Reader

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🔍 Hundreds of registered data brokers ignore user requests around personal data privacy – A study reveals that 40% of registered data brokers in California ignore user requests for data access, highlighting a need for stronger enforcement of privacy laws. https://cyberscoop.com/data-brokers-california-ccpa-non-compliance-privacy/

🚫 Vienna Latino Festival 2025: Tickets für offenbar nicht stattfindendes Event im Verkauf warning – Tickets for the Vienna Latino Festival are being sold, but the venue claims no event is scheduled. Consumers are advised not to purchase tickets until confirmed. https://www.watchlist-internet.at/news/vienna-latino-festival-2025-tickets-fuer-offenbar-abgesagtes-event-im-verkauf/

🫖 A Second Tea Breach Reveals Users’ DMs About Abortions and Cheating data breach – A second breach of the Tea app has exposed sensitive user messages about abortions and cheating, risking user privacy despite claims of legacy data issues. https://www.404media.co/a-second-tea-breach-reveals-users-dms-about-abortions-and-cheating/

✈️ Pro-Ukrainian hackers take credit for attack that snarls Russian flight travel cybercrime – A cyberattack attributed to pro-Ukrainian hackers disrupted Aeroflot's operations, leading to numerous flight cancellations and significant financial damage, as claimed by the hackers. https://arstechnica.com/security/2025/07/pro-ukrainian-hackers-take-credit-for-attack-that-snarls-russian-flight-travel/

📞 Orange, France’s largest telecoms company, hit by cyberattack data breach – Orange has detected a cyberattack affecting its internal systems, causing service disruptions for customers, though no data extraction has been confirmed at this stage. https://therecord.media/orange-telecom-france-cyberattack

⚠️ 40,000 WordPress websites at risk of being hijacked due to vulnerable Post SMTP plugin vulnerability – Over 40,000 WordPress sites using the vulnerable Post SMTP plugin could be hijacked, as low-privileged users can intercept sensitive emails. Many remain unpatched despite a fix being available. https://www.bitdefender.com/en-us/blog/hotforsecurity/40-000-wordpress-websites-at-risk-of-being-hijacked-due-to-vulnerable-post-smtp-plugin

💰 Research shows data breach costs have reached an all-time high cybercrime – The average data breach cost for U.S. companies rose to $10.22 million in 2025, driven by higher regulatory fines, while global costs decreased. Cyberattacks remain the leading cause of breaches. https://cyberscoop.com/ibm-cost-data-breach-2025/

⚠️ PyPI maintainers alert users to email verification phishing attack warning – PyPI warns users of phishing emails from noreply@pypj[.]org impersonating official communications, urging users to verify emails through fake sites to steal credentials. Users are advised to be cautious and change passwords if affected. https://securityaffairs.com/180585/hacking/pypi-maintainers-alert-users-to-email-verification-phishing-attack.html

😈 Decryptor released for FunkSec ransomware; Avast works with law enforcement to help victims security news – Avast has released a decryptor for FunkSec ransomware, aiding 113 victims after the gang's brief operation from December 2024 to March 2025, which reportedly utilized AI in its attacks. https://therecord.media/funksec-ransomware-decryptor-avast

🔒 Ready or not, age verification is rolling out across the internet privacy – The UK has begun implementing age verification for sites hosting adult content, raising privacy concerns as platforms collect sensitive user data. Other countries are expected to follow suit with varying methods and risks. https://www.theverge.com/analysis/715767/online-age-verification-not-ready

🎮 Scammers Unleash Flood of Slick Online Gaming Sites – Krebs on Security cybercrime – Fraudsters are promoting over 1,200 scam gaming sites via social media, offering fake bonuses and ultimately stealing cryptocurrency deposits from users. These scams utilize deceptive ads and automated support systems. https://krebsonsecurity.com/2025/07/scammers-unleash-flood-of-slick-online-gaming-sites/

📦 Users left scrambling for a plan B as Dropbox drops Dropbox Passwords security news – Dropbox will discontinue its password manager, Dropbox Passwords, by October 28, 2025, transitioning users to a view-only mode and recommending 1Password as an alternative. https://www.theregister.com/2025/07/30/dropbox_drops_dropbox_passwords/

⚠️ Attackers actively exploit critical zero-day in Alone WordPress Theme vulnerability – Hackers are exploiting a critical vulnerability (CVE-2025-5394) in the Alone WordPress theme, allowing unauthenticated users to upload files and execute remote code, leading to site takeovers. https://securityaffairs.com/180630/hacking/attackers-actively-exploit-critical-zero-day-in-alone-wordpress-theme.html

🔊 Microsoft's Azure AI Speech needs just seconds of audio to spit out a convincing deepfake security news – Microsoft's Azure AI Speech has been upgraded to generate voice replicas with just seconds of audio, raising concerns over the potential for malicious uses like audio deepfakes. https://www.theregister.com/2025/07/31/microsoft_updates_azure_ai_speech/

🛫 Spying on People Through Airportr Luggage Delivery Service privacy – CyberX9 researchers discovered vulnerabilities in Airportr’s website that exposed personal information and travel plans of users, including government officials, and allowed potential super-admin access. https://www.schneier.com/blog/archives/2025/08/spying-on-people-through-airportr-luggage-delivery-service.html

⚖️ Flo settles class action lawsuit alleging improper data sharing privacy – Flo settled a lawsuit claiming it improperly shared sensitive menstrual data with Meta, leaving Meta to face potential billions in damages as trial approaches. Plaintiffs allege data sharing violated user trust. https://therecord.media/flo-app-settlement-class-action-suit-data-sharing-meta

🌽 Sex toy maker Lovense threatens legal action after fixing security flaws that exposed users' data data breach – Lovense fixed security vulnerabilities that exposed user data and is considering legal action over reports about the bugs, despite claiming no evidence of data misuse. A researcher disclosed the flaws earlier this year. https://techcrunch.com/2025/08/01/sex-toy-maker-lovense-threatens-legal-action-after-fixing-security-flaws-that-exposed-users-data/

---

Some More, For the Curious

🧺 How I hacked my washing machine ¶ hacking write-up – A cybersecurity student shares their experience of reverse engineering a smart washing machine's app, creating notifications for wash cycles, and exploring IoT vulnerabilities. https://nexy.blog/2025/07/27/how-i-hacked-my-washing-machine/

🏭 ICS Security with Labshock: Virtual Oil Plant Hacking Tutorial cyber defense – This guide details setting up a virtual oil plant with Labshock and simulating a cyberattack on its PLC and SCADA systems to enhance ICS security skills. https://blog.nviso.eu/2025/07/29/refinery-raid/

🔐 Google Workspace is rolling out a security update to stop token stealing attacks security news – Google Workspace is implementing a security update aimed at preventing token stealing attacks, enhancing protection for user accounts against unauthorized access. https://www.theverge.com/news/715117/google-workspace-dbsc-cookie-stealing-attack

🔍 Google Project Zero to publicly announce bugs within a week of reporting them security news – Google Project Zero will now announce discovered vulnerabilities within a week of reporting them to vendors, aiming to improve communication and reduce the risk during patch delays. https://therecord.media/google-project-zero-publicly-announce-vulnerabilities-week-after-reporting

🛜 Hunt for Weak Spots in Your Wireless Network with Airodump hacking write-up – This guide introduces using airodump-ng for wireless penetration testing, focusing on identifying and exploiting access points, while covering essential tools and techniques. https://www.blackhillsinfosec.com/hunt-for-weak-spots-in-your-wireless-network-with-airodump-ng/

💰 In search of riches, hackers plant 4G-enabled Raspberry Pi in bank network cybercrime – Hackers used a Raspberry Pi with a 4G modem to infiltrate a bank's network, employing advanced techniques to hide malware and aiming to manipulate the ATM system for theft. https://arstechnica.com/security/2025/07/in-search-of-riches-hackers-plant-4g-enabled-raspberry-pi-in-bank-network/

🐻‍❄️ The Kremlin’s Most Devious Hacking Group Is Using Russian ISPs to Plant Spyware security news – The Russian hacker group Turla is using control over ISPs to plant spyware on targets' computers, exploiting internet traffic manipulation to disable encryption and enable espionage, raising concerns about surveillance. https://www.wired.com/story/russia-fsb-turla-secret-blizzard-apolloshadow-isp-cyberespionage/

🔓 Have I Been Pwned: Pi-hole data breach – A vulnerability in the GiveWP WordPress plugin exposed names and emails of around 30,000 donors to the Pi-hole project, which was reported to Have I Been Pwned. https://haveibeenpwned.com/Breach/ThePi-Hole

🇪🇺 Kommentar zur »EU Data Boundary«: Die Illusion europäischer Souveränität bei der EU-Kommission privacy – The EU's decision to allow Microsoft 365 usage raises concerns over data privacy, as the 'EU Data Boundary' lacks technical verification and does not protect against US access to data, undermining claims of European sovereignty. https://www.kuketz-blog.de/kommentar-zur-eu-data-boundary-die-illusion-europaeischer-souveraenitaet-bei-der-eu-kommission/

☝️ China accuses US of exploiting Microsoft zero-day in cyberattack security news – China alleges U.S. intelligence exploited a Microsoft zero-day vulnerability to conduct cyberattacks on Chinese military enterprises, claiming data theft over an extended period, amid rising tensions over hacking accusations. https://cyberscoop.com/china-accuses-us-of-exploiting-microsoft-zero-day-in-cyberattack/

🐺 Arctic Wolf Observes July 2025 Uptick in Akira Ransomware Activity Targeting SonicWall SSL VPN I Arctic Wolf cybercrime – Arctic Wolf reports increased ransomware attacks exploiting SonicWall SSL VPNs, possibly due to a zero-day vulnerability, urging organizations to disable the service and implement security best practices. https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/

👁️ Microsoft Recall can still nab credit cards, passwords, info privacy – Microsoft's Recall app, designed to screenshot user activity, fails to adequately filter sensitive information like credit card numbers and passwords, raising privacy concerns and potential risks for users. https://go.theregister.com/feed/www.theregister.com/2025/08/01/microsoft_recall_captures_credit_card_info/

🦣 Extending AD CS attack surface to the cloud with Intune certificates cyber defense – This article discusses how vulnerabilities in Intune's certificate management can be exploited to gain unauthorized access to Active Directory, allowing attackers to impersonate Domain Admins using certificates issued with arbitrary subjects. https://dirkjanm.io/extending-ad-cs-attack-surface-intune-certs/

---

CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has identified three new vulnerabilities in products by Cisco and PaperCut and added them to its KEV Catalog, urging federal agencies to address these risks due to active exploitation by cybercriminals. https://www.cisa.gov/news-events/alerts/2025/07/28/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Five Industrial Control Systems Advisories vulnerability – CISA has issued five advisories regarding vulnerabilities in Industrial Control Systems by Johnson, Fuji, NI, Samsung and Delta, urging users to review the details for security updates and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/07/29/cisa-releases-five-industrial-control-systems-advisories ⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA has issued two advisories regarding vulnerabilities in Güralp seismic monitoring devices and Rockwell Automation services, urging users to review for security details and mitigations. https://www.cisa.gov/news-events/alerts/2025/07/31/cisa-releases-two-industrial-control-systems-advisories

🛠️ Eviction Strategies Tool Released security news – CISA launched the Eviction Strategies Tool to aid cyber defenders in incident response, featuring a playbook and a countermeasures database for effective containment and eviction of adversaries. https://www.cisa.gov/news-events/alerts/2025/07/30/eviction-strategies-tool-released

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🚨 Critical Vulnerabilities in Microsoft SharePoint vulnerability – Microsoft has disclosed critical vulnerabilities in SharePoint, enabling remote code execution. Active exploitation is occurring, necessitating immediate isolation and mitigation actions for affected servers. Comment: The big one this week. https://cert.europa.eu/publications/security-advisories/2025-027/

🫏 UK wants to weasel out of demand for Apple encryption back door privacy – Under US pressure, the UK government is reportedly backing down from its demand for Apple to create a back door for iCloud encryption, avoiding a major privacy conflict. https://www.theverge.com/news/710504/uk-apple-encryption-back-door-icloud-adp-backing-down

💸 A Startup is Selling Data Hacked from Peoples’ Computers to Debt Collectors privacy – A startup is profiting by selling hacked data from over 50 million computers to various industries, raising ethical and legal concerns about privacy violations and exploitation of victims. https://www.404media.co/a-startup-is-selling-data-hacked-from-peoples-computers-to-debt-collectors/

📡 WhoFi: Unique 'fingerprint' based on Wi-Fi interactions security research – Italian researchers have developed 'WhoFi,' a biometric identifier using Wi-Fi signal distortions to track individuals across locations, potentially enhancing privacy-preserving surveillance methods. https://www.theregister.com/2025/07/22/whofi_wifi_identifier/

🦠 Arch Linux users told to purge Firefox forks after AUR malware scare malware – Compromised packages of Firefox-based browsers from the Arch User Repository contained a Remote Access Trojan. Users are advised to uninstall affected browsers and check for security breaches. https://www.theregister.com/2025/07/22/arch_aur_browsers_compromised/

👁️ Copilot Vision on Windows 11 sends data to Microsoft servers privacy – Microsoft's new Copilot Vision feature for Windows 11 captures user screens for AI analysis, sending data to its servers, raising privacy concerns. The update also introduces various AI tools and changes to system error displays. https://www.theregister.com/2025/07/23/microsoft_copilot_vision/

🎣 Fake Zoom Call Lures for Zoom Workplace Credentials cybercrime – A phishing campaign exploits Zoom connection issues to trick users into entering credentials on a fake login page, leveraging urgency and deceptive URLs to harvest sensitive information. https://cofense.com/blog/fake-zoom-call-lures-for-zoom-workplace-credentials

⚠️ Google’s AI Is Destroying Search, the Internet, and Your Brain security news – A Pew Research report reveals that Google's AI summary feature significantly reduces clicks on external links, threatening the traffic and business of many websites and blogs by prioritizing AI-generated content. https://www.404media.co/googles-ai-is-destroying-search-the-internet-and-your-brain/

🚨 Kriminelle versenden gefälschte Warnungen, um an Facebook warning – Kriminelle versenden gefälschte Warnungen, um an Facebook-Zugangsdaten zu gelangen. Nutzer sollten ihr Passwort ändern und sich an Facebook wenden, um ihr Konto zu sichern. https://www.watchlist-internet.at/news/kriminelle-versenden-fake-warnungen-um-facebook-accounts-zu-hacken/

🎂 The EFF turns 35, but there's plenty more to do privacy – As the Electronic Frontier Foundation celebrates 35 years, it continues to combat threats to privacy and free speech, focusing on issues like government surveillance, encryption, and data harvesting. https://www.theregister.com/2025/07/24/eff_turns_35/

👶 The Age-Checked Internet Has Arrived security news – New UK laws require strict age verification for accessing adult content, sparking concerns over privacy, data security, and the effectiveness of such measures in protecting children online. https://www.wired.com/story/the-age-checked-internet-has-arrived/

🚔 BlackSuit ransomware gang’s darknet websites seized by police cybercrime – Police from over nine countries seized the darknet sites of the BlackSuit ransomware gang, which is linked to over $500 million in extortion demands, including attacks on notable organizations. https://therecord.media/blacksuit-ransomware-gang-website-takedown

🫖 Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan data breach – The dating safety app Tea suffered a breach exposing user data, including selfies and IDs, which were posted on 4chan. The app confirmed the data is from two years ago. https://www.404media.co/women-dating-safety-app-tea-breached-users-ids-posted-to-4chan/

🎽 Microsoft exec admits it 'cannot guarantee' data sovereignty privacy – Microsoft acknowledges it cannot guarantee data sovereignty for EU customers due to the Cloud Act, which allows US authorities access to data stored by US-based tech firms, raising privacy concerns. https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/

🛟 Allianz Life says 'majority' of customers' personal data stolen in cyberattack data breach – Allianz Life confirmed that hackers stole personal information from the majority of its 1.4 million customers during a July 16 breach, utilizing social engineering to access a third-party CRM system. https://techcrunch.com/2025/07/26/allianz-life-says-majority-of-customers-personal-data-stolen-in-cyberattack/

🎮 Hacker sneaks infostealer malware into early access Steam game malware – A hacker compromised the early access Steam game Chemia, injecting infostealer malware that harvests user data. Users are advised to avoid the game until confirmed safe. https://www.bleepingcomputer.com/news/security/hacker-sneaks-infostealer-malware-into-early-access-steam-game/

---

Some More, For the Curious

🐚 Mass attack spree hits Microsoft SharePoint zero-day defect vulnerability – A critical zero-day vulnerability in Microsoft SharePoint is being actively exploited, allowing unauthorized access to sensitive data. Immediate action is advised to mitigate risks. https://cyberscoop.com/microsoft-sharepoint-zero-day-attack-spree/ 🐚 Disrupting active exploitation of on-premises SharePoint vulnerabilities vulnerability – Microsoft warns of active exploitation of SharePoint vulnerabilities CVE-2025-49706 and CVE-2025-49704 by Chinese threat actors, urging immediate patching and security measures to prevent ransomware deployment. https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ 🐚 What to know about ToolShell, the SharePoint threat under mass exploitation vulnerability – A critical vulnerability in SharePoint (CVE-2025-53770) is under mass exploitation, allowing remote code execution. Microsoft has linked the attacks to Chinese state actors, emphasizing the need for urgent patching and inspection of affected systems. https://arstechnica.com/security/2025/07/what-to-know-about-toolshell-the-sharepoint-threat-under-mass-exploitation/ 🐚 ToolShell: a story of five vulnerabilities in Microsoft SharePoint vulnerability – Multiple vulnerabilities in SharePoint, dubbed ToolShell, are under active exploitation, allowing attackers to gain full control over servers. Organizations are urged to apply patches immediately to mitigate risks. https://securelist.com/toolshell-explained/117045/

🔍 Google Online Security Blog: Introducing OSS Rebuild: Open Source, Rebuilt to Last cyber defense – Google's OSS Rebuild project aims to enhance trust in open source by automating the reproduction of package builds, helping prevent supply chain attacks without burdening maintainers. http://security.googleblog.com/2025/07/introducing-oss-rebuild-open-source.html

🔒 Hardcoded credentials found in HPE Aruba Instant On Wi vulnerability – HPE disclosed critical hardcoded credentials in Aruba Instant On Wi-Fi devices, allowing attackers to bypass authentication. Firmware updates are available to mitigate the vulnerabilities. https://securityaffairs.com/180230/security/hardcoded-credentials-hpe-aruba-instant-on-wi-fi-devices.html

⛓️ Another npm Supply Chain Attack: The 'is' Package Compromise cybercrime – The 'is' package was compromised after attackers phished an old maintainer's account, leading to malicious versions being published. Developers are urged to check dependencies and implement security measures. https://www.stepsecurity.io/blog/another-npm-supply-chain-attack-the-is-package-compromise

🏅 Detecting ADCS Privilege Escalation cyber defense – The blog discusses how to detect privilege escalation in Active Directory Certificate Services (ADCS) through auditing and alerts, emphasizing the need for proper logging to identify vulnerabilities. https://www.blackhillsinfosec.com/detecting-adcs-privilege-escalation/

⚠️ Critical Vulnerability in Popular npm form-data Package Used Across Millions of Installs vulnerability – A serious flaw in the npm form-data package could lead to data injection attacks. Many projects remain at risk due to outdated versions despite available patches. https://socket.dev/blog/critical-vulnerability-in-popular-npm-form-data-package

🚔 European authorities arrest alleged admin of notorious Russian crime forum XSS cybercrime – Authorities have arrested the alleged admin of XSS.is, a major Russian cybercrime forum, uncovering over $7 million in cybercrime proceeds through surveillance of their communications. https://techcrunch.com/2025/07/23/european-authorities-arrest-alleged-admin-of-notorious-russian-crime-forum-xss/

🛡️ Sophos fixed two critical Sophos Firewall vulnerabilities vulnerability – Sophos has patched five vulnerabilities in its Firewall, including two critical flaws that could enable remote code execution. Users with automatic updates enabled are protected without action needed. https://securityaffairs.com/180283/security/sophos-addressed-five-sophos-firewall-vulnerabilities.html

🃏 CrushFTP zero-day exploited in the wild warning – CrushFTP is facing active exploitation of a zero-day vulnerability (CVE-2025-54309) allowing unauthorized admin access. Users are urged to check for signs of compromise and update to patched versions. https://cert.europa.eu/publications/security-advisories/2025-028/

🤖 AI slop and fake reports are coming for your bug bounty programs security news – The rise of AI-generated low-quality bug reports, dubbed 'AI slop,' is overwhelming bug bounty platforms with false vulnerabilities, complicating the detection of genuine security issues. https://techcrunch.com/2025/07/24/ai-slop-and-fake-reports-are-exhausting-some-security-bug-bounties/

🔓 20281: Cisco ISE API Unauthenticated Remote Code Execution Vulnerability vulnerability – A vulnerability in Cisco ISE allows unauthenticated remote code execution via command injection, enabling attackers to gain root access. The flaw was patched under CVE-2025-20281 and CVE-2025-20337. https://www.thezdi.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability

🔗 Supply-chain attacks on open source software are getting out of hand cybercrime – Recent supply-chain attacks have compromised multiple npm packages, exposing user data and allowing attackers to execute malicious code. Developers are urged to monitor their dependencies and implement security measures. https://arstechnica.com/security/2025/07/open-source-repositories-are-seeing-a-rash-of-supply-chain-attacks/

---

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability, CVE-2025-53770 “ToolShell,” to Catalog warning – CISA has identified CVE-2025-53770, a Microsoft SharePoint vulnerability, as actively exploited, urging federal agencies to address it to mitigate significant risks. https://www.cisa.gov/news-events/alerts/2025/07/20/cisa-adds-one-known-exploited-vulnerability-cve-2025-53770-toolshell-catalog ⚠️ CISA Adds Four Known Exploited Vulnerabilities to Catalog warning – CISA has identified four new vulnerabilities in CrushFTP, Google Chromium and SysAid On-Prem to add to its KEV Catalog, emphasizing their active exploitation and risks to federal networks, urging prompt remediation by agencies. https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-four-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has included two new vulnerabilities regarding Microsoft SharePoint in its KEV Catalog, emphasizing their active exploitation and risks to federal networks, urging timely remediation by agencies. https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA has issued nine advisories detailing vulnerabilities and security issues related to various Industrial Control Systems, urging users to review for mitigations and technical details. https://www.cisa.gov/news-events/alerts/2025/07/22/cisa-releases-nine-industrial-control-systems-advisories ⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA has published six advisories detailing vulnerabilities and security issues in various Industrial Control Systems, urging users to review them for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/07/24/cisa-releases-six-industrial-control-systems-advisories

🛡️ #StopRansomware: Interlock security news – A joint advisory details the Interlock ransomware, which targets organizations via unique methods and employs a double extortion model. Recommendations for mitigation are provided to enhance cybersecurity. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

There’s a pattern I keep seeing, especially online where someone steps up to do something different, tries to shift the culture or challenge the norm, and instead of support, they get bombarded with demands. “Why don’t you do more?” “You should fix X too” As if trying to change anything means you’re now responsible for everything. As if one person is supposed to carry the entire system on their back. This reflects a deeper problem: people constantly externalize responsibility. They expect change to come from someone else—some leader, some influencer, some movement, some system. Rarely from themselves.

It’s the same mindset that keeps people trapped in cycles of dependency on authority—whether it's politicians, celebrities, or “visionaries.” They wait. They comment. They criticize. But they rarely start. The agent of change is expected to be prophetic, to know all, fix all, and be everything for everyone meanwhile the crowd stays seated, watching. This is why systems of power persist. Not because they’re strong, but because most people won’t act unless someone gives them permission. That’s why even with all the information and tools we have, so many still cling to illusions of saviors—presidents, parties, parliaments—as if those constructs ever had people’s true interests at heart. This isn’t a call to be apolitical. It’s a call to stop waiting for permission. Stop demanding prophecy. Start becoming the kind of person who acts, even without recognition, even when it’s imperfect. Especially when it's imperfect.

Criticism is easy. Creation is hard. Most people never cross that line. You want a better world? Start with yourself. Build with those around you. No one's coming to save you. There’s no prophecy. There’s just action.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🕵️‍♂️ willhaben & PayLivery: Wie Kriminelle einen eigentlich sicheren Service ausnutzen cybercrime – Fraudsters manipulate victims into leaving a secure platform for WhatsApp, disguising their communications to bypass security checks, aiming for money transfers under false pretenses. https://www.watchlist-internet.at/news/willhaben-paylivery-sicheres-service/

🚨 CitrixBleed 2 beckons sweeping alarm as exploits spread across the globe vulnerability – A critical vulnerability in Citrix NetScaler, CVE-2025-5777, is actively exploited worldwide, prompting urgent patching recommendations from CISA as attackers target sensitive data. Risks are particularly high for federal networks. https://cyberscoop.com/citrixbleed2-exploits-spread/

💔 Episource is notifying millions of people that their health data was stolen data breach – Episource has disclosed a cyberattack affecting over 5.4 million individuals, compromising personal and health data, including medical records and insurance information, attributed to ransomware. https://techcrunch.com/2025/07/14/episource-is-notifying-millions-of-people-that-their-health-data-was-stolen/

🚆 Hackers Can Remotely Trigger the Brakes on American Trains and the Problem Has Been Ignored for Years vulnerability – A critical vulnerability allows hackers to remotely lock train brakes, known since 2012 but only recently addressed by the railroad industry, posing serious safety risks. https://www.404media.co/hackers-can-remotely-trigger-the-brakes-on-american-trains-and-the-problem-has-been-ignored-for-years/

🎮 FBI Seizes NSW2U, PS4PKG Domains in $170 Million Game Piracy Investigation cybercrime – The FBI has seized major domains involved in video game piracy, impacting sites like nsw2u, which offered early access to pirated games. Estimated losses reach $170 million, highlighting serious legal repercussions for such activities. https://thecyberexpress.com/fbi-seizes-nsw2u-ps4pkg-domains/

🔍 Meta fixes bug that could leak users' AI prompts and generated content vulnerability – Meta has resolved a security flaw that allowed users to access others' AI prompts and responses, discovered by a researcher who received a $10,000 bounty. No evidence of exploitation was found. https://techcrunch.com/2025/07/15/meta-fixes-bug-that-could-leak-users-ai-prompts-and-generated-content/

🔒 6554 marks the fifth actively exploited Chrome Zero vulnerability – CVE-2025-6554 is the fifth actively exploited zero-day vulnerability in Chrome for 2025, concerning a type-confusion issue in the V8 engine. Google has issued patches and is aware of existing exploits. https://securityaffairs.com/180001/hacking/cve-2025-6554-marks-the-fifth-actively-exploited-chrome-zero-day-patched-by-google-in-2025.html

🛒 UK retail giant Co-op confirms hackers stole all 6.5 million customer records data breach – Co-op confirmed a cyberattack resulted in the theft of 6.5 million customer records, including personal details. The breach was part of a broader campaign affecting the UK retail sector. https://techcrunch.com/2025/07/16/uk-retail-giant-co-op-confirms-hackers-stole-all-6-5-million-customer-records/

👶 Adoption Agency Data Exposure Revealed Information About Children and Parents data breach – A recent data exposure incident at an adoption agency compromised sensitive information about children and their parents, highlighting ongoing privacy and security concerns within such organizations. https://www.wired.com/story/adoption-agency-data-exposure-revealed-information-about-children-and-parents/

💼 Meta investors, Zuckerberg settle $8 billion privacy lawsuit tied to Cambridge Analytica scandal privacy – Meta investors have settled a lawsuit alleging mishandling of the Cambridge Analytica scandal, with unclear terms, while seeking $8 billion in damages related to data privacy violations. https://therecord.media/meta-investors-zuckerberg-settle-privacy-lawsuit

🔓 Hackers are trying to steal passwords and sensitive data from users of Signal clone cybercrime – Hackers are exploiting a vulnerability in the TeleMessage app, a Signal clone used by officials, to steal usernames, passwords, and sensitive data. The flaw has been recognized by CISA as actively exploited. https://techcrunch.com/2025/07/17/hackers-are-trying-to-steal-passwords-and-sensitive-data-from-users-of-signal-clone/

🍞 Loaf and order: Belgian police launch bread-based cybersecurity campaign cyber defense – Belgian police are promoting cybersecurity awareness by printing tips on bakery bags, aiming to reach those less engaged with digital media and educate the public about online fraud and scams. https://grahamcluley.com/loaf-and-order-belgian-police-launch-bread-based-cybersecurity-campaign/

📹 Ring reintroduces video sharing with police security news – Ring has resumed allowing police to request user footage through a partnership with Axon, reversing its previous stance on video sharing. Users can choose to share footage, which will be encrypted. https://www.theverge.com/news/709836/ring-police-video-sharing-police-axon-partnership

🔑 Authorities released free decryptor for Phobos and 8base ransomware cybercrime – Japanese police have released a free decryptor for Phobos and 8Base ransomware, enabling victims to recover files without paying ransom. The tool is available on official sites and promotes safe recovery practices. https://securityaffairs.com/180108/malware/authorities-released-free-decryptor-for-phobos-and-8base-ransomware.html

🔒 For privacy and security, think twice before granting AI access to your personal data privacy – As AI tools increasingly request extensive access to personal data, users should be cautious. Granting such access can pose significant privacy and security risks, often for minimal benefit. https://techcrunch.com/2025/07/19/for-privacy-and-security-think-twice-before-granting-ai-access-to-your-personal-data/

---

Some More, For the Curious

🔓 Framework 13. Press here to pwn vulnerability – The Framework 13 laptop has a vulnerability allowing BIOS reset via a tamper switch, compromising critical security settings without vendor fixes available. Users should be cautious in unsecured environments. https://www.pentestpartners.com/security-blog/framework-13-press-here-to-pwn/

⌚️ WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch security research – The article discusses a project enhancing interoperability, privacy, and user autonomy for Apple Watch users with Android phones. https://arxiv.org/abs/2507.07210

🕵️‍♂️ Active Supply Chain Attack: npm Phishing Campaign Leads to Prettier Tooling Packages Compromise security research – A phishing campaign compromised npm packages, injecting malicious code. Developers are urged to check their installs and secure accounts against similar threats. https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise

🔧 Thread Support for Flipper Zero, Part 1: Introduction hacking write-up – This article introduces the integration of OpenThread with Flipper Zero, enhancing its smart home capabilities while discussing technical challenges and upcoming features in the series. https://cujo.com/blog/thread-support-for-flipper-zero-part-1-introduction/

🛠️ Severity Arbitrary File Write in Git CLI I Arctic Wolf vulnerability – A high-severity arbitrary file write vulnerability (CVE-2025-48384) in Git allows malicious repositories to execute code when cloned, posing risks mainly to macOS and Linux users. Immediate upgrades are recommended. https://arcticwolf.com/resources/blog/poc-available-for-high-severity-arbitrary-file-write-in-git-cli-cve-2025-48384/

🤖 Curl creator mulls nixing bug bounty awards to stop AI slop security news – Daniel Stenberg, founder of curl, considers ending the bug bounty program due to an influx of low-quality AI-generated bug reports, which now constitute 20% of submissions, overwhelming the small security team. https://www.theregister.com/2025/07/15/curl_creator_mulls_nixing_bug/

🐛 Hackers exploit a blind spot by hiding malware inside DNS records cybercrime – Hackers are embedding malware in DNS records, using hexadecimal encoding to evade detection, allowing malicious binaries to be fetched through overlooked DNS traffic. This technique poses significant security challenges. https://arstechnica.com/security/2025/07/hackers-exploit-a-blind-spot-by-hiding-malware-inside-dns-records/

🕵️‍♂️ Cato CTRL™ Threat Actor Profile: IntelBroker cybercrime – Kai Logan West, known as IntelBroker, led a major data brokerage operation causing over $25 million in damages before his arrest in 2025. His methods exploited basic security flaws, revealing vulnerabilities in cybercriminal OPSEC. https://www.catonetworks.com/blog/cato-ctrl-threat-actor-profile-intelbroker/

🔐 SonicWall customers hit by fresh, ongoing attacks targeting fully patched SMA 100 devices vulnerability – A financially motivated group, UNC6148, is exploiting fully patched SonicWall SMA 100 devices using stolen admin credentials for data theft and possible ransomware deployment, despite the vendor's support efforts. https://cyberscoop.com/sonicwall-sma100-attacks/

🚨 Operation Eastwood disrupted operations of pro cybercrime – Operation Eastwood, a coordinated effort by international law enforcement, disrupted the pro-Russian hacker group NoName057(16), taking down over 100 systems and issuing several arrest warrants amid ongoing DDoS attacks. https://securityaffairs.com/180027/cyber-crime/operation-eastwood-disrupted-operations-of-pro-russian-hacker-group-noname05716.html

💻 GitHub abused to distribute payloads on behalf of malware-as-a-service cybercrime – Cisco's Talos team uncovered a malware-as-a-service operation using GitHub accounts to distribute various malicious software, including the Emmenhtal loader and Amadey malware, exploiting GitHub's accessibility in enterprise networks. https://arstechnica.com/security/2025/07/malware-as-a-service-caught-using-github-to-distribute-its-payloads/

⚠️ Critical Vulnerabilities in Cisco ISE warning – Cisco has identified three critical vulnerabilities in its Identity Services Engine (ISE), allowing attackers to execute arbitrary code. Users are urged to update affected versions immediately. https://cert.europa.eu/publications/security-advisories/2025-025/

⚠️ Critical Vulnerabilities in VMWare Products warning – VMware has released a security advisory for three critical vulnerabilities allowing code execution on affected devices, urging immediate updates, especially for internet-facing virtual machines. https://cert.europa.eu/publications/security-advisories/2025-026/

📍 A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations security research – Researchers found a Middle Eastern surveillance vendor exploiting a new SS7 attack to track phone locations by bypassing carrier security measures, raising concerns about the increasing use of such exploits for location tracking. https://techcrunch.com/2025/07/18/a-surveillance-vendor-was-caught-exploiting-a-new-ss7-attack-to-track-peoples-phone-locations/

🚨 CVE-2025-54309: CrushFTP Zero-Day Vulnerability Exploited In The Wild vulnerability – A critical zero-day vulnerability in CrushFTP (CVE-2025-54309) allows attackers to gain administrator access and is currently being exploited. CrushFTP has released mitigation techniques and identified affected versions. https://www.tenable.com/blog/cve-2025-54309-crushftp-zero-day-vulnerability-exploited-in-the-wild

🔮 Fortinet FortiWeb flaw CVE-2025-25257 exploited hours after PoC release vulnerability – A critical SQL injection vulnerability in Fortinet FortiWeb (CVE-2025-25257) was exploited within hours of a proof-of-concept release, compromising multiple systems. Immediate patching is advised. https://securityaffairs.com/180118/hacking/fortinet-fortiweb-flaw-cve-2025-25257-exploited-hours-after-poc-release.html

---

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a known exploited vulnerability in Wing FTP Server to its catalog, urging federal agencies and all organizations to prioritize remediation to protect against cyber threats. https://www.cisa.gov/news-events/alerts/2025/07/14/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a known exploited vulnerability in Fortinet FortiWeb to its KEV Catalog, urging federal agencies and all organizations to prioritize remediation to protect against cyber threats. https://www.cisa.gov/news-events/alerts/2025/07/18/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA has published six advisories addressing vulnerabilities in various Industrial Control Systems, urging users and administrators to review the details and implement mitigations to enhance security. https://www.cisa.gov/news-events/alerts/2025/07/15/cisa-releases-six-industrial-control-systems-advisories ⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA has published three new advisories addressing vulnerabilities in various Industrial Control Systems, urging users and administrators to review the details and implement necessary mitigations. https://www.cisa.gov/news-events/alerts/2025/07/17/cisa-releases-three-industrial-control-systems-advisories

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

using ffmpeg

good for making drum kits for the m8 – you can do this in a directory with a lot of tiny samples.

1. prepare the directory

put all the samples you want to concatenate into the same directory and then navigate to that location in the terminal.

2. add silence

this will create copies of the files which have a tiny amount of silence appended to them. this helps with the m8s auto-slice function (though you'll still usually want to tweak the results). This command will do it:

for i in *.wav; do ffmpeg -i "$i" -af "adelay=100|100" "${i%.*}-EDIT.wav"; done

3. remove the original files.

the newly created files will have “-EDIT” added to their names just before the .wav file extension. only keep those ones in the directory. (you can just move the other ones out of the folder, or delete them if you made copies to begin with).

4. generate input text file

from the files which are now in the folder

for f in *.wav; do echo "file '$f'" >> mylist.txt; done

• bonus: you can change the order of the sounds by editing this text file before executing the next step.

5. concatenate all the wav files

ffmpeg -f concat -safe 0 -i mylist.txt -c copy concat.wav

6. rename the resultant “concat.wav” file

... to whatever describes the collection you've created. (I like to prefix these files with “cct” ie. “cct-Yamaha-MR10.wav”)

7. load it up

fine tune the slices, & fuck around with it.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🍔 Would you like an IDOR with that? Leaking 64 million McDonald’s job applications security research – A security flaw in McDonald’s recruitment bot exposed personal data of 64 million applicants due to weak default credentials and an insecure API. Prompt remediation followed disclosure. https://ian.sh/mcdonalds

🕷️ Scattered Spider weaves web of social-engineered destruction cybercrime – Scattered Spider, a decentralized cybercrime group, exploits social engineering and phishing to target multiple industries, amassing over $66 million in extortion demands through clever tactics. https://cyberscoop.com/scattered-spider-social-engineering-cybercrime/

🤖 Unless users take action, Android will let Gemini access third-party apps privacy – Google's Gemini AI will soon access third-party apps like WhatsApp, overriding user settings. Users seeking to prevent this may struggle to find clear guidance on disabling or removing Gemini. https://arstechnica.com/security/2025/07/unless-users-take-action-android-will-let-gemini-access-third-party-apps/

💰 „Hallo Mama, das ist meine neue Nummer“ – Ein Blick hinter die Kulissen des Evergreens cybercrime – Scammers exploit emotional manipulation, posing as family members in need of urgent money transfers, often targeting parents to redirect funds into their own accounts. https://www.watchlist-internet.at/news/hallo-mama-hinter-den-kulissen/

🎨 Browser hijacking campaign infects 2.3M Chrome, Edge users security news – A malicious Chrome and Edge extension disguised as a color picker has hijacked over 2.3 million users' browsers, tracking activities and capturing sensitive data through silent updates. https://www.theregister.com/2025/07/08/browser_hijacking_campaign/

⛑️ Microsoft Patch Tuesday July 2025: 130 Vulnerabilities Fixed, 17 High-Risk vulnerability – Microsoft's July Patch Tuesday fixed 130 vulnerabilities, including 17 high-risk ones, with a critical remote code execution flaw rated 9.8 affecting Windows 10 and above. https://thecyberexpress.com/microsoft-patch-tuesday-july-2025/

🏃 Yet Another Strava Privacy Leak data breach – Based on a new Strava Leak, Bruce Schneier points towards privacy, the impact of technology on society, and the need for informed public engagement in security matters. https://www.schneier.com/blog/archives/2025/07/yet-another-strava-privacy-leak.html

🎮 Activision pulls Call of Duty game after PC players are hacked security news – Activision has removed an outdated and insecure version of Call of Duty from the Microsoft Store after reports of hacking incidents affecting PC players. https://www.theverge.com/news/702255/call-of-duty-wwii-pc-game-pass-hacking-activision

🔒 AiLock ransomware: What you need to know cybercrime – AiLock is a ransomware-as-a-service that threatens victims with data leaks and regulatory notifications if ransoms aren't paid. Organizations are advised to enhance security measures to mitigate risks. https://www.fortra.com/blog/ailock-ransomware

💸 Fake CNN and BBC sites used to push investment scams security news – Cybercriminals are creating fake news websites mimicking CNN and BBC to promote fraudulent cryptocurrency investments, tricking users into sharing personal data and making deposits. https://therecord.media/news-websites-faked-to-spread-investment-scams

⚖️ German court rules Meta tracking technology violates European privacy laws privacy – A German court ruled that Meta must pay €5,000 to a user for violating GDPR by tracking data via pixels on third-party sites, potentially opening the door for extensive lawsuits. https://therecord.media/german-court-meta-tracking-tech

📱 Using Signal groups for activism privacy – Signal offers secure communication for activists, allowing safe organization through group features like QR code invites, admin approval, and announcement-only settings, ensuring privacy from law enforcement. https://micahflee.com/using-signal-groups-for-activism/

🚨 FinanzOnline – „Dringende Sicherheitswarnung wegen Anmeldeversuchs“ ist Phishing warning – Criminals are sending phishing emails claiming unauthorized login attempts to FinanzOnline accounts, attempting to steal user information under the guise of security alerts about 'unknown devices.' https://www.watchlist-internet.at/news/finanzonline-sicherheitswarnung-phishing/

👮 UK NCA arrested four people over M&S, Co-op cyberattacks cybercrime – The UK NCA arrested four individuals, including three teens, linked to cyberattacks on M&S and Co-op, which caused significant financial losses estimated between £270M and £440M. https://securityaffairs.com/179806/cyber-crime/uk-nca-arrested-four-people-over-ms-co-op-cyberattacks.html

🏀 Pro basketball player and 4 youths arrested in connection to ransomware crimes cybercrime – Authorities arrested former basketball player Daniil Kasatkin and four others linked to ransomware attacks, including operations targeting M&S and Co-op, attributed to the Scattered Spider group. https://arstechnica.com/security/2025/07/pro-basketball-player-and-4-youths-arrested-in-connection-to-ransomware-crimes/

🚗 Researchers identify critical vulnerabilities in automotive Bluetooth systems vulnerability – Researchers discovered four critical vulnerabilities in the OpenSynergy BlueSDK Bluetooth stack, affecting vehicles from Mercedes-Benz, Volkswagen, and Skoda, potentially allowing remote code execution via Bluetooth connections. https://cyberscoop.com/perfektblue-bluetooth-vulnerabilties-bluesdk-software/

💰 Hacker returns cryptocurrency stolen from GMX exchange after $5 million bounty payment cybercrime – A hacker returned $42 million stolen from GMX exchange after receiving a $5 million bounty, with the company agreeing not to pursue legal action if the funds were returned. https://therecord.media/hacker-returns-stolen-gmx-bounty

🤖 AI therapy bots fuel delusions and give dangerous advice, Stanford study finds security research – A Stanford study reveals critical flaws in AI therapy bots like ChatGPT, highlighting their tendency to validate harmful beliefs and provide dangerous advice, particularly for users with mental health issues. https://arstechnica.com/ai/2025/07/ai-therapy-bots-fuel-delusions-and-give-dangerous-advice-stanford-study-finds/

---

Some More, For the Curious

🔍 Hiding Prompt Injections in Academic Papers security research https://www.schneier.com/blog/archives/2025/07/hiding-prompt-injections-in-academic-papers.html

💡 Researchers Jailbreak AI by Flooding It With Bullshit Jargon security research – A study reveals that AI chatbots can be manipulated into providing harmful information by using complex jargon and fake citations, a technique dubbed 'InfoFlood.' https://www.404media.co/researchers-jailbreak-ai-by-flooding-it-with-bullshit-jargon/

🛡️ Google Online Security Blog: Advancing Protection in Chrome on Android cyber defense – Chrome's Advanced Protection enhances security on Android by isolating websites and disabling JavaScript optimizers to reduce vulnerabilities, catering to users with varying risk profiles. http://security.googleblog.com/2025/07/advancing-protection-in-chrome-on.html

🦠 Hackers weaponize Shellter red teaming tool to spread infostealers malware – Hackers exploit the leaked Shellter tool to package infostealer malware, evading detection and targeting users via phishing campaigns. Elastic Security Labs has developed a dynamic unpacker to counter this threat. https://securityaffairs.com/179745/malware/hackers-weaponize-shellter-red-teaming-tool-to-spread-infostealers.html

🚨 Critical CitrixBleed 2 vulnerability has been under active exploit for weeks vulnerability – A critical Citrix vulnerability allowing MFA bypass has been actively exploited for weeks, despite Citrix's claims of no evidence. Researchers criticize the lack of details in advisories, complicating defense efforts. https://arstechnica.com/security/2025/07/critical-citrixbleed-2-vulnerability-has-been-under-active-exploit-for-weeks/

🔍 Uncovering Privilege Escalation Bugs in Lenovo Vantage — Atredis Partners vulnerability – Atredis Partners discovered multiple privilege escalation vulnerabilities in Lenovo Vantage, allowing attackers to exploit SQL injection and manifest manipulation for elevated access. Lenovo released patches on July 8. https://www.atredis.com/blog/2025/7/7/uncovering-privilege-escalation-bugs-in-lenovo-vantage

⚠️ Azure's Front Door WAF WTF: IP Restriction Bypass vulnerability – A critical flaw in Azure's Front Door WAF allows IP restriction bypass using the X-Forwarded-For header, undermining security expectations and highlighting poor documentation and variable naming practices. https://trustedsec.com/blog/azures-front-door-waf-wtf-ip-restriction-bypass

🐛 CVE-2025-48384: Git vulnerable to arbitrary file write on non-Windows systems vulnerability – CVE-2025-48384 allows arbitrary file writes and remote code execution on Linux and macOS when using git clone —recursive on malicious repositories. A patch was released on July 8, 2025. https://securitylabs.datadoghq.com/articles/git-arbitrary-file-write/

🍳 Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5 hacking write-up – Research reveals critical vulnerabilities in the Thermomix TM5, allowing firmware downgrades and arbitrary code execution through weaknesses in nonce tampering, known AES keys, and incomplete secure boot mechanisms. https://www.synacktiv.com/en/publications/let-me-cook-you-a-vulnerability-exploiting-the-thermomix-tm5.html

⚠️ Critical Vulnerability in FortiWeb warning – Fortinet has released a security advisory for a critical vulnerability (CVE-2025-25257) in FortiWeb, allowing unauthorized code execution via crafted HTTP requests. Affected versions require immediate updates. https://cert.europa.eu/publications/security-advisories/2025-024/

🚨 10/10 Wing FTP bug exploited within hours, cyber pros say security news – A critical remote code execution vulnerability in Wing FTP Server was exploited within hours of public disclosure, allowing attackers to execute Lua code. Users are urged to patch immediately. https://www.theregister.com/2025/07/11/1010_wing_ftp_bug_exploited/

📄 Export to PDF allows local file inclusion/path traversal in Microsoft 365 security research – A vulnerability in Microsoft 365's PDF conversion feature allowed local file inclusion via HTML files, enabling access to sensitive server data. The issue has been reported and remediated, earning a $3000 bounty. https://security.humanativaspa.it/export-to-pdf-allows-local-file-inclusion-path-traversal-in-microsoft-365/

---

CISA Corner

⚠️ CISA Adds Four Known Exploited Vulnerabilities to Catalog warning – CISA has identified four new vulnerabilities that are actively exploited, emphasizing the need for federal agencies to remediate these risks to enhance cybersecurity. https://www.cisa.gov/news-events/alerts/2025/07/07/cisa-adds-four-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, urging all organizations to prioritize remediation to protect against cyber threats. https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases One Industrial Control Systems Advisory vulnerability – CISA issued an advisory regarding vulnerabilities in Emerson ValveLink products, urging users to review the advisory for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/07/08/cisa-releases-one-industrial-control-systems-advisory ⚙️ CISA Releases Thirteen Industrial Control Systems Advisories vulnerability – CISA has released thirteen advisories regarding vulnerabilities in various Industrial Control Systems by Siemens, Delta Electronics, Advantech, KUNBUS, End/Head-of-Train, ECOVACS and IDEC, urging users to review for technical details and necessary mitigations. https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-releases-thirteen-industrial-control-systems-advisories

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

I stumbled upon this post on r/fibromyalgia, titled “How long did it take you to accept it?”. As I'm writing this, I'm still processing both the post and the comments; at the same time, feeling relieved that it's a lot more common to struggle to accept this fucking syndrome.

Knowing I'm not one of the few who struggle with accepting this and all the limitations it imposes is like taking weight off my chest. And to be honest, I don't think I'll ever fully accept this. Why would I? To me, that's like giving up, conceding defeat. Yes, I still cling to the hope that either a cure will be found or a medication will be developed that actually stops the pain. Or that the pain might one day stop by itself, just like it started.

Accepting it would mean I've given up on hope.

Of course, this doesn't mean I haven't adapted. I've developed strategies to deal with the pain level I'm feeling as I perform whatever task I'm doing and how it changes as I execute it.

A good example of this is cooking. Even if I'm just cooking a simple stew, there are days that I have to start cooking it 4 to 6 hours before the usual time and do it in small steps, with long periods of rest in between, because standing up for 10 minutes feels like torture. Think: “Getting the pan out and the ingredients. Rest. Chop some ingredients. Rest. Chop more ingredients. Rest.”

This may not make sense to you. That's OK. It probably wouldn't make sense to me either if I didn't live with nonstop pain.

#Fibromyalgia #ChronicPain

“Когато държавата се превърне в отечество, тя се готви да убива.”

---

Куче се отглежда, за да те “лае” по пътя ти в отвъдния свят. ~prof.

---

Being an anarchist is often misunderstood. Many people think it's about breaking all rules and creating chaos. Additionally in my country, even mainstream media are mistakenly saying vandalism is equal to anarchism. This make me shake my head as they don't understand what anarchism really is. I've been practically doing anarchism value in my immediate social circles. I contribute to education, I reject about structural group in college especially for making decisions and I educate people about abstaining from political participation because no politicians can truly be trusted. I often share my thoughts on social issues from an anarchist point of view. Like most anarchists, I believe in building a society aligned with anarchist values. But still, I don't want anarchism to be applied in our society yet, in any state. Why?

Too Extreme for People to Accept

Anarchism is seen as “too far left” ideology, unlike socialism or communism, we reject hierarchical rulers. Everyone should be treated equally and all opinions should matter (as long as they're logically sound). But most countries today are run by conservatives who uphold capitalism, which is the complete opposite anarchism. These governments are elected by the conservative citizens, so the system and the people share the same ideology. Which makes it harder to spread anarchist values. By definition, conservatism is a commitment to traditional values and ideas with opposition to change or innovation. Capitalism has been dominant for over a century. That's why people fear radical change. Which leads to the next point.

Historical Failures of Leftist Ideas

The Soviet Union was once the biggest leftist state in the world and it collapsed. Many people now see that as proof that leftist ideologies don’t work. They say systems like socialism or anarchism are too utopian to survive in the real world. Because of that fear, anarchism is seen as unrealistic, even dangerous.

Anarchism Is Misunderstood

This ties into ignorance and media literacy. Many people think anarchism means “no rules” e.g. total chaos, violence, people killing each other. That’s NOT what anarchism is. As I mentioned earlier, the media here even label May Day protests as “anarchic” just because of vandalism or people spray-painting walls. That’s not anarchism, that’s just destruction. These false narratives shape public misunderstanding.

Bad People Still Exist

This is the main reason I don't think anarchism can work right now. There are still people who will take advantage of others if laws don’t exist. Legal systems, even if flawed, can still restrain some bad behavior. But in a world without written laws? Those people would feel free to exploit, harm, or abuse others. It’s like saying morals come from religion. If religion disappears, would some people suddenly start robbing, raping, or killing? That’s the scary part.

People today still need to learn how to be decent human beings and open themselves to new perspectives. Only then can we start introducing anarchist values in a real, meaningful way.

via Jürgen Hubert – @juergen_hubert@mementomori.social

Not far from the village of Retzin, which lies about one and a half miles away from Penkun, there is a long, tall hill and beneath it lies a lake commonly known as the Leichensee (“corpse lake”). On the hill, which is now overgrown with shrubs, there used to be a bandits' castle, whose remains can be spotted now and then amidst the shrubbery. The whole hill is therefore still called the Burgwall (“castle wall”)[1]. The bandits who lived in the castle threw the corpses of those they slew into the lake, from which the lake derives its name. The murdered and the murderers are said to haunt the lake and its environs in some nights, and nobody likes to visit the area after dark. Another tale gives us more details: The Leichensee is in the middle of two spots where two castles used to stand, and where now the villages of Lökenitz and Ramin can be found. These two castles belonged to a villainous robber knight named Hans von Ramin. The river Randow, which flows through the lake, was traversable by ships in those days[2] and thus it was common for ships to pass through the lake. The knight with his bandits only waited for those moments, and he had constructed an ingenious contraption which aided him in capturing those ships. He had put down two chains across the lake which were about 50 feet apart, and which were about two inches above the water when they were stretched taut. Whenever he saw a ship approaching in the distance he and his bandits hid in the reeds at the shore of the lake and left the first chain slacken so that it would be below the surface of the water. But when the ship had passed over it, he pulled it taut again. And thus the ship was stuck between the two chains and could go neither backwards nor forwards, and he and his bandits swarmed over it, slaughtered the crew, and took all of its goods. The corpses were thrown into the lake, on the side of the long hill[3]. It frequently occurred that the bandits discovered a larger crew on the ship than they had anticipated. In these cases they rang a large bell, which they had hung up at the shore for this very purpose. Then reinforcements would arrive from both castles. This bell fell into the lake after the death of the knight. It remains there, and at noon on St. John's Day it is still possible to hear its ringing. Source: Temme, J. D. H. Die Volkssagen von Pommern und Rügen, 1840. P. 202-204.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🤖 ICE Rolls Facial Recognition Tools Out to Officers' Phones privacy – ICE introduces Mobile Fortify, a facial recognition app for agents, raising concerns about privacy and wrongful arrests due to potential inaccuracies and surveillance risks. https://www.wired.com/story/ice-rolls-facial-recognition-tools-out-to-officers-phones/

🚨 BreachForums broken up? French police arrest five members of notorious cybercrime site cybercrime – French police arrest five alleged members of BreachForums, a major cybercrime marketplace, including one sought by the US for selling hacked data worth millions, amid ongoing investigations. https://www.bitdefender.com/en-us/blog/hotforsecurity/breachforums-broken-up-french-police-arrest-five-members-of-notorious-cybercrime-site

🏎️ How we turned a real car into a Mario Kart controller by intercepting CAN data security research – A team converted a Renault Clio into a Mario Kart controller by intercepting its CAN data, enabling real driving controls for a game demo, despite some technical challenges. https://www.pentestpartners.com/security-blog/how-we-turned-a-real-car-into-a-mario-kart-controller-by-intercepting-can-data/

💰 SafePay Ransomware: What You Need To Know security news – SafePay ransomware encrypts files and steals data, demanding cryptocurrency ransoms. Unlike typical ransomware, it doesn't operate as RaaS, focusing on operational security. It's linked to previous notorious groups and has specific language restrictions to avoid certain victims. https://www.fortra.com/blog/safepay-ransomware-what-you-need-know

⚠️ Security pro counts the cost of Microsoft dependency security news – A blog post highlights the risks of heavy reliance on Microsoft, advocating for improved digital sovereignty and quantifying potential security costs to influence decision-makers away from sole dependency on American cloud services. https://www.theregister.com/2025/06/26/cost_of_microsoft_dependency/

🔒 Complaint says Bumble feature connected to OpenAI violates European data privacy rules privacy – A complaint alleges Bumble's Icebreakers feature, powered by OpenAI, breaches GDPR by lacking user consent and transparency regarding data transfers, prompting concerns over privacy and control. https://therecord.media/bumble-for-friends-openai-noyb-complaint-gdpr

🎧 Security Advisory: Airoha-based Bluetooth Headphones and Earbuds vulnerability – Vulnerabilities in Airoha-based Bluetooth devices allow unauthenticated attackers to manipulate and take over devices within Bluetooth range. Users are advised to await firmware patches for remediation. https://insinuator.net/2025/06/airoha-bluetooth-security-vulnerabilities/

⚰️ Qilin ransomware attack on NHS results in confirmed death cybercrime – The NHS confirmed that a ransomware attack by Qilin on Synnovis led to a patient's death due to delays in receiving blood test results, highlighting the serious impact of cyberattacks on healthcare. https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/

🖨️ New Vulnerabilities Expose Millions of Brother Printers to Hacking vulnerability – Hundreds of Brother printers and others have serious vulnerabilities allowing hackers to exploit devices without authentication. A critical flaw can expose admin passwords, risking device misuse. https://www.securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking/

💍 Ring can use AI to 'learn the routines of your residence' privacy – Ring's new Video Descriptions feature uses AI to analyze motion activity, providing detailed notifications about detected events. Concerns arise over privacy and security given Ring's history and data handling practices. https://www.theregister.com/2025/06/25/amazons_ring_ai_video_description/

🔓 Russia frees REvil hackers after sentencing security news – Four members of the REvil ransomware group were released from custody after serving time while awaiting trial, despite pleading guilty to fraud and malware charges, with no fines imposed. https://www.theverge.com/news/692582/russia-revil-hacker-group-ransomware-sentencing

🏙️ Glasgow City Council impacted by ‘cyber incident’ data breach – Glasgow City Council is dealing with a cyber incident disrupting online services and potentially involving customer data theft, with affected servers taken offline and residents advised to be cautious. https://therecord.media/glasgow-city-council-cyber-incident

🕯️ What LLMs Know About Their Users privacy – The article discusses a prompt for analyzing user interaction data in detail, highlighting preferences, past conversation topics, and insights into user behavior, raising questions about the capability of AI to build human-readable profiles. https://www.schneier.com/blog/archives/2025/06/what-llms-know-about-their-users.html

☠️ Hackers Are Poisoning Google Search Results for AI Tools to Deliver Infostealer Malware cybercrime – Threat actors are hijacking Google search results for AI tools to distribute malware via trojanized sites, using black hat SEO tactics to redirect users to infected downloads, notably Vidar and Lumma infostealers. https://thecyberexpress.com/poisoning-google-search-results-infostealers/

🔓 Leak of data belonging to 7.4 million Paraguayans traced back to infostealers data breach – Hackers accessed data on 7.4 million Paraguayans via infostealer malware on a government employee's device, leading to massive data leaks from multiple agencies. Paraguay's government plans a National Cybersecurity Strategy in response. https://therecord.media/data-leak-paraguayan-millions-infostealer

👓 Smartglass Ray-Ban Meta: Dauerüberwachung im Sonnenbrillengehäuse privacy – Meta's Ray-Ban Smartglasses, equipped with always-on recording capabilities and AI features, raise significant privacy concerns as they continuously collect data without clear opt-out options for bystanders. https://www.kuketz-blog.de/smartglass-ray-ban-meta-dauerueberwachung-im-sonnenbrillengehaeuse/

---

Some More, For the Curious

🛡️ RedirectionGuard: Mitigating unsafe junction traversal in Windows security news – Microsoft introduces RedirectionGuard in Windows 11 to prevent filesystem redirection attacks, closing a critical security gap and enhancing system integrity against privilege escalation. https://msrc.microsoft.com/blog/2025/06/redirectionguard-mitigating-unsafe-junction-traversal-in-windows/

📜 NIS2 Technical Implementation Guidance security news – ENISA provides practical guidance for implementing the NIS2 Directive, detailing cybersecurity requirements for various entities and offering examples and mappings for compliance. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance

🔓 When Backups Open Backdoors: Accessing Sensitive Cloud Data via “Synology Active Backup for Microsoft 365” vulnerability – A leaked credential in Synology's backup tool allowed unauthorized access to sensitive Microsoft 365 data, raising serious security concerns and highlighting vulnerabilities in cloud services. https://modzero.com/en/blog/when-backups-open-backdoors-synology-active-backup-m365/

✈️ FBI, cybersecurity firms say a prolific hacking crew is now targeting airlines and the transportation sector security news – The FBI warns that the hacking group Scattered Spider is now targeting airlines and transportation, employing social engineering and ransomware tactics to compromise sensitive data. https://techcrunch.com/2025/06/28/fbi-cybersecurity-firms-say-scattered-spider-hackers-now-targeting-airlines-transportation-sector/

💻 Microsoft security updates address CrowdStrike crash, kill ‘Blue Screen of Death’ security news – Microsoft announces security updates to prevent future outages caused by third-party software, limiting direct kernel access and enhancing recovery features, including a revamped crash interface. https://cyberscoop.com/microsoft-security-updates-kernel-restrictions-downtime/

🥸 The Age of Integrity security research – Data integrity is crucial in the era of AI and Web 3.0, requiring systems to ensure accurate data throughout its lifecycle. We need to focus on integrous design to address integrity challenges. https://www.schneier.com/blog/archives/2025/06/the-age-of-integrity.html

⚠️ CVE-2024-39914 – Unauthenticated Command Injection in FOG Project’s export.php vulnerability – CVE-2024-39914 is a critical unauthenticated command injection vulnerability in FOG Project versions ≤ 1.5.10.34, allowing attackers to execute system commands or deploy webshells via export.php. https://www.offsec.com/blog/cve-2024-39914/

🔐 Cisco fixes two critical make-me-root bugs vulnerability – Cisco patched two critical vulnerabilities, CVE-2025-20281 and CVE-2025-20282, in its Identity Services Engine, allowing unauthenticated attackers to execute code with root privileges via API flaws. https://www.theregister.com/2025/06/26/patch_up_cisco_fixes_two/

🔑 Common SCCM Misconfigurations Leading to Privilege Escalation cyber defense – Misconfigurations in SCCM can lead to privilege escalation, allowing attackers to exploit Network Access Accounts and Domain Join Accounts to compromise domains. Recommendations include enforcing least privilege and avoiding legacy settings. https://www.truesec.com/hub/blog/sccm-tier-killer

🚨 Sipping from the CVE Firehose: How We Prioritize… cyber defense – The article discusses how security teams prioritize CVEs using a tiered scoring system to identify real-world threats, moving beyond traditional CVSS metrics to focus on attributes that reflect actual impact on customer attack surfaces. https://bishopfox.com/blog/sipping-cve-firehose-how-we-prioritize-emerging-threats-for-real-world-impact

🔒 Hackers deploy fake SonicWall VPN App to steal corporate credentials security research – Hackers are distributing a trojanized SonicWall NetExtender VPN app, dubbed SilentRoute, to steal user credentials by modifying the installer to bypass security checks. Users are advised to download only from official sources. https://securityaffairs.com/179332/hacking/hackers-deploy-fake-sonicwall-vpn-app-to-steal-corporate-credentials.html

📈 Surge in MOVEit Transfer Scanning Activity Could Signal Emerging Threat Activity warning – GreyNoise reports a significant increase in scanning activity targeting MOVEit Transfer systems, with over 300 unique IPs observed daily since May 27, 2025, indicating potential emerging threats and exploitation attempts. https://www.greynoise.io/blog/surge-moveit-transfer-scanning-activity

🦠 New Malware Embeds Prompt Injection to Evade AI Detection malware – A malware sample named Skynet attempts to use prompt injection to manipulate AI models for evasion, but the method fails against current LLMs. The article discusses its features and implications for future threats. https://research.checkpoint.com/2025/ai-evasion-prompt-injection/

🌐 Stealth China-linked ORB network gaining footholds in US, East Asia security research – A China-linked ORB network, dubbed 'LapDogs', has surpassed 1,000 devices, primarily in the US and East Asia, focusing on stealthy operations that complicate detection and attribution for espionage activities. https://cyberscoop.com/orb-network-china-lapdogs/

🔒 Up next on the KEV? All signs point to 'CitrixBleed 2' vulnerability – Citrix's new critical vulnerability, dubbed 'CitrixBleed 2', affects its NetScaler products, allowing attackers to read sensitive information without authentication. Experts warn of inevitable exploitation and urge immediate patching. https://go.theregister.com/feed/www.theregister.com/2025/06/24/critical_citrix_bug_citrixbleed/

🤔 The ‘16 billion password breach’ story is a farce security news – Recent reports of a 16 billion credential breach lack substantial evidence and are criticized by experts as recycled data from past leaks. The incident highlights the ongoing threat of infostealer malware and the need for better cybersecurity practices. https://cyberscoop.com/colossal-data-breach-16-billion-credentials-no-evidence-media-exaggeration/

💰 The State of Ransomware 2025 security research – The Sophos report reveals that exploited vulnerabilities and compromised credentials are major causes of ransomware attacks. While recovery rates are improving, ransom payments remain high, highlighting ongoing risks for organizations. https://news.sophos.com/en-us/2025/06/24/the-state-of-ransomware-2025/

---

CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog, including CVE-2024-54085, CVE-2024-0769, and CVE-2019-6693, highlighting significant risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/06/25/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA issued two advisories on June 26, 2025, addressing vulnerabilities in Mitsubishi Electric Air Conditioning Systems and TrendMakers Sight Bulb Pro, urging users to review for mitigation details. https://www.cisa.gov/news-events/alerts/2025/06/26/cisa-releases-two-industrial-control-systems-advisories ⚙️ CISA Releases Eight Industrial Control Systems Advisories vulnerability – CISA issued eight ICS advisories on June 24, 2025, addressing vulnerabilities in various systems including Schneider Electric and Mitsubishi Electric, urging users to review for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/06/24/cisa-releases-eight-industrial-control-systems-advisories

🔒 New Guidance Released for Reducing Memory-Related Vulnerabilities security news – CISA and NSA released a guide to reduce memory-related vulnerabilities in software, advocating for the adoption of memory safe languages (MSLs) to enhance security in development practices. https://www.cisa.gov/news-events/alerts/2025/06/24/new-guidance-released-reducing-memory-related-vulnerabilities

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

“Комуникацията е жизненоважният мост между човешките съзнания – нейното отсъствие ражда бездни от недоразумения, в които се погубват мисли, чувства и намерения. Колко му е хората да започнат да си споделят повече притесненията и емоциите? “

Да споделиш е да се отвориш, да се отключиш, да се отдадеш. Всяко малко отдаване причинява страх, който все по-дълбоко копае навътре в черупката на комфорта и спокойствието. От друга страна, липсата на емоционална връзка със света те прави уязвим и склонен към крайности.

Ето какво казва Ursula K. Le Guin в The wave in the Mind за комуникацията:

“Кутия А и кутия В са свързани с тръба. Кутия А съдържа единица информация. Кутия А е предавателят, изпращачът. Тръбата е начинът, по който се предава информацията – тя е средата. А кутия В е приемникът. Те могат да редуват ролите си. Изпращачът, кутия А, кодира информацията по начин, подходящ за средата – в двоични битове, или пиксели, или думи, или каквото и да е, и я предава чрез средата на приемника, кутия В, който я получава и декодира.

А и В могат да се разглеждат като машини, например компютри. Те могат да се разглеждат и като умове. Или едната може да е машина, а другата – ум.

В повечето случаи на хора, които действително разговарят помежду си, човешката комуникация не може да бъде сведена до информация. Съобщението не само включва, то е връзка между говорещия и слушащия. Средата, в която е вградено съобщението, е изключително сложна, безкрайно повече от код: тя е език, функция на общество, култура, в която езикът, говорещият и слушащият са вградени.

В човешкия разговор, в живата, действителна комуникация между или сред човешки същества, всичко „предадено“ – всичко казано – е оформено по време на говорене от действителен или очакван отговор.

Живата човешка комуникация лице в лице е интерсубективна. Интерсубективността включва много повече от машинно-медиирания тип стимул-реакция, наричан в момента „интерактивен“. Изобщо не е стимул-реакция, нито механично редуване на предварително кодирано изпращане и получаване. Интерсубективността е взаимна. Тя е непрекъснат обмен между две съзнания. Вместо редуване на роли между кутия А и кутия В, между активен субект и пасивен обект, това е непрекъсната интерсубективност, която тече двупосочно през цялото време.

Моят личен модел за интерсубективност, или комуникация чрез реч, или разговор, е амеби, които се репродуцират. Както знаете, амебите обикновено се размножават, като просто тихо се оттеглят в ъгъла и се разделят на две амеби; но понякога условията показват, че малко генетичен обмен може да подобри местната популация и две от тях се събират, буквално, и се протягат една към друга и сливат псевдоподите си в малка тръбичка или канал, който ги свързва.

След това амеба А и амеба В обменят генетична „информация“, тоест буквално си дават вътрешни части от телата си, чрез канал или мост, който е направен от външни части на телата им. Те прекарват доста време, изпращайки части от себе си напред-назад, взаимно отговаряйки си.

Това е много подобно на това как хората се съединяват и си дават части от себе си – вътрешни части, умствени, а не телесни части – когато говорят и слушат.

Две амеби, които се съединяват по този начин, или двама души, които говорят, образуват общност от двама. Хората също могат да образуват общности от много, чрез постоянно изпращане и получаване на части от себе си и другите – тоест чрез говорене и слушане. Говоренето и слушането в крайна сметка са едно и също нещо.

Речта ни свързва толкова непосредствено и жизненоважно, защото тя е физически, телесен процес. Ако монтирате два стенни часовникови махала едно до друго на стената, те постепенно ще започнат да се люлеят заедно. Те се синхронизират взаимно, като улавят малки вибрации, които всеки предава през стената.

Всякакви две неща, които осцилират с приблизително един и същ интервал, ако са физически близо едно до друго, постепенно ще имат тенденцията да се „заключат“ и да пулсират точно с един и същ интервал. Нещата са лениви. Изисква по-малко енергия да пулсират съвместно, отколкото да пулсират в опозиция. Физиците наричат тази красива, икономична леност взаимно фазово синхронизиране, или „увличане“.

Всички живи същества са осцилатори. Ние вибрираме. Амеба или човек, ние пулсираме, движим се ритмично, променяме се ритмично; ние поддържаме ритъм. Можете да го видите в амебата под микроскоп, вибрираща в честоти на атомно, молекулярно, субклетъчно и клетъчно ниво. Това постоянно, деликатно, сложно туптене е самият процес на живота, направен видим.

Ние, огромните многоклетъчни същества, трябва да координираме милиони различни осцилационни честоти и взаимодействия между честотите в телата ни и нашата среда. Повечето от координацията се осъществява чрез синхронизиране на импулсите, чрез привеждане на ударите в главен ритъм, чрез „увличане“.

Подобно на двете махала, макар и чрез по-сложни процеси, двама души заедно могат взаимно да се фазово синхронизират. Успешните човешки взаимоотношения включват увличане – влизане в синхрон. Ако това не се случи, връзката е или некомфортна, или катастрофална. “

---

Катастрофата се получава, когато страна А или B не е предразположена към такъв обмен и се опитва да се отскубне от връзката с тръбата, ако въобще е била поставена. Това се случва (може би) по-лесно в XXI век, тъй като масовата култура подкрепя затвореността, нишовостта, разделението.

Divide et impera!

И все пак, не можем да спрем да се опитваме да говорим с хора, а особено трябва да вземем присърце и опитите (често синоним на провалите) да комуникираме и с по-затворените хора, които често имат толкова много да кажат.

---

As a profession, cyber/information security has been telling itself that it is “risk-based”, but often fails to live up to that in practice. We see this from hyping threats because they're cool and make for a good conference talk, to having to make a market for a new Gartner product category.

We therefore often mistake the possible for the probable, and the PoC for a Production threat we have to invest to fix. Nowhere is this more extreme than in post quantum cryptography (PQC) and the false urgency of fixing it now, just in case.

Crypto Agility and PQC

Don't get me wrong. Crypto agility and PQC are good things. It is good to know which libraries in your code provide crypto functions so you can keep them up-to-date, whether for PQC or otherwise. That is not the debate. What I have trouble with is the urgency on a problem that everybody agrees to isn't real yet. There are no working quantum computers. Estimates are 5 (optimistic) to 10 (more realistic) to 20 (maybe) years out. Are we still doing risk-based infosec if we're spending time and effort on a problem that realistically won't occur for years?

Are we, when most organizations can't even keep on top of known vulnerabilities or running an effective CSPM program? Between your phishing defense, ransomware resilience and XDR adoption, where does this rate?

“Harvest Now, Decrypt Later” isn't Real

“Oh, but adversaries could capture TLS traffic, store it till a later date and decrypt when quantum computers are viable”.

Yes. Theoretically. But TLS + storage for 10 years is not free – especially when you consider the volume of TLS traffic that runs across the internet on a continuous basis. Google Search gives me daily internet traffic volumes running from 33 exabytes to 0.4 zettabytes which is quite the range, but enough to make it clear that is “stupid scale”. Therefore, simply due to volume, any HNDL would have to be targeted. Unless you're a foreign government or critical industry, that almost certainly already puts you outside of danger.

But BGP Hijacks...

BGP hijacks do happen, where adversaries route vast traffic volumes through infrastructure they control. This is almost certainly to capture metadata, not to HNDL. Even after filtering, what worth is a snapshot of a few hours or days after a decade? At the very least you'd want a continuous stream.

BGP hijacks would be incredibly wasteful to adversaries – storing data in the hope a fragment of a conversation might one day prove useful.

What About Targeted Organizations or Journalists?

If you're a targeted organization watch your XDR and network detection! If you're a journalist, use safe modes and reboot often as surveillance tools targeting you are already on the market.

You're WRONG, I have Clearance and Know it Happens

Very good. And maybe it is, but that still doesn't mean it's a threat. Those adversaries may believe it and waste their time. And you should still start your crypto agility program if not already done, for reasons nothing to do with PQC. Either way, I am happy to admit I am wrong, if that proves to be the case a decade from now. I'll wear the badge “PQC, The One I Got Wrong”.

But I'll take those chances. At least as long as the front doors remain wide open in most of our organizations.

One of the symptoms I hate the most in fibromyalgia is how it messes with my internal temperature perception. Whatever the season we're in, if I'm in pain, I'm sweating. If I do something that my body interprets as physical effort, I transform into a human sweat waterfall. Sometimes, things get even worse, and I feel so hot that I have trouble breathing.

Let me use today as an example. When I woke up, I brushed my teeth and then cleaned Chico's toilet. In a matter of seconds, my t-shirt was soaked in sweat, and my eyes were burning from the perspiration dripping from my forehead and into my eyes.

But it gets worse. Sometimes, I feel so hot that I have trouble breathing. And today was another example of that.

All of this because I woke up, got out of bed, brushed my teeth, and cleaned my cat's toilet. Just this.

There's an upside to this, though [I'm trying to look on the bright side of this, ok...]. Occasionally, before I start feeling the pain increasing, I start feeling crazy hot and sweating. This allows me to at least have a few moments to prepare myself for the upcoming pain increase. Those few moments can go from a few seconds to a few minutes, but never more than that, unfortunately.

Better than nothing, though 🤷.

#ChronicPain #Fibromyalgia #Pain

When I started university, I expected challenges, but not from my teammates. In my university, we had basic physics, chemistry, and calculus before continuing to more focused degree courses. I took a gap year after high school, so I worried I’d forgotten some of it. But I managed fine.

The surprise? My younger groupmates from industrial and environmental engineering — fresh out of high school — had forgotten even the basics. During physics and chemistry practicums, lab assistants would ask simple questions before we began (like formulas for free-fall motion). Out of six people in our group, only two of us could answer: me and one other. Worse, some didn’t even know how to zip files for task submission. But the problem wasn’t just my groupmates – some of the lab assistants were also clueless. I even debated with them because they were teaching students the wrong way to calculate error percentages during practicum. I reported them to the lecturer the next day. The lecturer accepted my complaint, but in class the following week he just told us to “understand the assistants” because they’re students too and can make mistakes. That wasn’t the point. I had already shown the assistants the correct method, but they were too arrogant – they insisted I was the one who couldn’t do math. I was furious. Imagine how many students had been taught the wrong thing by these people.

On social media, I see the same pattern: teens unable to answer basic questions like “What’s the capital of Central Java?” or “What’s 12 × 12?”. Sure, I was lazy in school too — people called me wasted potential — but I wasn’t this bad.

Young Indonesians are stuck at the lowest level of Bloom’s taxonomy:

• ✅ Remembering facts
• ❌ Understanding concepts
• ❌ Applying knowledge
• ❌ Analyzing ideas
• ❌ Evaluating situations
• ❌ Creating something new

Our schools drill memorization. That’s it. No focus on thinking, questioning, or solving problems.

From my perspective, the main causes are:

• Social media + online game addiction –> meaningless consumption –> weaker memory, impulsivity, anxiety, less empathy [source]. The deeper problem? Parents, teachers and even the government aren't prepared to guide healthy digital habits. They're trapped in the same cycle.
• No reading culture –> no curiosity, no new ideas [source]. But this also has a deeper problem. In my country, books are relatively expensive and are harder to reach for grass-roots. Making it hard to contain new information from analog writings.
• Black-and-white thinking –> no room for nuance or creativity. Our education system and media oversimplify complex issues. Critical thought is never encouraged.
• Cultural pressure to stay quiet –> Eastern values teach politeness and respect for authority, so students avoid asking questions or debating because they fear being seen as rude or attention-seeking. This value is so deeply rooted that breaking it risks social rejection, even when the intention is to learn.

See: Indonesian kids don’t know how stupid they are

#thoughts #society #education