@Javvad@infosec.exchange

· 1w ago

The FBI got hacked and now criminals have home addresses, medical records, and family details of thousands of agents. The agency that investigates cyber crime couldn't protect its own workforce from it. The irony is so thick you could investigate it. https://www.bbc.co.uk/news/articles/cm4gjjlgzdjgo

Agents fearful and angry after 'dangerous' FBI data breach

BBC News

Agents fearful and angry after 'dangerous' FBI data breach

Current and former agents speak to the BBC about the devastating impact of the FBI hack.

3

1

0

· 2mo ago

Open source licensing survives on trust: you can use this, but respect the terms. AI training obliterates that chain by copying millions of repos into models, stripping away the license context, and selling the patterns back as a product. The copyright problem doesn't disappear just because it's harder to see. https://api.cyfluencer.com/s/ai-open-source-and-intellectual-property-28631

AI, Open Source and Intellectual Property

api.cyfluencer.com

AI, Open Source and Intellectual Property

How AI training challenges open source, copyright, licensing, and the wider fight over creative work, voices, faces, and digital identity.

13

0

10

0

· 2mo ago

A password that takes 14 years to crack via brute force is useless to protect you if it's already in a breach database and attackers are using it in credential stuffing attacks. https://api.cyfluencer.com/s/new-research-does-argon2-mean-your-password-is-uncrackable-28757

[New Research] Does Argon2 Mean Your Password is Uncrackable?

Specops Software

[New Research] Does Argon2 Mean Your Password is Uncrackable?

Does Argon2 make passwords uncrackable? See how it performs against the latest hardware with this research from Specops.

8

3

2

0

· 2mo ago

Dinosaurs ruled for 165 million years. Mayflies live a day. Stop confusing "legacy" with "outdated" and "new" with "better. https://blog.knowbe4.com/what-security-can-learn-from-dinosaurs

blog.knowbe4.com

What Security Can Learn From Dinosaurs

Why 165 million years of dinosaur dominance is a better model for human risk management than any 'modern' pitch deck.

7

1

4

0

· 1mo ago

The US is now using lasers to shoot drones at the border. We have reached peak science fiction while still arguing about basic password hygiene. https://www.wired.com/story/high-energy-laser-us-shoots-down-drones-near-mexico-border/

WIRED

Using High-Energy Laser, US Shoots Down Drones Near Mexico Border

The US Army’s laser system is part of a new generation of directed-energy weapons capable of detecting, tracking, and destroying drones with a concentrated beam of light.

2

1

0

· 2mo ago

A museum accidentally became a brand by embracing the worst review it ever got. Now it's sold 738 shirts in 30 hours. The lesson isn't about turning lemons into lemonade. It's about having the spine to admit you're not what people wanted, and then selling them that admission. https://www.wbur.org/news/2026/07/27/new-bedford-whaling-museum-worst-aquarium-ever-merch

New Bedford Whaling Museum goes viral for ‘worst aquarium ever’ merch

wbur.org

New Bedford Whaling Museum goes viral for ‘worst aquarium ever’ merch

A Google user left a one-star review of the New Bedford Whaling Museum coining the phrase. Last fall, the museum began selling shirts and hoodies with the review on the back and a whale skeleton on the front. Now, the design is capturing national attention.

6

1

2

0

· 2mo ago

A $30 children's smartwatch. Three massive supply chains. Zero authentication. Tens of millions of devices where someone else can silently photograph your kid, hear their conversations, and track their every movement. The real scandal isn't that it's hackable. It's how many brands are built on the same rotten foundation and nobody noticed. https://www.wired.com/story/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids/

WIRED

Hackers Stalked Me by Hijacking a Smartwatch for Kids

Security researchers tracked and eavesdropped on a WIRED reporter using vulnerabilities in a pink plastic smartwatch. It’s just one piece of a deeply insecure supply chain of GPS-enabled gadgets.

4

0

6

0

· 2mo ago

Publicly indexed AI conversations are awkward enough; Anthropic's response "you shouldn't have shared them then" is a masterclass in not reading the room. https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/

PSA: Your Claude shared chats and Artifacts may have ended up on Google | TechCrunch

The issue appears to have originated from Claude’s “share chat” feature, which allows users to create links that enable anyone with the assigned URL view a conversation or project.

3

0

1

0

https://resident.ngo/lab/writeups/check-and-protect-analysis-of-telegram-phishing-operation-targeting-exiled-activist/

· 2mo ago

Activists are getting spear-phished with stunning precision. The Belarusian exile in Lithuania who caught this one deserves a drink—the phishing site cloaked itself to fool scanners, the lure message swapped Cyrillic for Latin lookalikes, and follow-ups echoed back their own device details. Elegant work. Genuinely nasty.

RESIDENT.NGO THREAT LAB

Check and Protect: Analysis of Telegram Phishing Operation Targeting Exiled Activist - RESIDENT.NGO THREAT LAB

In July 2026, RESIDENT.NGO investigated a cloaked phishing operation targeting the Telegram account of an exiled Belarusian activist living in Lithuania. Delivered in a private Telegram Secret Chat as a fake Telegram security alert, the phishing link led to a convincing Telegram-themed page designed to capture one-time login codes in…

3

0

· 2mo ago

The AI standards agency has now cycled through three leaders in six months. At this rate, the job posting will have fresher ink than the person's business cards. https://techcrunch.com/2026/07/20/trumps-latest-ai-czar-has-already-resigned/

Trump's latest AI czar has already resigned | TechCrunch

The director role for the Center for AI Standards and Innovation (CAISI) has become a revolving door since David Sacks left his position as czar.

3

0

4

1

· 2mo ago

We've built a doomsday system in orbit and most people have no idea it's there. The rules exist. Nobody's following them. Meanwhile, a trillion-dollar company is launching a million satellites to improve your wifi. https://www.theguardian.com/lifeandstyle/2026/jul/20/doomsday-system-physicist-laura-grego-satellites-nuclear-weapons-battle-skies-space-elon-musk

theguardian.com

2

3

0

· 2mo ago

We spent thirty years warning people not to copy floppy disks. Turns out we should have been telling them to copy them before they rotted away. https://hackaday.com/2026/07/07/its-now-imperative-that-you-copy-that-floppy/

Hackaday

It’s Now Imperative That You Copy That Floppy

In the early 1990s, Don’t Copy That Floppy was an anti-piracy campaign that attempted to connect with computer-savvy youth through the power of hip-hop. While somewhat difficult to imagine gi…

2

3

1

0

· 2mo ago

Met up for lunch with @DanRaywood@infosec.exchange and @MoA@infosec.exchange yesterday... we missed you @wendynather@infosec.exchange I've come to the conclusion that nearly has at least one cool Wendy Nather story to tell. You should join us next time, and we promise to get a second cup of coffee just for you!

2

5

0

· 2mo ago

Airbus is moving 900 critical apps off AWS to a French cloud provider. Not because American tech is bad. Because American law can demand access to it anywhere. Europe's sovereignty problem just became Europe's vendor opportunity. https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cloud

thenextweb.com

Airbus is moving its most critical apps off AWS to a French cloud

Airbus is moving 70 critical apps from AWS to France's Scaleway for digital sovereignty, keeping sensitive data shielded from US extraterritorial law.

2

0

· 2mo ago

71% of organisations have AI in production. 16% can actually govern it. Your IR playbook doesn't cover hallucinations. You can't patch a probability distribution. Time to build a new one. https://www.csoonline.com/article/4196303/ai-incidents-need-a-new-playbook-heres-how-to-build-one.html

CSO Online

AI incidents need a new playbook. Here’s how to build one

Old-school security playbooks can't handle AI glitches, so companies need a fresh approach to catch model errors and legal risks before they backfire.

2

1

0

cybersec.picussecurity.com

· 2mo ago

They've turned your calendar into a postbox. Commands arrive as events scheduled for the year 2099, stolen data leaves as encrypted attachments, all riding through Microsoft Graph as if you'd planned it yourself. The beauty of HOLLOWGRAPH is that it never touches attacker infrastructure. https://cybersec.picussecurity.com/s/hollowgraph-backdoor-turns-microsoft-365-calendars-into-a-c2-channel-28829

HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

Learn how HOLLOWGRAPH malware works: Microsoft 365 calendar dead drop C2, encrypted exfiltration, and IPv6 DNS credential refresh.

1

0

· 2mo ago

Replying to

@krypt3ia@infosec.exchange Why wouldn't they

1

2

0

· 2mo ago

Everyone's arguing about who owns AI agent security. They're all wrong. The answer is nobody, which is precisely why it matters. https://api.cyfluencer.com/s/understanding-the-ai-agent-security-ecosystem-roles-responsibilities-and-where-runtime-authority-fits-28828

Understanding the AI Agent Security Ecosystem: Roles, Responsibilities, and Where Runtime Authority Fits

Akeyless

Understanding the AI Agent Security Ecosystem: Roles, Responsibilities, and Where Runtime Authority Fits

As enterprises deploy AI agents, an entirely new security ecosystem is emerging.

1

3

0

· 2mo ago

Replying to

@FishermansEnemy@infosec.exchange 100%

1

0

· 2mo ago

We've spent years celebrating passkeys as the thing that finally kills password attacks. Turns out the attacks just changed uniforms. https://www.darkreading.com/identity-access-management-security/flaws-passkeys-implementation-old-attacks-work

Dark Reading

Flaws in Passkey Implementation Show Old Attacks Still Work

Researchers find exploitable flaws in Microsoft passkey systems that allow attackers to bypass phishing-resistant authentication

1

0

https://javvadmalik.com/2026/07/28/the-floppy-disc-generations-data-problem/

· 2mo ago

The Floppy Disc Generation’s Data Problem

I keep a box of cables in the garage. Not even sure why anymore. VGA cables, SCSI terminators, a couple of those old parallel printer cables thick as garden hoses. I pulled it down last weekend because my daughter needed an HDMI cable and I thought maybe I had one in there. I didn't. What I found instead was a box of old VHS tapes.

The Floppy Disc Generation’s Data Problem

I keep a box of cables in the garage. Not even sure why anymore. VGA cables, SCSI terminators, a couple of those old parallel printer cables thick as garden hoses. I pulled it down last weekend bec…

1

0

https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/

· 2mo ago

Man tried to use a duress password at the border. Now he's being prosecuted for destroying his own phone. The government is writing new law in real time and calling it enforcement.

US accuses American of allegedly wiping his phone using a 'duress' password during border search | TechCrunch

A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constitutional rights at the U.S. border.

1

0

· 2mo ago

90,000 surveillance cameras across the US, installed quietly, tracking your vehicle's make, model, colour, damage, bumper stickers. Most people have no idea they're there. Democracy needs consent, not surprise. https://www.zdnet.com/article/flock-ai-cameras-risks-us-how-to-find-nearby-what-they-track/

ZDNET

90,000 Flock cameras have quietly gone up in the US: What they track and how to check your city - ZDNET

Flock cameras are everywhere - even in my small town, quietly using AI to identify your car and surveil your movements. But did you consent? Probably not.

1

0

2

0

· 2mo ago

Breach of Confidence: 24 July 2026 I've been trying to explain to my kids why I don't let them use AI to write their homework. Then I read that OpenAI's own models broke out of their sandbox and cheated on a test by hacking Hugging Face. So basically, we've raised silicon sociopaths who'd rather exploit the system than do the work. Parenting is hard enough without my laptop setting a bad example. https://javvadmalik.com/2026/07/24/breach-of-confidence-24-july-2026/

Breach of Confidence: 24 July 2026

I’ve been trying to explain to my kids why I don’t let them use AI to write their homework. Then I read that OpenAI’s own models broke out of their sandbox and cheated on a test b…

1

0

cybersec.picussecurity.com

· 2mo ago

Automated pentesting covers maybe 10-15% of your environment. The rest needs breach simulation, exposure validation, and continuous control testing. Otherwise you're validating nothing, just feeling better about the slice you tested. https://cybersec.picussecurity.com/s/where-does-automated-pentesting-fit-in-ctem-28632

Where Does Automated Pentesting Fit in CTEM?

Where Does Automated Pentesting Fit in CTEM?

Learn where automated pentesting fits in CTEM, its limitations, and how BAS and exposure validation complete the Validation stage.

1

0

· 2mo ago

GPT-5.6 Sol and a pre-release model escaped their sandbox and attacked Hugging Face's package repo, which raises the obvious question: if you're testing "weapons-grade offensive models," an airgap might be the minimum viable precaution https://www.bleepingcomputer.com/news/security/openai-says-its-ai-models-hacked-hugging-face-during-testing/

BleepingComputer

OpenAI says its AI models hacked Hugging Face during testing

OpenAI says its AI models, including GPT‑5.6 Sol and a pre-release model, hacked into the Hugging Face artificial intelligence repository while being tested in a sandboxed testing environment.

1

2

0

· 2mo ago

Replying to

@wendynather@infosec.exchange Does a comedian worry that they've told the same joke set too many times? Does captain Sully wonder if he's told his story a few too many times? (spoiler alert, he landed the plane safely) Was the audience able to say, "I saw Wendy Nather on stage live!!!" Now that's something worth talking about :)

1

0

· 2mo ago

Everyone's building AI datacenters at sprint speed and securing them at shuffle. The infrastructure layer is where this gets decided, not the model. https://api.cyfluencer.com/s/the-top-10-data-centre-and-ai-infrastructure-security-risks-28611

FORGE

Top 10 Risks

A practical security framework for Neoclouds and AI Data Centers: the Top 10 risks in the layer that trains, hosts, and serves AI.

1

0

· 2mo ago

Replying to

@sawaba@infosec.exchange I found a whole box of old VHS tapes the other day - and a video player. Ordered a scart to HDMI converter and most of them still work. My kids are like, "why are these such poor quality" :D

1

0

@lilithsaintcrow@raggedfeathers.com

· 2mo ago

RE: https://raggedfeathers.com/@lilithsaintcrow/116954401893898737 "The primary complaint from the community is visibility. Because the concrete barriers sit extremely low to the ground, neighbors argue that aggressively driving or distracted motorists simply cannot see them until it is too late." Better the barrier than the cyclist!

Quoting

Lili Saintcrow

"Ironically, the trail of wrecked cars actually proves that the protected bike lanes are doing exactly what they were designed to do: take the hit." https://www.motorbiscuit.com/atlantas-new-bike-barriers-are-flipping-cars-and-sparking-debate/

Open quoted post

1

0

· 2mo ago

Someone's built a microphone jammer using ultrasonic transducers and an RP2040. Works brilliantly. Now we wait for the inevitable arms race where phones develop better audio processing, then someone builds a better jammer, then phones get smarter still. Lovely. https://hackaday.com/2026/07/23/mic-jammer-relies-on-ultrasound/

Hackaday

Mic Jammer Relies On Ultrasound

Today’s phone microphones are perfectly adept at picking up sound in all sorts of conditions, and they’re backed by all kinds of processing techniques to filter out noise and capture cl…

0

1

0

· 2mo ago

Replying to

@krypt3ia@infosec.exchange Smoke em while you got em... right?

0

1

0

· 2mo ago

Still Got My Nokia Somewhere Up There I still have my Nokia 3210 somewhere. Not in a drawer I can easily reach but boxed up in the garage with the party decorations and a broken food processor I've been meaning to fix since 2019. I know it's there because I packed it deliberately when we moved house, which means at some point I looked at a phone with a cracked screen, a battery that hasn't held charge since the Blair administration, and the faint ghost of a Snake high score, and thought: *I might need this.* https://javvadmalik.com/2026/07/29/still-got-my-nokia-somewhere-up-there/

Still Got My Nokia Somewhere Up There

I still have my Nokia 3210 somewhere. Not in a drawer I can easily reach but boxed up in the garage with the party decorations and a broken food processor I’ve been meaning to fix since 2019.…

0

· 2mo ago

Welcome to JFK, Please Lower Your Expectations JFK airport looks like it was designed by a steering committee of tired men who only took the job because it paid well and gave them a crew to discuss their golf scores with. The entire setup before you get through security is old and confusing.The signage appears to have been created during a power cut by someone who had heard of arrows but had not yet seen one in the wild. https://javvadmalik.com/2026/07/30/welcome-to-jfk-please-lower-your-expectations/

Welcome to JFK, Please Lower Your Expectations

JFK airport looks like it was designed by a steering committee of tired men who only took the job because it paid well and gave them a crew to discuss their golf scores with. The entire setup befor…

0

2

0

· 1w ago

Meta's playbook never changes: violate privacy, get caught, pause, wait for outrage fatigue, launch again. Rinse, repeat, profit. And we keep pretending we're surprised. https://www.anildash.com/2026/09/29/facebook-fake-out/

anildash.com

The Facebook Fake-out - Anil Dash

A blog about making culture. Since 1999.

0

1

0

cybersec.picussecurity.com

· 2mo ago

Everest ransomware does three things at once: encrypts your files, sells your network access, and pays your employees to let them in. The business model is almost respectable. https://cybersec.picussecurity.com/s/everest-ransomware-triple-threat-of-encryption-access-and-insiders-28566

Everest Ransomware: Triple Threat of Encryption, Access, and Insiders

Everest Ransomware: Triple Threat of Encryption, Access, and Insiders

Everest Ransomware encrypts Windows hosts, steals data, and sells network access. Learn how it works and how to defend against it.

0

· 2mo ago

Industry walked into CISA town halls and basically said: count fewer of us, tell us to report less, give you less detail when we do. The most significant cyber law Congress ever passed is being negotiated down to something manageable. https://cyberscoop.com/cisa-circia-cyber-incident-reporting-rule-feedback/

Industry's message on CIRCIA: Please ask us fewer questions about cyberattacks

CyberScoop

Industry's message on CIRCIA: Please ask us fewer questions about cyberattacks

Critical infrastructure groups are pressing CISA to narrow its long-delayed CIRCIA cyber reporting rule, demanding fewer covered entities and reduced reporting burdens.

0

https://techcrunch.com/2026/07/25/the-hacker-who-humiliated-spyware-makers-and-was-never-caught/

· 2mo ago

A hacker who demolished spyware makers, funded resistance movements, and vanished without trace. A decade later, still free. Phineas Fisher reminds us that the most dangerous person isn't always the loudest.

The hacker who humiliated spyware makers and was never caught | TechCrunch

An awe-inspiring hacktivist who hacked two controversial government spyware makers may be the most prolific hacker to have never gotten caught. What do we know about Phineas Fisher?

0

https://medium.com/@billmarczak/an-angry-spark-or-a-triangle-in-disguise-ac32852a1be3

· 2mo ago

They found spyware that nobody had ever seen before. Then they realised they'd actually seen it years ago, just didn't know what they were looking at.

Medium

An Angry Spark, or a Triangle in Disguise?

On April 14, 2026, Gen Digital published “Chasing an Angry Spark”, a report about sophisticated Windows spyware that Gen saw once in 2022…

0

· 2w ago

Most people abandon platforms with poor engagement metrics. Fowler keeps posting to Mastodon and Bluesky anyway because they're open. That's the actual ranking system that matters. https://martinfowler.com/articles/2026-social-traffic.html

martinfowler.com

Social Media Engagement: summer 2026

0

· 2mo ago

Breach of Confidence — 31 July 2026 I've been thinking about the number of security products that promise to solve problems nobody actually has. Then I remembered that most actual problems don't have vendors. The government just made up a new crime A bloke at the US border tried to use a duress password to wipe his phone. Now he's being prosecuted for destroying his own device. Nobody passed a law saying this was illegal. https://javvadmalik.com/2026/07/31/breach-of-confidence-31-july-2026/

Breach of Confidence — 31 July 2026

I’ve been thinking about the number of security products that promise to solve problems nobody actually has. Then I remembered that most actual problems don’t have vendors. The governme…

0

· 3w ago

Apple Watch-Triggered Eavesdropping Concerns

0

https://www.bleepingcomputer.com/news/security/new-dolphin-x-malware-uses-ai-to-rank-high-value-targets/

· 2mo ago

Dolphin X apparently uses AI to prioritise high-value victims automatically... oh dear me.

BleepingComputer

New Dolphin X malware uses AI to rank high-value targets

A new Dolphin X remote access trojan claims to use an AI-powered profiling feature to score and rank infected users, helping cybercriminals identify which victims should be targeted first.

0

· 2mo ago

The Robots Have Escaped, Please Buy Our Product It feels a bit like watching the latest epic blockbuster in the iMax. OpenAI and Anthropic announce that their models have escaped from secure testing environments, reached the internet and attacked real systems. We are expected to nod as the companies describe “unprecedented cyber capabilities” and models going to “extreme lengths”. It sounds like a warning, but it also sounds like a product launch. https://javvadmalik.com/2026/08/03/the-robots-have-escaped-please-buy-our-product/

The Robots Have Escaped, Please Buy Our Product

It feels a bit like watching the latest epic blockbuster in the iMax. OpenAI and Anthropic announce that their models have escaped from secure testing environments, reached the internet and attacke…

0