← Feed

Posts

• View post

  Found the Binance hacker.

• View post

  Binance said that its $6.3 billion crypto breach "may involve a compromised DevOps engineer’s laptop." If a single employee's laptop was able to access Binance's systems capable of controlling billions of dollars worth of crypto, that's the *company's* fault — not the employee's. https://this.weekinsecurity.com/that-big-company-hack-probably-was-not-an-employees-fault/

• View post

  This week was, to put it mildly, a cybersecurity clusterfuck. Every Sunday, I separate all the news from the noise in my free newsletter https://this.weekinsecurity.com, and this week is no exception. All of the stories you need to know, plus a reader-submitted cyber-cat for fun. 🐈‍⬛ Sign up (or RSS) today! No AI use, and no email open/link tracking for your privacy.

• View post

  I filed a FOIA with the FBI earlier this year for all records from Jan 1, 2026 onwards (limited for responsiveness) relating to the Silent ransomware gang, which allegedly sent people to victims' offices to gain physical access to their systems. No records beyond its IC3 flash in May, some withheld. https://www.documentcloud.org/documents/28833639-silent-ransomware-groupfbi-foia/

• View post

  I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly didn't, but how the PHP-ocalypse is likely just the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time. More: https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/ Bypass for ad-blockers: https://web.archive.org/web/20261026132130/https://techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-...

• View post

  iPhone and iPad users still running iOS 18, update today, as Apple just back-ported a fix for a zero-day bug targeting devices running "versions of iOS before iOS 27." https://support.apple.com/en-us/149225

• View post

  Bluesky is blocking links to DDoSecrets, which is hosting the leaked dataset of 40,000+ Homeland Security employees. A searchable version of the site hosted by maia arson crimew also appears down after a DHS takedown demand on the domain registrar. More: https://techcrunch.com/2026/10/29/bluesky-blocks-links-to-leaked-dhs-employee-data-as-government-seeks-takedowns/ Bypass for ad-blockers: https://web.archive.org/web/20261029135114/https://techcrunch.com/2026/10/29/bluesky-blocks-links-to-lea...

• View post

  NEW: U.S. Dept. of Homeland Security was breached, allowing a hacker to scrape personnel and contact information data from its Okta sign-on system. The stolen data includes 40,000+ records across DHS agencies, including CBP, ICE, and HSI, as well as DHS leadership — and is now online via DDoSecrets. Read more: https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/ Bypass for ad-blockers: https://archive.is/9jTm...

• View post

  I'm not sure what else I can say about today's ~ this week in security ~ newsletter except to say, it's the "everything is on fire" edition. Thanks so much for reading, sharing, and subscribing. https://this.weekinsecurity.com/this-week-in-security-october-25-2026-edition/

• View post

  Quest Diagnostics says "personal information and patient records" were stolen during a data breach of its lab testing systems. The company hasn't said when the breach began, how many people are affected, or if it's heard from the hackers. Quest's breach page has "noindex" code, so it doesn't show up in search results. 🤦‍♂️ Read more: https://techcrunch.com/2026/10/23/lab-testing-giant-quest-diagnostics-confirms-patients-personal-and-health-data-was-compromised...

• View post

  Incredible reporting from @kevincollier@mastodon.social on how local governments and police departments are able to secure Flock contracts without notifying the public. In several cases, the government bids were *just* under the threshold for public disclosure and council votes, which oftentimes probably would have voted them down. https://www.nbcnews.com/tech/security/flock-cameras-safety-surveil-spread-location-where-contract-town-city-rcna595745

• View post

  You used to rely on MapQuest for printing out driving directions before GPS navigation was a thing. Now it's helping to fight mass surveillance. https://this.weekinsecurity.com/mapquest-now-lets-you-locate-nearby-surveillance-cameras-like-flock/

• View post

  NEW: Governments are abusing online ads to infect people's phones and computers with zero-click spyware, per Citizen Lab. Al Jazeera had ~45 devices hacked this way, simply by visiting a website that displayed a malicious ad. Researchers say it's tip of the iceberg. Read more: https://techcrunch.com/2026/10/15/citizen-lab-says-governments-are-abusing-online-ads-to-hack-people-with-zero-click-spyware/ Ad-block bypass: https://archive.is/Smm3d

• View post

  New, by @lorenzofb@infosec.exchange: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge. https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

• View post

  New, by me: Amazon said it's trying to fix a bug in its billing platform that kicked out incorrect estimates for Amazon Web Services cloud customers. How bad? Some AWS customers reported getting estimates into the billions of dollars. Whoops! More: https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-customers-billions-of-dollars/ Bypass for ad-blockers: https://web.archive.org/web/20260717152958/https://techcrunch.com/2026/07/17/amazon-fixing-bug-that-billed-some-aws-c...

• View post

  Flock confirms it's cutting staff, as the company faces mounting backlash over its surveillance technology. When asked by TechCrunch, a Flock spokesperson wouldn't say if chief executive Garrett Langley took a pay cut as part of the workforce reduction. By me: https://techcrunch.com/2026/10/09/surveillance-company-flock-cuts-staff-as-privacy-backlash-grows/ Bypass for ad-blockers: https://archive.is/epjKf

• View post

  I was researching the Pentagon data leak story earlier and by chance found one of the military's many, many login pages (it's pretty normal — there are lots of them — the DOD is a massive enterprise network). But this link caught my eye. "Learn more about Military Working Dog Nick." *IMMEDIATE CLICK.*

• View post

  CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

• View post

  This is more really important reporting here. It's not enough to just warn of the privacy risks, 404 is out there proving that it's actually happening. Also a reminder that what you upload to AI bots and whatnot is not private, and there's a real cost/toll on the people working behind the scenes. https://www.404media.co/humans-reading-copilot-prompts-images/

• View post

  The theft of the FBI agents/applicants' personal data is quickly becoming a major counterintelligence headache. I'm also aghast at how close to the internet this data was held. Call me old fashioned but some data shouldn't be stored in the cloud at all. https://www.reuters.com/world/shinyhunters-hackers-say-they-stole-psychiatric-medical-records-fbi-staff-2026-09-25/

• View post

  It's been an *insanely* busy week in cybersecurity. Need a catchup of all the top and most important stories that you need to know, hand-picked and written by a human (me 👋) ...plus, a roundup of good news, and a reader-submitted cyber-cat (or friend)? 🐈‍⬛ Sign up/RSS for my free weekly newsletter. No email open/link tracking (because privacy!): https://this.weekinsecurity.com

• View post

  Special shout-out to area shitbag Ben Halpern (ben@forem.com) and his team of arseholes who published fake AI-generated slop attached to my name on their site. I did not (nor would I) write this AI slop shit, and would encourage all to be mindful for fake bylines on shitty websites like this one.

• View post

  FBI tells me it's "aware of claims" of a hack affecting its jobs site and is "currently investigating.” ShinyHunters, meanwhile, tell me that they are confident that they have data "on mostly all of FBI" and a substantial amount of applicants' data. More: https://techcrunch.com/2026/09/22/hacking-group-shinyhunters-claims-it-breached-the-fbi-stole-agents-and-applicants-data/ Ad-block bypass: https://web.archive.org/web/20260923112736/https://techcrunch.com/202...

• View post

  In this latest edition of ~ this week in security ~ Apple goes all-in on "always-listening," Berlin is in crisis mode as breach hits before elections, IDScan confirms breach of huge cache of driver's licenses, and 404 Media's brilliant reporting on Homeland Security's predictive policing units. Plus: Revolut falls for fake gov't data demand; and a hacker mostly(!) returns stolen crypto a record-breaking heist. Read online: https://this.weekinsecurity.com/this-week-in-...

• View post

  Watching this Apple event tout how iPhones will soon be able to record ambient audio/conversations and transcribe "high level notes" for you. It's billed as private and end-to-end encrypted, but I think the bigger harm is the normalization of always-listening devices. It's creepy and not normal.

• View post

  FBI tells me it's investigating the suspected breach at IDScan after a crime site let anyone to search the driver's licenses of 150+ million people, including the Secretary of Defense Pete Hegseth. A DOD spox. told me it's aware and "evaluating" the report. Krebs' report: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ My story on TechCrunch: https://techcrunch.com/2026/09/02/it-sure-looks-like-hackers-breached-a-major-id-card-ver...

• View post

  This was really important, powerful reporting by @howelloneill. The US military’s cyberwarfare unit is scrutinizing an unusually high number of deaths by suicide among personnel over a month-long period this summer, according to government officials and other people familiar with the matter. https://www.bloomberg.com/news/articles/2026-08-06/us-military-s-cyber-command-unit-grapples-with-cluster-of-deaths-by-suicide

• View post

  Two researchers scanned Poland's internet out of a sense of patriotism and a desire to make it more secure, and found thousands of gov't and public bodies were at risk of very easy hacks. One bug let them take over two-thirds of Poland's court websites. More: https://techcrunch.com/2026/08/07/security-researchers-scanned-the-polish-web-and-found-courts-hospitals-and-airports-at-risk-of-hacks/ (Bypass for ad-blockers: https://archive.is/pDB7Q)

• View post

  Microsoft wins "lamest vendor response" award at this year's Pwnie Awards, for publishing a blog post earlier this year threatening security researchers with legal action if they published zero-days. Also: Meta wins "epic fail" award after its Meta AI hijack bug. By me: https://this.weekinsecurity.com/microsoft-wins-lamest-vendor-at-pwnie-awards-2026-for-threatening-security-researchers-with-legal-action/

• View post

  FYI, probably the busiest https://this.weekinsecurity.com newsletter in a while dropping tomorrow, plus bonus bits on the blog and more. 🐈‍⬛ Sign up/RSS. (No email open/link tracking, because ew.)