An activist was charged with destruction of evidence after resetting his phone to factory settings
reshared this
RE: techhub.social/@Techmeme/11571…
This is another unneeded action from the Trump administration and is just another way for defence contractors to siphon money from the US govt at inflated prices
Sources: The Trump administration is drafting a new cyber strategy that would enlist private companies to mount offensive cyberattacks on foreign adversaries (Jamie Tarabay/Bloomberg)bloomberg.com/news/articles/20…
techmeme.com/251213/p9#a251213…Sources: The Trump administration is drafting a new cyber strategy that would enlist private companies to mount offensive cyberattacks on foreign adversaries
By Jamie Tarabay / Bloomberg. View the full context on Techmeme.Techmeme
reshared this
The Dutch NCSC on the Notepad++ update hijack attacks:
"Currently, as far as is known, only organizations with interests in East Asia are victims of targeted attacks"
cc: @GossiTheDog
ncsc.nl/actueel/nieuws/2025/12…
Kwetsbaarheid Notepad ++
Er is een kwetsbaarheid in Notepad++ gevonden waarmee het mogelijk is om malafide updates naar gebruikers te pushen. Momenteel zijn voor zover bekend uitsluitend organisaties met belangen in Oost-Azië slachtoffer van gerichte aanvallen.www.ncsc.nl
reshared this
Can you please correct the naming of your Fedidevs.com starter packs?
@filippodb @amministratore dear Mastodon.uno administrators,
I've noticed that some starter packs you've uploaded to the site have incorrect descriptions: they almost seem designed to promote ONLY USERS of your instance, while ignoring all other instances in the #fediverse. In fact, they were all created by service accounts on the mastodon.uno instance.
This seems understandable, but I think it's urgent to rename the descriptions of those starter packs to specify that they are exclusively for users of your instance, otherwise they could mislead other users.
The starter packs in question are as follows:
- Satira vignette e meme (created by the @satira account, a mastodon.uno service account)
- Retrogames (created by the @kickoffworld account, a mastodon.uno service account)
- Profili Free Open Source su Mastodon on Mastodon (created by the @opensource account, a mastodon.uno service account)
- Ambiente Mobilità sostenibile e giustizia climatica (created by the @ambiente account, a mastodon.uno service account)
- Fedilug Account Linux Italiani Account Italian Linux Accounts (created by the @linux account, a mastodon.uno service account)
- Sicurezza digitale (created by the @sicurezza account, a Mastodon.uno service account)
- Fediverso e Social network (created by the @socialnetwork account, a Mastodon.uno service account)
I repeat: it's right to advertise to your users, but it's important to explain that it's self-promotional advertising. For example, the Mastodon UNO & Official Devol Accounts starter pack clearly specifies that it refers to the users of your instance.
This is out of respect for all Italian users of the Fediverse and for the developers who created and made the fantastic Fedidevs resource available for free.
Thank you for your attention and have a good evening
Lorenzo likes this.
reshared this
"Germany has accused Russia of a cyber-attack on air traffic control and attempted electoral interference, and summoned the Russian ambassador. "
bbc.com/news/articles/cvgrrnyl…
Germany accuses Russia of 2024 cyber attack and election disinformation campaign
The Russian ambassador is summoned over a cyber attack on air traffic control and attempted electoral interference.Bethany Bell (BBC News)
reshared this
-EU has a problem attracting and retaining cyber talent
-Coupang CEO resigns following breach
-NoName057 and CARR member charged in the US
-Chrome and Gogs zero-days
-UK sanctions Chinese hacking firms
-Coupang hacker was a cyber employee
-Petco takes down leaky Vetco site
-UK fines LastPass over breach
-Ransomware at HSE Ireland, again
-Russia denies military registry hack
-New PowerShell security feature
Newsletter: news.risky.biz/risky-bulletin-…
Podcast: risky.biz/RBNEWS507/
EU has a problem attracting and retaining cyber talent
In other news: Coupang CEO resigns following breach; NoName057 and CARR member charged in the US; Chrome and Gogs zero-days.Catalin Cimpanu (Risky.Biz)
reshared this
-CA/B Forum to sunset 11 domain validation methods
-Let's Encrypt to reach 1 billion certs in 2026
-Belarus blocks six crypto exchanges
-Russia preparing full Google ban
-US readies "thought police" for foreign travelers
-Ukrainian bot farm operator arrested
-Crypto money launderer pleads guilty
-Dutch man attacked emergency 112 service
-US charges Accenture manager over false cloud security claims
-Cybercrime trainer gets jail sentence
Catalin Cimpanu reshared this.
-More VS Code malicious extensions
-New PeerBlight and NANOREMOTE backdoors, InboxPrime AI PhaaS, PyStoreRAT, 01flip and VolkLocker RaaS
-New DroidLock Android ransomware
-Charming Kitten payroll data leaks online
-New Russian disinfo op backs Musk's EU attacks
-Salt Typhoon operators trained with Cisco back in 2010s
-Traefik misconfiguration disables TLS verification
-SOAPwn vulnerabilities
-Notepad++ fixes update hijack flaw
-Microsoft bug bounty expands to.... EVERYTHING [Gary Oldman voice]
-10k Docker Hub images leak secrets
-1k MCP servers exposed online
-SPAs leak 42k secrets
-We have an OWASP Agentic Top 10
-The 2025 CWE Top 25 is out
MITRE has published the list of Top 25 most common software vulnerabilities of 2025, also known as the CWE Top 25
cwe.mitre.org/top25/archive/20…
CWE - 2025 CWE Top 25 Most Dangerous Software Weaknesses
Common Weakness Enumeration (CWE) is a list of software and hardware weaknesses.cwe.mitre.org
reshared this
I once had to wait after work to catch a programmer who was using a buffer pointer after he'd freed it. QA caught it, and thought it was my code. Nope, but I figured out whose it was.
That one has been around for a long, long time.
Looks like Notepad++ has fixed its update system: community.notepad-plus-plus.or…
This is after reports that users received malicious Notepad++ updates containing malware: doublepulsar.com/small-numbers…
Notepad++ v8.8.9: Vulnerability-fix
Notepad++ release 8.8.9 is available: https://notepad-plus-plus.org/news/v889-released/ Notepad++ v8.8.9 new security enhancement, new features, regression f...Community
reshared this
Some phishers have taken inspiration from Russian cyber-espionage group UTA0355 and are using a technique that tricks users into sharing their OAuth material in a web page (UAT0355 did it via email replies)
pushsecurity.com/blog/consentf…
ConsentFix: Browser-native ClickFix hijacks OAuth grants
Analysing "ConsentFix", a new browser-native attack technique we've detected in the wild, combining OAuth consent phishing with a ClickFix-style user prompt.Luke Jennings (Push Security)
reshared this
Google is rolling out a new feature for Android users that will let them share live video with emergency services.
The new feature is being rolled out in the US and some regions in Mexico and Germany.
It will be available for Android 8 (2017) devices or higher
blog.google/products/android/e…
Share live video with emergency services to get the help you need
During an emergency call or text, a dispatcher can send a request to your Android phone to share live video.Alastair Breeze (Google)
reshared this
RE: mastodon.social/@campuscodi/11…
More research of this type
Intruder found 43k secrets across 5 million single-page apps: businesswire.com/news/home/202…
Bitsight has found more than 1,000 MCP servers exposed on the internet with no authorization in place and exposing sensitive data: bitsight.com/blog/exposed-mcp-…
It’s 2 AM. Do You Know Which AIs Your MCP Server Is Talking To?
Bitsight TRACE research team found roughly 1,000 exposed MCP servers with no authorization in place, revealing new AI vulnerabilities. Read the report now.João Cruz (BitSight)
Security firm Flare has scanned the Docker Hub portal and found secrets and tokens, including for production systems, in more than 10,000 imagesflare.io/learn/resources/docke…
Thousands of Exposed Secrets Found on Docker Hub - Flare
In a month, we found Docker Hub images that contained leaked secrets (including live credentials to production systems) from over 100 companies.Flare
reshared this
CA/B Forum to sunset 11 domain validation methods used to issue TLS certificates
security.googleblog.com/2025/1…
HTTPS certificate industry phasing out less secure domain validation methods
Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the...Google Online Security Blog
reshared this
UK ICO fines LastPass £1.2m for 2022 data breach
ico.org.uk/about-the-ico/media…
Password manager provider fined £1.2m by ICO for data breach affecting up to 1.6 million people in the UK
The Information Commissioner’s Office (ICO) has fined password manager provider LastPass UK Ltd £1.2 million following a 2022 data breach that compromised the personal information of up to 1.6 million of its UK users.ico.org.uk
reshared this
Looks like Twitter finally took down the NoName057 account after yesterday's indictment
reshared this
SOAPwn -- new bugs that can lead to RCE in .NET apps
Vulnerable applications include the Umbraco CMS, Barracuda's Service Center, the Ivanti Endpoint Manager, and more
Microsoft did not fix them
labs.watchtowr.com/soapwn-pwni…
SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies And WSDL
Welcome back! As we near the end of 2025, we are, of course, waiting for the next round of SSLVPN exploitation to occur in January (as it did in 2024 and 2025). Weeeeeeeee.Piotr Bazydlo (@chudyPB) (watchTowr Labs)
reshared this
Dutch prosecutors are seeking an eight-month prison sentence for a man who launched DDoS attacks against the country's 112 emergency line.
The suspect allegedly tried to frame some business partners for the attack
om.nl/actueel/nieuws/2025/12/1…
Zakelijk conflict leidt tot DDoS-aanval 112-centrale: celstraf geëist
Het Landelijk Parket (LP) van het Openbaar Ministerie (OM) heeft woensdag een onvoorwaardelijke gevangenisstraf van acht maanden en een geldboete geëist tegen een 47-jarige man uit Delft.www.om.nl
reshared this
There's this image on social media about how most of the Red Bull team that helped Verstappen win his titles are now gone... but few people posting this remember this drama started from the Verstappens.
This is the definition of shooting yourself in the nuts. You should have 0 sympathy for him
reshared this
The Paxful cryptocurrency exchange has pleaded guilty to laundering crypto-assets linked to scams, fraud, and extortions
Will pay a $4mil fine only
justice.gov/opa/pr/virtual-ass…
Virtual Asset Trading Platform Pleads Guilty to Violating the Travel Act and Other Federal Criminal Charges
Paxful Holdings Inc., an online virtual currency trading platform, agreed to plead guilty yesterday to a three-count information filed in the Eastern District of California and agreed to pay a criminal penalty of $4 million based on its ability to pa…www.justice.gov
reshared this
This constant stream of malicious VSCode extensions won't end anytime soon....
This batch hid its payload, a Rust-based trojan, as PNG files inside the dependencies folder
reversinglabs.com/blog/malicio…
VS Code extensions contain trojan-laden fake image | ReversingLabs
RL researchers have identified 19 malicious extensions on the VS Code Marketplace — the majority containing a malicious file posing as a PNG.ReversingLabs
reshared this
A popular reverse proxy and ingress controller shipped misconfigured versions for the past five months.
The Traefik setting that enabled TLS verification was actually disabling it across the board.
aisle.com/blog/cve-2025-66491-…
CVE-2025-66491: Traefik's "Verify=On" Turned TLS Off
Learn how CVE-2025-66491 exposed a critical TLS verification flaw in Traefik, where "Verify=On" accidentally disabled security for 5 months.AISLE
reshared this
Pffff... the Coupang insider, who allegedly stole the company's data, was apparently a cybersecurity employee
koreajoongangdaily.joins.com/n…
Alleged Coupang data leaker had only worked at company for two years, say police
The former Coupang employee accused of leaking 33.7 million customer data had worked at the company for just two years, according to police on Thursday.Korea JoongAng Daily
reshared this
The Coupang CEO also resigned following the hack and police raids: koreatimes.co.kr/business/comp…
That's the third South Korean CEO to resign after a breach after the KT and SK Telecom ones
Coupang CEO resigns over data breach
Coupang Corp. announced on Wednesday that its CEO Park Dae-jun has resigned amid mounting public outrage over a recent massive data breach that com...Lee Gyu-lee (The Korea Times)
Security firm Flare has scanned the Docker Hub portal and found secrets and tokens, including for production systems, in more than 10,000 images
flare.io/learn/resources/docke…
Thousands of Exposed Secrets Found on Docker Hub - Flare
In a month, we found Docker Hub images that contained leaked secrets (including live credentials to production systems) from over 100 companies.Flare
reshared this
The Justice Department charged a former product manager at Accenture Federal Services with falsely misleading government customers about the security posture of a cloud product offered by the company.
nextgov.com/cybersecurity/2025…
US charges former Accenture employee with misleading feds on cloud platform’s security
Danielle Hillmer, most recently employed with SentinelOne, allegedly concealed a cloud product’s noncompliance with federal security regulations.David DiMolfetta (Nextgov/FCW)
reshared this
RE: flipboard.com/@retrowarehouse/…
If any font needs to be banned, it should be Trebuchet MS...
Inter all the things!!!!
Calibri font is the latest casualty in the Trump administration's war on diversity and inclusion
Secretary of State Marco Rubio directed U.S. diplomats worldwide to use Times New Roman 14-point font for official documents, reversing a Biden-era directive to use Calibri. It’s the rise of the Roman Empire at the U.S.NBC News - By Alexandra Marquez and Abigail Williams
reshared this
The ENISA yearly survey is out: enisa.europa.eu/publications/n…
Yo, EU! Patch your stuff!
NIS Investments 2025 | ENISA
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.www.enisa.europa.eu
reshared this
A new US startup named Operation Bluebird has asked the US Patent and Trademark Office to vacate old Twitter trademarks, claiming that Elon Musk has abandoned them
reshared this
reshared this
Arnad: 50 Valdostani infuriati acchiappano un ladro d'appartamento e lo picchiano con diversi oggetti tra cui un piccone e gli fratturano il bacino. L'altro ladro s'è dato
È un tranquillo venerdì sera ad Arnad, in Valle d’Aosta. Ma la serata viene funestata da due ladri che si introducono in una abitazione nella frazione Sisane, tentando di forzare una cassaforte.
I due, però, vengono colti in flagrante dal vicinato che li ha sentiti e ha chiamato le forze dell’ordine. Nel frattempo, però, parte anche il passaparola tramite cellulare che ha portato in breve tempo molti residenti in strada e, al tentativo di fuga dei malviventi, almeno 50 persone si sono lanciate al loro inseguimento.
Se uno dei ladri è riuscito a dileguarsi, per l’altro – un 40enne – invece le cose sono andate diversamente: i cittadini lo hanno bloccato mentre tentava la fuga verso il bosco, lo hanno accerchiato e picchiato con un piccone fino a procurargli la frattura del bacino. L’uomo è stato poi trasportato in ospedale; la lesione è stata giudicata guaribile in 30 giorni.
reshared this
-Linux adds PCIe encryption to secure cloud servers
-Europol cracks down on Violence-as-a-Service providers
-ICC designates cyberspace as a genocide enabler
-Cambodia busts SMS blaster warehouse
-Police raid Coupang offices
-New Khashoggi lawsuit filed in France
-Aeroflot hack originated from contractor network
-FTC denies SpyFone CEO petition
-Meta agrees to use less personal data for ads in EU
Podcast: risky.biz/RBNEWS506/
Newsletter: news.risky.biz/risky-bulletin-…
Linux adds PCIe encryption to help secure cloud servers
In other news: Europol cracks down on Violence-as-a-Service providers; ICC designates cyberspace as a genocide enabler; Cambodia busts SMS blaster warehouse.Catalin Cimpanu (Risky.Biz)
reshared this
-Patch Tuesday security updates are out
-NDAA 2026 comes with cyber provisions
-New Zealand notifies Lumma victims
-Poland arrests three Ukrainian hackers
-Russia arrests NFCGate hackers
-Spain arrests 19yo hacker
-React2Shell exploitation hits IoT space
-Telegram cracked down on crime channels since Oct '24
-New malware: GhostFrame PhaaS, Spiderman PhaaS, ChimeraWire, DeadLock ransomware, Broadside botnet, GhostPenguin Linux backdoor
-ZeroBoot exploit
Catalin Cimpanu reshared this.
The point of entry for the Aeroflot hack (from July) appears to have been Bakka Soft, an IT company that developed the airline's mobile and web apps
thebell.io/istoriya-bolshogo-v…
История большого взлома. Как хакеры парализовали «Аэрофлот»
С начала войны число атак украинских и белорусских хакеров на крупные российские компании выросло кратно, но не всегда о нихМария Коломыченко (The Bell — деловые новости и аналитика)
reshared this
New Zealand's cybersecurity agency is notifying more than 26,000 users who have been infected with the Lumma Stealer
ncsc.govt.nz/news/nz-cyber-age…
NZ cyber agency alerts thousands to malware infection
The GCSB’s National Cyber Security Centre (NCSC) is emailing thousands of New Zealanders to notify them that their devices may be impacted by malicious software.NCSC NZ
reshared this
Germany's cybersecurity agency has conducted a security audit of ten password managers and found that three of them can access a user's stored passwords—Google Chrome, mSecure, and PassSecurium
bsi.bund.de/DE/Service-Navi/Pr…
Untersuchung: BSI identifiziert Verbesserungsbedarf bei Passwortmanagern
Aufgrund der Sensibilität der in Passwortmanagern gespeicherten Daten bestehen hohe Anforderungen an deren IT-Sicherheit.Bundesamt für Sicherheit in der Informationstechnik
reshared this
Cydome has spotted Broadside, a new variant of the Mirai IoT malware.
The botnet is targeting TBK DVRs, commonly used by the maritime sector, including on some vessels.
reshared this
reshared this
Europol arrests 193 in crackdown against Violence-as-a-Service platforms.
Unclear if any of the arrests are TheCom members
europol.europa.eu/media-press/…
Operational Taskforce GRIMM: 193 arrests in 6 months tackling violence-as-a-service networks | Europol
Europol’s Operational Taskforce (OTF) GRIMM has made significant progress in its first six months of operation, arresting 193 individuals and disrupting criminal networks behind the growth of violence-as-a-service (VaaS).Europol
reshared this
The International Criminal Court will investigate genocide and war crimes that have been enabled through cyberspace (hacks, leaks, social media posts)
The ICC published its new policy and has put cyber on the same footing as crimes committed through other means
reshared this
Per Sysdig, North Korean hackers are now exploiting React2Shell to drop EtherRAT, a remote access trojan that uses Ethereum smart contracts as C2
sysdig.com/blog/etherrat-dprk-…
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks
A novel Ethereum-powered backdoor, EtherRAT, is being deployed through the React2Shell vulnerability (CVE-2025-55182). With multi-layer persistence, blockchain C2, and self-updating payloads, this malware poses a significant threat.Sysdig
reshared this
RE: techhub.social/@Techmeme/11568…
Coupang also filed a complaint over the hack against a former employee, identified as a Chinese national
South Korean media: police raided Coupang's HQ, searching for evidence related to a historic data breach that compromised 30M+ people's personal information (Jane Lanhee Lee/Bloomberg)bloomberg.com/news/articles/20…
techmeme.com/251209/p10#a25120…South Korean media: police raided Coupang's HQ, searching for evidence related to a historic data breach that compromised 30M+ people's personal information
By Jane Lanhee Lee / Bloomberg. View the full context on Techmeme.Techmeme
reshared this
Koi Security researchers have discovered a malicious VSCode theme (Bitcoin Black) and extension (Codo AI) that captures a user's screen and sends it to attackers, in the hopes of capturing passwords and crypto-wallet seed phrases
reshared this
Krypt3ia
in reply to Catalin Cimpanu • • •