by me:
'A 24-year-old British national and senior member of the cybercrime group “Scattered Spider” has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Buchanan’s hacker handle “Tylerb” once graced a leaderboard in the English-language criminal hacking scene that tracked the most accomplished cyber thieves. Now in U.S. custody and awaiting sentencing, the Dundee, Scotland native is facing the possibility of more than 20 years in prison."
https://krebsonsecurity.com/2026/04/scattered-spider-member-tylerb-pleads-guilty/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/443/274/546/057/735/original/159263b13544ec3c.png