Reader

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🚗 Stellantis says a third-party vendor spilled customer data data breach – Stellantis confirms a data leak due to a third-party vendor breach, exposing customer names and emails. They have initiated an investigation and warned customers about potential phishing risks. https://www.theregister.com/2025/09/22/stellantis_breach/

⚠️ FBI alerts public to spoofed IC3 site used in fraud schemes cybercrime – The FBI warns of spoofed IC3 websites designed to steal personal information from users reporting cybercrimes. Users should verify URLs carefully to avoid falling victim to fraud. https://securityaffairs.com/182449/cyber-crime/fbi-alerts-public-to-spoofed-ic3-site-used-in-fraud-schemes.html

🦠 Here’s how potent Atomic credential stealer is finding its way onto Macs malware – Malicious ads impersonate services like LastPass to spread Atomic Stealer on Macs. Users are warned to avoid clicking ads and to download software only from official websites. https://arstechnica.com/security/2025/09/potent-atomic-credential-stealer-can-bypass-gatekeeper/

🎮 Steam game removed after cryptostealer takes over $150K malware – A Steam game was pulled after a cryptostealer exploited it, stealing over $150,000 from users. The incident highlights the ongoing risks of malware in gaming platforms. https://www.theverge.com/news/782993/steam-blockblasters-crypto-scam-malware

😩 AI ‘Workslop’ Is Killing Productivity and Making Workers Miserable privacy – A study reveals that AI-generated content, termed 'workslop', burdens workers with fixing low-quality outputs, undermining productivity rather than enhancing it. Companies struggle to define AI's benefits amid rising risks. https://www.404media.co/ai-workslop-is-killing-productivity-and-making-workers-miserable/

🚧 Jaguar Land Rover extends shutdown again following cyberattack data breach – Jaguar Land Rover's operations remain halted due to a cyberattack, with losses estimated at £50-70 million daily. The shutdown affects thousands of workers and disrupts the broader supply chain. https://therecord.media/jaguar-land-rover-extends-shutdown-again-cyberattack

🧳 Worried About Phone Searches? 1Password’s Travel Mode Can Clean Up Your Data privacy – 1Password’s Travel Mode helps protect your data during phone searches by removing sensitive information temporarily. This feature is ideal for travelers concerned about privacy. https://www.wired.com/story/1password-travel-mode/

⚖️ What to do if your company discovers a North Korean worker in its ranks cyber defense – Companies discovering North Korean IT workers face complex legal and cybersecurity challenges. Experts advise cooperation with the workers, careful monitoring, and engaging law enforcement to mitigate risks. https://cyberscoop.com/north-korean-it-workers-enterprise-risks-sanctions-response/

📰 Researchers say media outlet targeting Moldova is a Russian cutout security research – Researchers link the online news outlet REST Media to the Russian disinformation group Rybar, revealing its role in influencing Moldova's elections through deceptive tactics and social media. https://cyberscoop.com/researchers-say-media-outlet-targeting-moldova-is-russian-cutout/

💰 Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms – Krebs on Security cybercrime – U.S. prosecutors charged Thalha Jubair and Owen Flowers, members of the Scattered Spider group, with hacking and extorting over $115 million. Their operations involved significant cyberattacks against major retailers and transport systems. https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/

🚓 ‘Find My Parking Cops’ Tracks Officers Handing Out Tickets All Around San Francisco privacy – Riley Walz created 'Find My Parking Cops,' a site that maps San Francisco parking officers issuing tickets, helping users avoid fines. The city responded by altering access to public data. https://www.404media.co/find-my-parking-cops-tracks-officers-handing-out-tickets-all-around-san-francisco/

✈️ UK arrests man in airport ransomware attack that caused delays across Europe security news – A man was arrested in connection with a ransomware attack affecting multiple European airports, causing significant flight delays. The attack targeted the MUSE software, with reports suggesting simple ransomware tools were used. https://www.theverge.com/news/784786/uk-nca-europe-airport-cyberattack-ransomware-arrest

🔒 Volvo North America disclosed a data breach following a ransomware attack on IT provider Miljödata data breach – A ransomware attack on supplier Miljödata exposed personal data of Volvo North America employees, including names and Social Security numbers. Volvo is offering affected individuals 18 months of identity protection services. https://securityaffairs.com/182577/data-breach/volvo-north-america-disclosed-a-data-breach-following-a-ransomware-attack-on-it-provider-miljodata.html

🚨 Cybercrooks publish toddlers' data in 'reprehensible' attack data breach – The Radiant Group targeted Kido International, leaking sensitive data of toddlers and their parents, including names and addresses. Experts condemned the attack as a severe moral low for cybercriminals. https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/

☁️ DOGE might be storing every American’s SSN on an insecure cloud server privacy – Senate Democrats report that DOGE has transferred sensitive information, potentially including Social Security numbers, to a cloud server, raising concerns about catastrophic security risks. https://www.theverge.com/news/785706/doge-insecure-cloud-server-social-security-numbers

🔒 Viral call-recording app Neon goes dark after exposing users' phone numbers, call recordings, and transcripts data breach – The call-recording app Neon has been taken offline after a security flaw exposed users' phone numbers, call recordings, and transcripts. The founder announced the shutdown while failing to address the security lapse. https://techcrunch.com/2025/09/25/viral-call-recording-app-neon-goes-dark-after-exposing-users-phone-numbers-call-recordings-and-transcripts/

---

Some More, For the Curious

🤖 Researchers expose MalTerminal, an LLM malware – MalTerminal is the first known malware using LLM technology to create malicious code dynamically, complicating detection for defenders. Researchers highlight the evolving threat landscape with LLM-integrated attacks. https://securityaffairs.com/182433/malware/researchers-expose-malterminal-an-llm-enabled-malware-pioneer.html

⚖️ Modern Solution: Bundesverfassungsgerich bestätigt – Wegsehen ist sicherer als Aufdecken security news – Germany's courts penalize a security expert for exposing a major vulnerability in e-commerce software instead of holding the developer accountable, undermining responsible disclosure and IT security. https://www.kuketz-blog.de/modern-solution-bundesverfassungsgerich-bestaetigt-wegsehen-ist-sicherer-als-aufdecken/

💰 $150K awarded for L1TF Reloaded exploit that bypasses cloud mitigations vulnerability – Researchers earned $150K for exploiting L1TF Reloaded, leaking VM memory from public clouds despite mitigations. The attack demonstrates ongoing risks from transient CPU vulnerabilities. https://securityaffairs.com/182476/security/150k-awarded-for-l1tf-reloaded-exploit-that-bypasses-cloud-mitigations.html

📞 Secret Service says it dismantled extensive telecom threat in NYC area cybercrime – The Secret Service disrupted a telecom network in NYC, uncovering 300 servers and 100,000 SIM cards used for encrypted communications by threat actors. Concerns about potential disruptions during the U.N. General Assembly were raised. https://cyberscoop.com/secret-service-dismantles-nyc-telecom-threat-un-general-assembly/

🔓 Bypassing Mark of the Web (MoTW) via Windows Shortcuts (LNK): LNK Stomping Technique hacking write-up – The LNK Stomping technique exploits Windows shortcuts to bypass security checks by manipulating file metadata, allowing attackers to execute malicious payloads undetected. This method highlights the evolving nature of cyber threats. https://asec.ahnlab.com/en/90299/

⚠️ Critical Vulnerability in SolarWinds Web Help Desk vulnerability – SolarWinds disclosed a critical vulnerability (CVE-2025-26399) in its Web Help Desk, allowing unauthenticated remote code execution. Users are urged to update to the latest version immediately. https://cert.europa.eu/publications/security-advisories/2025-034/

🛡️ EDR Bypass Technique Uses Windows Functions to Put Antivirus Tools to Sleep security research – The EDR-Freeze technique allows attackers to bypass endpoint detection and response (EDR) tools by using Windows functions to suspend antivirus processes without installing vulnerable drivers. This new method enhances evasion tactics for threat actors. https://thecyberexpress.com/edr-bypass-technique-disables-antivirus/

⚠️ High Vulnerability in Cisco IOS and IOS XE Software warning – Cisco reported a high-severity vulnerability (CVE-2025-20352) in its IOS and IOS XE software SNMP subsystem, allowing remote code execution or denial of service. Immediate updates and security assessments are recommended. https://cert.europa.eu/publications/security-advisories/2025-035/

⚠️ Worries mount over max-severity GoAnywhere defect vulnerability – Concerns grow over a high-severity vulnerability (CVE-2025-10035) in GoAnywhere MFT, with evidence of active exploitation. Researchers criticize Forta for lack of transparency regarding the vulnerability's status. https://cyberscoop.com/goanywhere-vulnerability-active-exploitation-september-2025/

🔐 Critical Vulnerabilities in Cisco ASA and FTD warning – Cisco disclosed critical vulnerabilities (CVE-2025-20333, CVE-2025-20363, CVE-2025-20362) in its ASA and FTD software, allowing remote code execution. Immediate updates and compromise assessments are recommended. https://cert.europa.eu/publications/security-advisories/2025-036/

---

CISA Corner

🔒 SonicWall Releases Advisory for Customers after Security Incident security news – SonicWall alerts customers about a security incident where brute force attacks accessed cloud backup files. Users are urged to verify their account and follow guidance to secure their devices. https://www.cisa.gov/news-events/alerts/2025/09/22/sonicwall-releases-advisory-customers-after-security-incident 🔍 CISA Shares Lessons Learned from an Incident Response Engagement cyber defense – CISA's response to a cyber incident revealed critical vulnerabilities exploited via CVE 2024-36401. Key lessons include the importance of timely patching and robust incident response plans. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266a 🤞 CISA Directs Federal Agencies to Identify and Mitigate Potential Compromise of Cisco Devices security news – CISA issued Emergency Directive ED 25-03, urging federal agencies to address vulnerabilities in Cisco ASA and Firepower devices. Agencies must identify affected devices and transmit memory files for analysis by September 26. https://www.cisa.gov/news-events/alerts/2025/09/25/cisa-directs-federal-agencies-identify-and-mitigate-potential-compromise-cisco-devices

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2025-10585, a Google Chromium V8 Type Confusion Vulnerability, in its KEV Catalog due to active exploitation risks. Federal agencies must remediate identified vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ Dingtian DT-R002 vulnerability – Dingtian DT-R002 relay boards have critical vulnerabilities (CVE-2025-10879 and CVE-2025-10880) that allow unauthorized retrieval of credentials. Users are urged to restrict access and enhance security measures. https://www.cisa.gov/news-events/ics-advisories/icsa-25-268-01 ⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA issued six advisories detailing vulnerabilities in various Industrial Control Systems, including AutomationDirect and Mitsubishi Electric. Users are urged to review for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-releases-six-industrial-control-systems-advisories

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

Наскоро прекарах известно време, близо месец, в една институция, която по замисъл трябва да бъде кръвоносната система на независимия културен живот у нас, от която зависят много неправителствени организации, състави и клубове с културна насоченост, които не са субсидирани от държавата, както и множество индивидуални творци – Национален фонд “Култура”.

Като стажант, аз бях много изненадан и впечатлен от силния контраст между хората, с които се запознах във Фонда, и представата ми за една държавна организация със сиви стени, управлявана от застаряващи лели без лица, целящи объркването и загубата на време на всеки дръзнал да влезе през вратите на техните студени учреждения с решетки. Der Process.

Сив облак се стели над съзнанието ми всеки път, когато си помисля за съкращения като НАП, КАТ или НОИ, и техните сиви, глухи коридори и затворени (за обедна почивка) гишета. Пази боже да искаш нещо от хората, наричани държавни служители, ако не са си изпили кафето и не са си изпушили дневната доза никотин.

Истината обаче се оказа по-сложна и някак по-тъжна. Срещнах прекрасни, отдадени хора, готови да помогнат на всеки и дебатиращи правилниците на организацията със завидна компетентност. Тяхното усърдие и професионализъм обаче се разбиваха в железобетонния острог на институционалната реалност – комбинация от хроничен недостиг на кадри и лошо управление. В резултат на това, самият Фонд е придобил репутацията на бавна, скърцаща със зъби машина.

Съдбата на НФК е белязана от един вроден недостатък, заложен в самия Закон за закрила и развитие на културата. Тя не е самостойна държавна организация със собствен бюджет, а “юридическо лице на бюджетна издръжка към министъра на културата” и контролирана единствено от него.

Тоест, една държавна организация в една демократична държава се управлява от самодържеца министър, който назначава пряко изпълнителния директор – пост, за който липсват законови изисквания за образование или опит в сферата. Когато цялото управление на „организацията майка“ – Министерството на културата – се назначава по политическа линия, от министъра до последния съветник, няма как тази зависимост да не се отрази и на дъщерната структура.

Управлението на Фонда, както ми стана ясно, винаги е било нескопосано и недодялано, с изключение на кратка почивка при Сава Драгунчев, който (като компетентно лице) бил назначен “от немай къде” и кой знае защо като изпълнителен директор на фонд, който се занимава именно със сферата, в която д-р Драгунчев е компетентен. Този човек, опитал се собственоръчно да извади фонда от бъркотията, в която е бил забъркан, все още се споменава с горчива усмивка от всички негови бивши служители, които може би не вярват, че феноменът “Фонда се управлява от компетентно лице” някога ще се повтори.

Ето защо ежедневието на прекрасните кадри във Фонда е белязано от разочарование. Най-компетентните и мотивирани служители напускат, въпреки отчайващата нужда от тях. А тази нужда се усеща най-силно извън стените на институцията – от хилядите творци и културни организации. Именно те, които създават изкуство и провеждат културни мероприятия в полза на обществото, разчитат на тези проекти, за да получат достоен хонорар за труда си. В крайна сметка, точно затова е създаден и самият Фонд.

Тръгнах си от стажа с възхищение към хората, които се борят “отвътре” със системата и разочарование от същата тази система, която ги задушава. Тръгнах си и с въпроса – Кой всъщност има полза от една неработеща културна политика, която обезсърчава както служителите си, така и творците, на които трябва да служи?

Five years later, we finally had proper vacations! 🎉 We chose the northern interior part of Alentejo because we had a voucher that covered most of the hotel cost, and we could use it to spend a few nights in the monastery of Crato, a breathtaking place that looks more like a castle. I highly recommend it if you want to spend some days in that area and can afford the prices. It even has a museum there that you can visit.

We only ended up staying one night because Chico, our cat, has some abandonment trauma, and we knew he would be stressed out while we were away. He had my parents to look out for him, and he's very comfortable around them, but he spent most of the time in the downstairs living room, where he usually spends very little time, switching between couches, waiting for us to come home, sometimes crying, and barely eating. 😿

Even if we only had two days to visit the area, and we wanted to go to the villages of Castelo de Vide and Marvão, we managed to find some spots with stunning views! 🤩 Some were plains, some were mountainous areas, but all were chef's kiss.

The Roman Museum of Ammaia, in Marvão, is also worth a visit. The outside part is bare, but it has some cool stuff in the interior exhibit. It's just a shame I couldn't touch anything behind glass. 😭 I wanted to touch an amphora and some coins so much! I'm not joking!

We did have issues finding a place to eat. Most of the restaurants in the center of each village were closed, even some that were suggested to me, and the few they had open had long queues. It's better to try and find something in the outskirts of the villages; you'll have slightly more options and far shorter waiting queues, if any.

Overall, even if exhausting, especially in Marvão, where you have to walk on foot to go up to the castle, you have several cool places to visit.

Speaking of exhausting, I was cursing so much as I was walking to Marvão's castle, because it was making my legs feel like they were being ripped apart, that several other tourists, especially the Portuguese and Spanish ones, looked at me in a bit of a shock. That actually ended up making me laugh and helped me slightly distract from that insane pain.

This was out of character for me because, in a normal situation, I wouldn't subject myself to this. But the wife was super excited about this, so I chose to try and tough it up, knowing I would pay for it later. Well, I'm paying for it hard, but I don't regret it. Even I needed this!

All the photos here are mine. You can use them under the CC0 License.

#CasteloDeVide #Marvão #Alentejo #Vacations

This blog post is one of the most gutwrenching and relatable things – IMHO, at least for me – I've read in the last half-decade. The “You'll be ok. We're here for you.” that soon changes to “You're not ok yet? Get over that, don't be a wuss. Bye!” is all too relatable for me.

Most of the people in my life just stopped reaching out, and I'm left to do it if I want to talk to them. And if they won't do it, I sure as hell won't because I have other stuff to worry about, like having the energy to cook. It may not even be a small task for you, but for someone with chronic pain, IT IS a big endeavour.

#ChronicPain #Fibromyalgia #Health

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

✈️ Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching privacy – Major airlines are selling billions of ticket records to the government for warrantless monitoring, raising significant privacy concerns about surveillance of individuals' movements. https://www.404media.co/airlines-sell-5-billion-plane-ticket-records-to-the-government-for-warrantless-searching/

🔑 Password Security Part 2: The Human Factor – Password Patterns and Weaknesses cyber defense – Human behavior leads to predictable password patterns that compromise security. Organizations can mitigate risks through password policies, filtering, and multi-factor authentication, while credential audits reveal weaknesses. https://www.guidepointsecurity.com/blog/password-security-part-2-human-factor-patterns-weaknesses/

💼 Hackers steal millions of Gucci, Balenciaga, and Alexander McQueen customer records data breach – Hackers, identified as Shiny Hunters, stole personal data of millions from luxury brands Gucci, Balenciaga, and Alexander McQueen, including names and contact details, raising concerns about targeted scams. https://securityaffairs.com/182236/cyber-crime/hackers-steal-millions-of-gucci-balenciaga-and-alexander-mcqueen-customer-records.html

🦠 FileFix attacks trick victims into executing infostealers malware – The FileFix attack tricks victims into executing malware by posing as a Facebook security alert, leading to the installation of the StealC infostealer. This method has surged in popularity, emphasizing the need for improved anti-phishing training. https://www.theregister.com/2025/09/16/filefix_attacks_facebook_security_alert/

🤖 Millions turn to AI chatbots for spiritual guidance and confession privacy – Tens of millions are using AI chatbots for spiritual advice, with apps gaining popularity for their accessibility. However, concerns arise over their accuracy, privacy, and the nature of their responses. https://arstechnica.com/ai/2025/09/millions-turn-to-ai-chatbots-for-spiritual-guidance-and-confession/

🛡️ OpenAI to predict ages in bid to stop ChatGPT from discussing self harm with kids privacy – OpenAI is implementing age prediction and identity verification systems to protect minors after a lawsuit linked its chatbot to a teenager's suicide. The company prioritizes safety over privacy for younger users. https://therecord.media/openai-age-prediction-chatgpt-children-safety

🔒 Samsung patches zero-day security flaw used to hack into its customers' phones vulnerability – Samsung has patched a zero-day vulnerability that allowed hackers to remotely install malicious code on devices running Android 13 to 16, following a private alert from Meta and WhatsApp. https://techcrunch.com/2025/09/16/samsung-patches-zero-day-security-flaw-used-to-hack-into-its-customers-phones/

🔧 Apple addresses dozens of vulnerabilities in latest software for iPhones, iPads and Macs vulnerability – Apple's latest updates for iOS, iPadOS, and macOS patch multiple vulnerabilities, including some with potential root access, but no active exploits have been reported. Users can also update to earlier versions for critical patches. https://cyberscoop.com/apple-security-updates-september-2025/

⚖️ BreachForums founder resentenced to three years in prison cybercrime – Conor Brian Fitzpatrick, founder of the BreachForums cybercrime marketplace, was resentenced to three years in prison after a lenient initial sentence was overturned due to his lack of remorse and continued illegal activities. https://cyberscoop.com/conor-fitzpatrick-pompompurin-resetenced-breachforums/

🖥️ Consumer Reports asks Microsoft to keep supporting Windows 10 security news – Consumer Reports has urged Microsoft to continue supporting Windows 10, highlighting concerns about user security and compatibility as the transition to Windows 11 proceeds. https://www.theverge.com/news/779079/consumer-reports-windows-10-extended-support-microsoft

📰 Russian fake-news network back in action with 200+ new sites security news – A Russian troll farm has launched over 200 new fake news websites using AI to generate content, aiming to influence political discourse in multiple countries, including the US and Canada. https://www.theregister.com/2025/09/18/russian_fakenews_network/

🔒 10585 is the sixth actively exploited Chrome zero vulnerability – Google patched four vulnerabilities in Chrome, including the actively exploited zero-day CVE-2025-10585, a type confusion issue in the V8 engine, marking the sixth such vulnerability in 2025. https://securityaffairs.com/182322/uncategorized/cve-2025-10585-is-the-sixth-actively-exploited-chrome-zero-day-patched-by-google-in-2025.html

🛠️ Open-Source Tool Greenshot Hit by Severe Code Execution Vulnerability vulnerability – A critical vulnerability in Greenshot allows arbitrary code execution due to improper data handling, risking exploitation by local attackers. Users are urged to update to version 1.3.301 to mitigate the issue. https://thecyberexpress.com/greenshot-vulnerability/

📚 Librarians Are Being Asked to Find AI-Hallucinated Books security news – Librarians report increasing patron requests for non-existent books generated by AI, leading to confusion and diminished trust in information sources. The impact of generative AI on libraries raises concerns about information literacy and the quality of resources. https://www.404media.co/librarians-are-being-asked-to-find-ai-hallucinated-books/

🚆 ‘Scattered Spider’ teens charged over London transportation hack cybercrime – Two teenagers from the 'Scattered Spider' group have been charged in connection with a cyberattack that disrupted London's transportation systems, highlighting growing concerns about youth involvement in cybercrime. https://www.theverge.com/news/781039/scattered-spider-teens-charged-tfl-london-hack

✈️ Russia's main airport in St. Petersburg says its website was hacked security news – Pulkovo Airport in St. Petersburg experienced a cyberattack that took its website offline, although flight operations remained unaffected. This follows other disruptions in Russia's aviation sector amid rising cyberattacks since the Ukraine invasion. https://therecord.media/russia-pulkovo-airport-st-petersburg-website-hacked

👶 Watchdog finds MrBeast improperly collected children’s data privacy – The Children’s Advertising Review Unit found that YouTuber MrBeast collected children's data without parental consent, violating COPPA guidelines. He has since updated his data collection practices in response to the findings. https://therecord.media/watchdog-mrbeast-youtube-privacy-colection

🚗 JLR Cyberattack Becomes UK National Crisis cybercrime – The Jaguar Land Rover cyberattack has halted production, affecting over 200,000 workers and prompting government discussions for support. The incident, attributed to the Scattered Lapsus$ Hunters group, is causing significant financial losses. https://thecyberexpress.com/jlr-cyberattack-becomes-uk-national-crisis/

✈️ Hundreds of flights delayed at Heathrow and other airports after apparent cyberattack security news – A cyber-related incident involving Collins Aerospace led to significant flight delays at major European airports, including Heathrow, as airlines reverted to manual check-ins. Travelers are advised to arrive earlier for flights. https://techcrunch.com/2025/09/21/hundreds-of-flights-delayed-at-heathrow-and-other-airports-after-apparent-cyberattack/

---

Some More, For the Curious

🚨 T-1 month: Exchange Server 2016 and Exchange Server 2019 End of Support security news – Exchange Server 2016 and 2019 reach end of support on October 14, 2025, risking security vulnerabilities without updates. Users are urged to upgrade or migrate to Exchange Online. https://techcommunity.microsoft.com/blog/exchange/t-1-month-exchange-server-2016-and-exchange-server-2019-end-of-support/4453133

🕵️‍♂️ One Token to rule them all – obtaining Global Admin in every Entra ID tenant via Actor tokens vulnerability – A critical vulnerability in Entra ID allows attackers to impersonate Global Admins across tenants using undocumented Actor tokens. Microsoft swiftly fixed the issue, but risks remain. https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

💨 Hosting a WebSite on a Disposable Vape hacking write-up – An innovative project explores hosting a web server on a disposable vape's microcontroller, achieving surprisingly fast response times despite its limited specs. A humorous take on tech recycling! https://bogdanthegeek.github.io/blog/projects/vapeserver/

🔓 Windows Local Privilege Escalation through the bitpixie Vulnerability vulnerability – The bitpixie vulnerability allows attackers to bypass BitLocker encryption via a downgrade attack on Windows Boot Manager, risking unauthorized access. A Microsoft patch is available to mitigate this risk. https://blog.syss.com/posts/bitpixie/

🚨 China Imposes One-Hour Reporting Rule for Major Cybersecurity Incidents security news – China's new regulations mandate reporting severe cybersecurity incidents within one hour, enhancing enforcement following high-profile data breaches. Proposed law amendments suggest stricter penalties for non-compliance. https://thecyberexpress.com/china-cybersecurity-incident-reporting/

🛡️ Google Online Security Blog: Supporting Rowhammer research to protect the DRAM ecosystem security research – Google supports research on Rowhammer vulnerabilities in DRAM, leading to the development of test platforms and new attack patterns that expose weaknesses in existing mitigations, necessitating further improvements. http://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html

🐍 Replicating Worm Hits 180+ Software Packages – Krebs on Security cybercrime – The Shai-Hulud worm has infected over 180 NPM packages, stealing credentials and publishing them on GitHub. It self-replicates, raising concerns over supply chain security in software development. https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/

🚫 Microsoft, Cloudflare shut down RaccoonO365 phishing domains cyber defense – Microsoft seized 338 domains linked to the RaccoonO365 phishing operation, led by Joshua Ogundipe, which sold phishing kits that compromised Microsoft 365 credentials. The takedown disrupts a major tool used by cybercriminals. https://www.theregister.com/2025/09/16/microsoft_cloudflare_shut_down_raccoono365/

💻 HybridPetya: The Petya/NotPetya copycat comes with a twist malware – ESET has identified a new ransomware called HybridPetya, which mimics NotPetya but can also compromise UEFI systems and exploit CVE‑2024‑7344 to bypass UEFI Secure Boot. It's not currently spreading in the wild. https://www.welivesecurity.com/en/videos/hybridpetya-petya-notpetya-copycat-twist/

🔓 Attack on SonicWall’s cloud portal exposes customers’ firewall configurations data breach – SonicWall confirmed a breach of its MySonicWall.com platform, exposing firewall configuration files of less than 5% of its customers. The incident highlights systemic security issues within the vendor's operations. https://cyberscoop.com/sonicwall-cyberattack-customer-firewall-configurations/

⛈️ Cloudflare DDoSed itself with React useEffect hook blunder security news – Cloudflare experienced an outage due to a coding error involving a React useEffect hook, which caused excessive API calls and overloaded its Tenant Service API. The incident sparked discussions on the proper use of useEffect in development. https://www.theregister.com/2025/09/18/cloudflare_ddosed_itself/

⚙️ SystemBC – Bringing the Noise security research – Lumen's Black Lotus Labs discovered the SystemBC botnet, leveraging over 80 C2s and primarily targeting VPS systems to create high-volume proxies for cybercriminal activities. The botnet is linked to various criminal groups and is being used alongside the REM Proxy service for malicious operations. https://blog.lumen.com/systembc-bringing-the-noise/

🔒 CISA Warns of New Malware Campaign Exploiting Ivanti EPMM Vulnerabilities vulnerability – CISA reports a malware campaign exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428), allowing unauthorized access and malware deployment. Organizations are urged to upgrade systems and implement security measures. https://thecyberexpress.com/cisa-mar-cve-2025-4427-28/

🔐 CVE-2025-10035: Critical Vulnerability in Fortra GoAnywhere MFT vulnerability – A critical vulnerability, CVE-2025-10035, has been identified in Fortra's GoAnywhere MFT software, potentially exposing sensitive data. Users are urged to apply patches immediately to mitigate risks. https://www.vulncheck.com/blog/cve-2025-10035-fortra-go-anywhere-mft

🤔 Future of CVE Program in limbo as CISA, board members debate path forward security news – The future of the CVE Program is under debate after a funding incident raised concerns about its management. CISA asserts its leadership role while board members advocate for a collaborative, globally-supported model. https://therecord.media/cve-program-future-limbo-cisa

---

CISA Corner

⚙️ CISA Releases Eight Industrial Control Systems Advisories vulnerability – CISA has issued eight advisories addressing vulnerabilities in various Industrial Control Systems, including products from Siemens, Schneider Electric, and Hitachi Energy, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/09/16/cisa-releases-eight-industrial-control-systems-advisories ⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA has issued nine advisories addressing vulnerabilities in various Industrial Control Systems, including products from Westermo, Schneider Electric, and Hitachi Energy, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/09/18/cisa-releases-nine-industrial-control-systems-advisories

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

Highlight

🤞 We Got Lucky: The Supply Chain Disaster That Almost Happened No summary here, just a recommendation to read https://www.aikido.dev/blog/we-got-lucky-the-supply-chain-disaster-that-almost-happened

---

News For All

💾 Signal introduces free and paid backup plans for your chats security news – Signal now allows users to back up chats for free and offers a paid plan for full media backups. This enhances its value for secure messaging amid privacy concerns. https://techcrunch.com/2025/09/08/signal-introduces-free-and-paid-backup-plans-for-your-chats/

📺 Plex admits breach of account details, hashed passwords data breach – Plex has warned users to reset passwords after a breach potentially exposed emails, usernames, and hashed passwords. While credit card data wasn't compromised, this incident echoes previous breaches. https://www.theregister.com/2025/09/09/plex_breach/

🏋️‍♂️ Call audio from gym members, employees in open database data breach – An unprotected AWS database exposed sensitive audio recordings of gym members discussing personal and financial information. This raises concerns about potential identity theft and social engineering attacks. https://www.theregister.com/2025/09/09/gym_audio_recordings_exposed/

🔒 Apple says the iPhone 17 comes with a massive security upgrade security news – Apple's iPhone 17 features Memory Integrity Enforcement, an always-on security measure aimed at complicating spyware development, enhancing user protection. https://www.theverge.com/news/775234/iphone-17-air-a19-memory-integrity-enforcement-mte-security

📱 Nepal lifts social media ban after deadly youth protests security news – Nepal has lifted a ban on social media platforms following violent protests that resulted in 29 deaths. The government faced criticism for the ban, deemed digital repression by rights groups. https://therecord.media/nepal-social-media-ban-lifted-after-deadly-protests

🚗 Jaguar Land Rover says data stolen in disruptive cyberattack data breach – Jaguar Land Rover reported a cyberattack that resulted in data theft and halted vehicle assembly lines. The extent of the stolen data and its impact on employees or customers remains unclear. https://techcrunch.com/2025/09/10/jaguar-land-rover-says-data-stolen-in-disruptive-cyberattack/

🖼️ Google Online Security Blog: How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials security news – Google's Pixel and Android devices now utilize C2PA Content Credentials to enhance image authenticity, providing users with verifiable trust in their images and combating misinformation. http://security.googleblog.com/2025/09/pixel-android-trusted-images-c2pa-content-credentials.html

🔐 Brussels faces privacy crossroads over encryption backdoors privacy – Europe debates legislation requiring scanning of user content for child abuse, raising concerns over privacy and security. Critics argue it could lead to false accusations and a significant erosion of digital rights. https://www.theregister.com/2025/09/11/eu_chat_control/

💻 Kids in the UK are hacking their own schools for dares and notoriety cybercrime – The ICO reports that over half of personal data breaches in UK schools are caused by students, often through weak passwords and lax security practices. https://techcrunch.com/2025/09/11/kids-in-the-uk-are-hacking-their-own-schools-for-dares-and-notoriety/

🛡️ FTC opens inquiry into how AI chatbots impact child safety, privacy privacy – The FTC is investigating how major tech companies protect children using AI chatbots, focusing on safety measures and privacy practices. This follows concerns over negative impacts, including a tragic suicide case linked to a chatbot. https://therecord.media/ftc-opens-inquiry-ai-chatbots-kids

⚠️ Apple issues spyware warnings as CERT warning – Apple has issued alerts about a spyware campaign affecting iCloud-linked devices, confirmed by France's CERT-FR. Notifications indicate potential compromises, often involving sophisticated attacks with zero-day vulnerabilities. https://securityaffairs.com/182129/malware/apple-issues-spyware-warnings-as-cert-fr-confirms-attacks.html

🔒 Swiss government looks to undercut privacy tech, stoking fears of mass surveillance privacy – The Swiss government plans to require service providers to collect IDs, retain user data for six months, and potentially disable encryption, raising concerns over mass surveillance and the impact on privacy tech companies. https://therecord.media/switzerland-digital-privacy-law-proton-privacy-surveillance

🔒 Samsung fixed actively exploited zero vulnerability – Samsung patched the CVE-2025-21043 zero-day vulnerability, allowing remote code execution on Android devices. The flaw was exploited in attacks without user interaction, raising concerns over security. https://securityaffairs.com/182135/hacking/samsung-fixed-actively-exploited-zero-day.html

⚖️ Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal cybercrime – Aleksanteri Kivimäki, convicted of extorting over 20,000 psychotherapy clients, was released on appeal while his case continues. The hack has deeply impacted Finnish society, with many victims still suffering. https://therecord.media/finland-vastaamo-hacker-free-during-appeal-conviction

🧺 Dutch students denied access to jailbroken laundry machines security news – Over 1,250 University of Amsterdam students are without laundry services after a cyberattack compromised smart machines, allowing free washing. Management company Duwo refuses to restore the service due to costs. https://www.theregister.com/2025/09/12/jailbroken_laundry_machines/

🔓 Vietnam, Panama governments suffer incidents leaking citizen data data breach – Vietnam's National Credit Information Center suffered a data breach, with hackers claiming to have stolen 160 million records. Meanwhile, Panama's Ministry of Economy and Finance reported a cyberattack, with the INC ransomware gang claiming to have stolen 1.5 terabytes of data. https://therecord.media/vietnam-cic-panama-finance-ministry-cyberattacks

🚆 British rail passengers urged to stay on guard after hack signals failure data breach – LNER warns passengers of a data breach involving a third-party supplier, exposing contact details and journey information. Customers are advised to be cautious of unsolicited communications, although no payment details were compromised. https://www.bitdefender.com/en-us/blog/hotforsecurity/british-rail-passengers-hack-signals-failure

---

Some More, For the Curious

🎢 Exploiting the Impossible: A Deep Dive into A Vulnerability Apple Deems Unexploitable vulnerability – A deep dive reveals a race condition in Apple's file-copy API that could be exploited, challenging Apple's belief that it was unexploitable. This vulnerability poses significant security risks. https://jhftss.github.io/Exploiting-the-Impossible/

🐱‍👤 Break The Protective Shell Of Windows Defender With The Folder Redirect Technique hacking write-up – This article details a method for exploiting Windows Defender's update mechanism through symbolic links, allowing attackers to control its execution folder and potentially disable the antivirus. https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html

🔓 Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack security news – Salesloft's GitHub was breached by hackers who stole tokens, leading to a mass attack on major clients like Google and Cloudflare. Security measures are now in place after a lengthy detection delay. https://securityaffairs.com/182002/hacking/hackers-breached-salesloft-s-github-in-march-and-used-stole-tokens-in-a-mass-attack.html

💻 18 Popular Code Packages Hacked, Rigged to Steal Crypto – Krebs on Security malware – Eighteen widely-used JavaScript packages were compromised to steal cryptocurrency after a developer was phished. Experts warn that such supply chain attacks could lead to more severe malware outbreaks. https://krebsonsecurity.com/2025/09/18-popular-code-packages-hacked-rigged-to-steal-crypto/

🕵️‍♂️ Detecting Active Directory Password-Spraying with a Honeypot Account cyber defense – This article outlines a method to detect password-spraying attacks using a honeypot account, reducing false positives by monitoring logon attempts specifically associated with this account. https://trustedsec.com/blog/detecting-password-spraying-with-a-honeypot-account

🔧 Zero Day Initiative — The September 2025 Security Update Review vulnerability – September updates include Adobe's fixes for 22 CVEs across various products, and Microsoft's 80 CVEs, featuring Critical vulnerabilities like remote code execution. No active exploitation noted. https://www.thezdi.com/blog/2025/9/9/the-september-2025-security-update-review

⚠️ SAP warns of high-severity vulnerabilities in multiple products vulnerability – SAP has identified multiple high-severity vulnerabilities, including a critical flaw rated 10 in NetWeaver, allowing unauthenticated command execution. Immediate patching is advised to prevent exploitation. https://arstechnica.com/security/2025/09/as-hackers-exploit-one-high-severity-sap-flaw-company-warns-of-3-more/

🎓 The State of Ransomware in Education 2025 security research – Sophos' study reveals evolving ransomware threats in education, highlighting phishing and exploited vulnerabilities as primary attack vectors. Recovery efforts decline while ransom demands and payments drop significantly, indicating growing resilience. https://news.sophos.com/en-us/2025/09/10/the-state-of-ransomware-in-education-2025/

😅 The npm incident frightened everyone, but ended up being nothing to fret about cybercrime – An npm account compromise led to malicious code injection in popular packages, causing initial panic. However, the attack's impact was minimal, quickly contained, and the community's response proved effective. https://cyberscoop.com/open-source-npm-package-attack/

🐛 ChillyHell modular macOS malware OKed by Apple in 2021 malware – ChillyHell, a modular macOS backdoor that passed Apple's notarization, has likely infected systems undetected since 2021. Its advanced features include multiple persistence methods and command-and-control protocols. https://www.theregister.com/2025/09/10/chillyhell_modular_macos_malware/

🔍 Do we invest too much in risk assessments and too little in security? cyber defense – Organizations should prioritize basic security controls over risk assessments. A structured approach involves establishing foundational security, followed by managed capabilities and risk-based enhancements to improve overall security posture. https://safecontrols.blog/2025/09/10/do-we-invest-too-much-in-risk-assessments-and-too-little-in-security/

☁️ VMSCAPE Spectre vulnerability leaks cloud secrets vulnerability – ETH Zurich researchers have discovered the VMSCAPE vulnerability, a Spectre-based exploit that allows cloud users to leak secrets from the hypervisor on AMD and Intel CPUs without code changes. Software mitigations are required to address the issue. https://www.theregister.com/2025/09/11/vmscape_spectre_vulnerability/

🦠 SonicWall firewalls targeted by fresh Akira ransomware surge cybercrime – Researchers warn of a surge in Akira ransomware attacks exploiting a year-old vulnerability in SonicWall firewalls. Improper configurations and failure to reset passwords have exacerbated the issue, with multiple organizations affected. https://cyberscoop.com/sonicwall-akira-ransomware-attacks-surge/

💻 HybridPetya ransomware dodges UEFI Secure Boot malware – HybridPetya, a new ransomware strain, exploits a vulnerability to bypass UEFI Secure Boot on Windows systems. While currently a proof-of-concept, it demonstrates significant technical capabilities, including MFT encryption. https://www.theregister.com/2025/09/12/hopefully_just_a_poc_hybridpetya/

---

CISA Corner

⚙️ CISA Releases Fourteen Industrial Control Systems Advisories vulnerability – CISA issued fourteen advisories detailing vulnerabilities in various Industrial Control Systems, including multiple Rockwell Automation products. Users are urged to review these for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/09/cisa-releases-fourteen-industrial-control-systems-advisories ⚙️ CISA Releases Eleven Industrial Control Systems Advisories vulnerability – CISA issued eleven advisories on September 11, 2025, detailing vulnerabilities in various ICS products, primarily from Siemens and Schneider Electric. Users are urged to review these advisories for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/11/cisa-releases-eleven-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-5086, a deserialization vulnerability in Dassault Systèmes DELMIA Apriso, to its KEV Catalog due to active exploitation risks. Federal agencies are required to remediate identified vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2025/09/11/cisa-adds-one-known-exploited-vulnerability-catalog

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

Outro dia desses estava lendo “homo bolsonarus” do Renato Lessa (disponibilizado de graça na rede) e uma das coisas que acho instigante no texto é a concepção de que o bolsonarismo é uma instituição.

Lessa fala sobre como Hobbes observou a capacidade humana de produzir “animais artificiais”, que são as instituições.

Nem todo animal artificial que criamos, por certo, precisa ser necessariamente uma besta perversa. Também é possível ver uma luta entre estes constructos animais (mas não no estilo duelo Pokemon). Inclusive estamos assistindo na atualidade as instituições oficiais do Judiciário e PGR (antes leniente sob o comando de Augusto Aras) combatendo a besta bolsonarista.

Mas deixando de lado a atenção principal do texto do professor, o bolsonarismo, o que mais gostei foi a dica final, de que podemos criar outras instituições! E acrescento que nossos animais artificiais não necessitam ser estatais.

O Poder Central é expressivo, mas também é limitado, uma instituição precisa mesmo é ter um “discurso forte”, capaz de reunir as pessoas em torno de convicções e crenças sólidas.

Este fediverso, por exemplo, é a infraestrutura de uma instituição, de um animal artificial que criamos. Não é estatal, não criamos um Leviatã, nem é um passarinho ou uma borboleta, de propriedade capitalista. Alguns de nós chamam de mastodonte, mas sabemos que é maior que isso.

Nesse caso específico, ademais, nós, que alimentamos nosso bichinho, precisamos tornar esse discurso mais forte para dar mais consistência às crenças que sustentam essa instituição (informação, diálogos, comunicação públicas, abertas, descentralizadas, etc.).

Quando o bolsonarismo alcançou o Poder Executivo (além de parcela relevante das cadeiras do Congresso) por certo ele ganhou mais força e foram quatro anos sofridos, com direito a uma pandemia mundial para a besta fazer mais vítimas…

Mas só conseguiu alcançar o executivo por ser uma instituição forte, independentemente do Poder Central, que canalizava as emoções e crenças de muitas pessoas!

O poder parcial conquistado com a eleição e ascensão ao executivo federal teve também um aspecto limitador. A estrutura de Separação dos Poderes fez a criatura guinchar de ódio e se queixar que o Judiciário não a deixava desgovernar em paz… Até mesmo o Legislativo exigia muitas emendas e não admitia todas as vontades da besta.

O que gostaria de ressaltar, contudo, é que estas experiências nos mostram que também podemos cristalizar nossas crenças em uma humanidade não alienada, não oprimida, livre do jugo do poder financeiro e da vigilância do capitalismo atual, por meio de novos constructos animais!

Para tanto precisamos de união, cooperação, consenso, diálogo, respeito, técnica politica e, principalmente, praticar a experimentação e a criatividade.

Comente este humilde ensaio aqui

#instituições #fediverso #bolsonarismo

দুটি দরজা, একপাশে কান্নার আওয়াজ আর অন্যপাশে আনন্দের হর্ষধ্বনি। আর এদের মাঝে একটি রুম, নাম তার ‘ওয়েটিং রুম।’ যেখানে সময়ের ঘড়ি চলে ধীরগতিতে, অথচ হৃৎস্পন্দন পাগলা ঘোড়ার দ্রুতিতে ছোটে। জীবনের এই দেনা-পাওনার মঞ্চে হাসপাতাল হল সেই স্থান, যেখানে প্রতিটা মিনিটের আলাদা রঙ আছে, প্রতিটা শ্বাসের রয়েছে আলাদা অর্থ। চেয়ারে অপেক্ষমাণ মানুষগুলোকে দেখলে বোঝা যায়, অপেক্ষা কেমন করে তাদের উৎকণ্ঠাকে মুখভঙ্গিতে টেনে উঠিয়ে নিয়ে আসে। কারও চোখে ভয়ের কুয়াশা তো কারও ঠোঁটে নীরব প্রার্থনা, কারও হাতে প্রেসক্রিপশন চেপে ধরা তো কারও চোখে-মুখে অদৃশ্য শূন্যতা। কোণায় কোণায় অ্যান্টিসেপটিকের গন্ধ, দেয়াল ঘড়ির টিকটক-টিকটক শব্দ, ব্যাস্ততায় মুখ ভরা এটেন্ডেন্ট; পুরোটা দেখলে মনে হয় কেউ যেন সময়কে ধীর করে এসবের মাঝে পেঁচিয়ে দিয়েছে। কারও কাছে পাঁচ মিনিট এখানে অসহ্য অনন্ত, আবার এই পাঁচ মিনিটই কারো কাছে জীবনের নতুন সূর্যোদয়ের অংশ।

এখানে ডাক্তার সাহেবের চেম্বারের দরজার দুই প্রান্তে দুইটি আলাদা জগৎ রয়েছে। চেম্বারের ভেতরে প্রবেশ করা রোগীটি মনে করে— ডাক্তার সাহেব কি ঠিকমতো আমাকে দেখছেন? এই যে দ্রুত কয়েকটা প্রশ্ন করে, দ্রুত কয়েকটা পরীক্ষা করাতে দিলেন, নাম না জানা কতোগুলো ঔষধের নাম লিখে দিলেন; এগুলোই কি যথেষ্ট? আবার বাইরে বসে থাকা মানুষটি ভাবে- একজনকে দেখতেই এত সময়! আমার সিরিয়াল কি আজ আসবে? একই সময়ে দুই বিপরীত প্রত্যাশা নিয়ে সবাই এখানে অপেক্ষা করে। কেবল নিজের সমস্যাটার বেলায় খুব মনোযোগ প্রত্যাশা করে, আর অন্যদের বেলায় কেবল বিরক্তির প্রকাশ করে। ওই একই মানুষ, একই ডাক্তার- শুধু দরজার দুই পাড়ে দাঁড়াতেই আমাদের চাওয়া-পাওয়া এখানে ভিন্নরূপ ধারণ করে।

প্রায়ই বলতে শোনা যায়, ডাক্তার সাহেব কেমন যেন উদাসীন, আমার পুরো কথা শুনলেন না বা সবকিছু জিজ্ঞাসা করলেন না, ভালোভাবে বুঝলেন না। তাহলে কী তারা উদাসীন?!! মোটেই না, বরং দিনের পর দিন একই রকম উদ্বেগ, একই রকম ব্যথা, একই ভঙ্গির উৎকণ্ঠা, একই রকম জরুরি অবস্থা সামলাতে সামলাতে তাঁদের মুখে হাসির বদলে নিয়ম বাসা বেঁধেছে। রুক্ষ বা রুষ্ট নয় বরং এটি দায়িত্ব পূরণে আত্মরক্ষার এক পাতলা আস্তরণ; যেন আবেগে ভেসে গিয়ে হাত কাঁপে না, সিদ্ধান্ত নিতে মনে যেন কোন দোদুল্যমান অবস্থার উদ্রেক না ঘটে। একই ঘটনা ঘটে নার্সদের ব্যাপারে, তাদের রুক্ষ আচরণ আর কঠিন ব্যবহার নিয়ে আমাদের অভিযোগের অন্ত নেই। অথচ নার্সরা যেই রুক্ষ আচরণটি করে, যে “রুটিন” মেনে চলে, সেটাই তো আপনার-আমার জন্যে নিরাপত্তার ব্যারিকেড। কখন ইনজেকশন, কখন স্যালাইন, কোন ওষুধ আগে, কার প্রেসার নেমে যাচ্ছে -এসব সমীকরণের হিসেব মেলাতে একটু ঘাড় নেড়ে সান্ত্বনার প্রকাশ কিংবা আপনার অন্যায়কে প্রশ্রয় না দিয়ে তারা আপনাকেই প্রাধান্য দিচ্ছে।

হাসপাতালের ওয়েটিং রুমে বসে কিছু সময় ব্যয় করলে জীবনকে অন্য আলোয় দেখার সুযোগ পাওয়া যায়। পাশের চেয়ারে হয়ত নতুন বাবার কাঁধে লেপটে থাকা খুশি; একটু দূরে স্ট্রেচারে শুয়ে থাকা এক বৃদ্ধার নিঃশব্দের টানা শ্বাস; কেউ চুপচাপ তসবিহ গুনছেন, কেউ ফোনে টাকার বন্দোবস্ত করছেন, কেউ রিপোর্টের শিরোনাম ধরে ধরে গুগল করা শব্দের মানে খুঁজছেন। এইসব দৃশ্যের ভিড়ে বোঝা যায়- আমাদের ব্যক্তিগত ঝড় গুলো পৃথিবীর সবচেয়ে বড় জলোচ্ছাস নয়। বরং আজ যে যন্ত্রণায় বুক ফেটে যাচ্ছে, কালই হয়ত বুঝব আমার সেই কষ্টটা আসলে তেড়ে আসা সমুদ্র নয়, বরং সেটি ছিল সমুদ্রতীরের কেবলই ছোট্ট একটা ঢেউ।

আমরা মানুষেরা খুবই ‘আপন কেন্দ্রিক’। নিজের বেলায় পরিপূর্ণ আকর্ষণ কামনা করি, আর পরের বেলায় খানিকটা আকর্ষণেও বিরক্তি প্রকাশ করি। অথচ হসপিটালের এই একটি কাঠামোতেই হাজার হাজার গল্প একসঙ্গে ঘটে। এখানে কারও একজনের বিলম্ব অন্য কারও বেঁচে উঠার কারণ হয়ে উঠে। এখানে একজনের একটু অপেক্ষা অন্য কারও জন্যে জীবনের দিকে এগিয়ে যাওয়া সিঁড়ির একটি ধাপ হয়ে উঠে। এখানে সময় সমান্তরাল লাইন না হয়ে বিপ-বিপ শব্দ তোলা বাঁকা-তেড়া সাইন হয়ে উঠে। কপালের চিন্তার ভাজ আর গালে খুশির টোল এখানে একইসঙ্গে ঘটতে থাকে।

শিষ্টতা, সহানুভূতি, সম্মান আর দায়বদ্ধতার এক দারুণ হারমোনি দেখা যায় হাসপাতালগুলোতে। নিজের ব্যক্তিগত বিরক্তি ঢেকে ডাক্তার সাহেব হাসিমুখে আপনার সমস্যাটি যখন জানতে চায়, তখন প্রকাশ পায় তার শিষ্টতা, রাত তিনটার ডিউটিতে বারো ঘণ্টা পেরিয়ে যাওয়া নার্সের হাত যখন নিখুঁতভাবে ক্যানোলা বসায়, সেটাই তার সহানুভূতি; দীর্ঘ লাইনের মাঝেও যখন ডাক্তার প্রয়োজনের অতিরিক্ত কোনো পরীক্ষা লেখেন না, সেটাই তার দায়বদ্ধতা; ডায়াগনোসিস ঠিক রাখতে যখন তিনি আপনাকে পঁচিশটা প্রশ্নের বদলে সঠিক পাঁচটা প্রশ্ন করেন, সেটাই আপনার প্রতি দেখানো তার সম্মান। এই বিষয়গুলো অনুধাবনের, অনুকরণের। মমতা সবসময় হাসি দিয়ে নয়, অনেকক্ষেত্রে নীরব নির্ভুলতার মাধ্যমে প্রকাশ পেয়ে থাকে।

তবুও অভিযোগ থাকবে; হাসপাতাল মানেই কাগজপত্র, বিল, সিরিয়াল, ভিড়, হুলস্থূল, দিশেহারা অবস্থা। আমরা চাই মানবিকতা; সিস্টেম চায় শৃঙ্খলা। এই দুইয়ের মাঝখানে একটা সেতুবন্ধন প্রয়োজন। প্রয়োজন অপেক্ষার প্রতি সম্মান এবং সেবার প্রতি আস্থা। আমরা যদি প্রয়োজন আর প্রশ্নগুলোকে ভাগ করতে পারি, জিজ্ঞাসা আর চাহিদাকে সময়ের গণ্ডিতে সীমাবদ্ধ করতে পারি তাহলেই ব্যাপারগুলো সহজ হয়ে উঠে। আর অন্যদিকে কাউন্টারের অপরপাশ থেকে কেউ যখন বলবে- “একটু অপেক্ষা করুন, আপনারটা আমরা দেখছি।” তখন অপেক্ষার ভারী বাতাস হালকা হয়ে উঠে। আপনি-আমি, ডাক্তার-নার্স – সবাই মিলে চাইলেই এই সেতুটি বানাতে পারি।

সবশেষে, ওয়েটিং রুম থেকে বেরিয়ে যখন করিডর ধরে এগোতে শুরু করবেন, তখন একবার পিছনে তাকান। দেখবেন, আপনার ঠিক পরেই আরেকটি গল্প সেই একই দরজার সামনে এসে দাঁড়িয়েছে। কেউ হয়ত ফোনকলে নিজের আনন্দটা প্রকাশ করছে; কেউ চুপচাপ বসে কাঁদছে; কেউ একে অপরের কাঁধে হাত রেখে সান্ত্বনা দিচ্ছে। এই ধারাবাহিকতার নামই তো জীবন। কেউ হারায়, কেউ পায়; কেউ শিখে নেয় স্থির হতে, কেউ পায় কৃতজ্ঞ হওয়ার মন্ত্রণা।

সময়কে মানতে আর মানুষকে বুঝতে শেখায় হসপিটাল। সময়কে মানলে অপেক্ষা সহনীয় হয়; মানুষকে বুঝলে অভিযোগ হয় সংক্ষিপ্ত। পরের বার আপনি যখন ওয়েটিং রুমে বসবেন, বিরক্তিটাকে মন থেকে ঝেড়ে ফেলবেন। গভীর একটি শ্বাস নেবেন, আর মনে মনে বলবেন—”এটা কেবল একটি জার্নি, ধৈর্য আর অপেক্ষাই আমাকে পৌঁছে দেবে গন্তব্যে।” দেখা যাবে, একই ঘড়ির কাটাও তখন একটু টিক-টক শব্দ করে এগিয়ে যাবে, কিন্তু এবার সেই সুরটি বিরক্তির বদলে কোমলতা ছড়িয়ে দিবে।

ওয়েটিং রুমের দরজা পেরিয়ে আমরা আবারও ফিরে যাবো নিজ-নিজ জীবনে। পেছনে থাকবে কর্মব্যস্ত হসপিটাল আর তার ওয়েটিং রুম। তবে ওয়েটিং রুমের সেই শিক্ষাটাও মনে রাখতে হবে। মনে রাখতে হবে- পৃথিবীর সবচেয়ে গুরুত্বপূর্ণ কাজ কখনও কখনও ধৈর্য ধরে অপেক্ষা করা। আরও মনে রাখতে হবে- কোথাও কেউ একজন, এখনো আমাদের জন্যে নিষ্ঠার সাথে কাজ করে যাচ্ছে। প্রয়োজন কেবল একটু ধৈর্য, একটু আস্থার। বাকি পথ সময় নিজ দায়িত্বে হাঁটিয়ে নিয়ে যাবে।

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🤖 Microsoft launches Copilot AI function in Excel, but warns not to use it in 'any task requiring accuracy or reproducibility' security news – Microsoft's new Copilot AI for Excel simplifies formula generation but raises concerns about accuracy and privacy, warning against use in critical tasks. https://www.pcgamer.com/software/ai/microsoft-launches-copilot-ai-function-in-excel-but-warns-not-to-use-it-in-any-task-requiring-accuracy-or-reproducibility/

🔑 CERT.at Ewig ruft das Passwort warning – The article discusses the persistent reliance on passwords, their vulnerabilities, and the importance of robust security measures, including monitoring leaks and implementing two-factor authentication. https://www.cert.at/de/blog/2025/8/ewig-ruft-das-passwort

🏨 Attackers Target Hotelier Accounts in Malvertising and Phishing Campaign cybercrime – A phishing campaign impersonating hotel service providers uses malvertising to harvest credentials and bypass MFA, targeting cloud-based property management systems and exploiting user trust. https://sec.okta.com/articles/2025/08/attackers-target-hotelier-accounts-in-broad-phishing-campaign/

📱 Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware malware – Experts discovered 77 malicious Android apps on Google Play, collectively installed over 19 million times, spreading the Anatsa banking trojan and other malware, highlighting significant risks for users. https://securityaffairs.com/181528/malware/malicious-apps-with-19m-installs-removed-from-google-play-because-spreading-anatsa-banking-trojan-and-other-malware.html

📷 CBP Had Access to More than 80,000 Flock AI Cameras Nationwide privacy – Customs and Border Protection accessed over 80,000 Flock ALPR cameras across the U.S., revealing extensive data-sharing practices with local police departments unaware of the collaboration. https://www.404media.co/cbp-had-access-to-more-than-80-000-flock-ai-cameras-nationwide/

🛒 Auchan discloses data breach: data of hundreds of thousands of customers exposed data breach – Auchan reported a data breach affecting hundreds of thousands of customers, exposing personal information linked to loyalty cards, while assuring that sensitive banking data was not compromised. https://securityaffairs.com/181556/data-breach/auchan-discloses-data-breach-data-of-hundreds-of-thousands-of-customers-exposed.html

🆔 FBI, Dutch cops seize fake ID marketplace that sold identity docs for $9 cybercrime – Authorities have shut down VerifTools, a major marketplace for fake IDs, which facilitated identity theft and fraud. The seizure is seen as a significant blow against online crime. https://www.theregister.com/2025/08/28/fbi_dutch_cops_seize_veriftools/

🤖 Not in my browser! Vivaldi capo doubles down on generative AI ban privacy – Vivaldi's CEO opposes integrating generative AI in browsers, arguing it threatens user control and web diversity. He emphasizes prioritizing human interaction over automated solutions. https://www.theregister.com/2025/08/28/vivaldi_capo_doubles_down_on/

🕵️‍♂️ TransUnion says hackers stole 4.4 million customers’ personal information data breach – TransUnion has revealed a breach affecting 4.4 million customers, with sensitive data including names and Social Security numbers compromised. The company provides little clarity on the incident. https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information/

🚗 Security researcher maps hundreds of TeslaMate servers spilling Tesla vehicle data security research – A security researcher discovered over 1,300 publicly exposed TeslaMate servers leaking sensitive vehicle data, urging users to secure their dashboards to prevent unauthorized access. https://techcrunch.com/2025/08/26/security-researcher-maps-hundreds-of-teslamate-servers-spilling-tesla-vehicle-data/

🤦 OpenAI admits ChatGPT safeguards fail during extended conversations security news – OpenAI acknowledged failures in ChatGPT's safety measures during long conversations, which may lead to harmful guidance, following a lawsuit linked to a user's suicide after extensive interactions with the AI. https://arstechnica.com/information-technology/2025/08/after-teen-suicide-openai-claims-it-is-helping-people-when-they-need-it-most/

🔒 DOGE uploaded live copy of Social Security database to 'vulnerable' cloud server, says whistleblower data breach – A whistleblower claims the Department of Government Efficiency uploaded sensitive Social Security data to a vulnerable cloud server, risking the personal information of millions of Americans. https://techcrunch.com/2025/08/26/doge-uploaded-live-copy-of-social-security-database-to-vulnerable-cloud-server-says-whistleblower/

📄 Hackers use fake NDAs to deliver malware to US manufacturers cybercrime – Hackers are targeting U.S. manufacturers by using website contact forms to deliver malware disguised as non-disclosure agreements, maintaining engagement to appear credible and leveraging legitimate cloud services. https://therecord.media/hackers-fake-ndas-malware

🚴‍♂️ Developer Unlocks Newly Enshittified Echelon Exercise Bikes But Can't Legally Release His Software security news – An app developer jailbroke Echelon exercise bikes to restore offline functionality after a controversial firmware update, but copyright laws prevent him from legally sharing the software. https://www.404media.co/developer-unlocks-newly-enshittified-echelon-exercise-bikes-but-cant-legally-release-his-software/

💰 Euro banks block 'unauthorized' PayPal direct debits cybercrime – German banks froze billions in PayPal transactions due to unauthorized direct debits linked to a fraud-detection failure, impacting transactions primarily in Germany, though PayPal claims the issue is resolved. https://www.theregister.com/2025/08/28/euro_banks_block_paypal_direct_debits/

🛡️ 200 Swedish municipalities impacted by a major cyberattack on IT provider cybercrime – A cyberattack on Miljödata disrupted services across over 200 Swedish municipalities, raising concerns about stolen sensitive data and leading to a police investigation and reports of extortion. https://securityaffairs.com/181668/security/200-swedish-municipalities-impacted-by-a-major-cyberattack-on-it-provider.html

🎰 Affiliates Flock to ‘Soulless’ Scam Gambling Machine – Krebs on Security cybercrime – A new Russian affiliate program, Gambler Panel, has led to the rise of scam gambling sites that lure users with fake promotions and steal cryptocurrency deposits, operating under the guise of legitimate gaming. https://krebsonsecurity.com/2025/08/affiliates-flock-to-soulless-scam-gambling-machine/

🔒 WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware vulnerability – WhatsApp addressed a zero-click vulnerability (CVE-2025-55177) in its iOS and Mac apps, exploited alongside an Apple flaw to stealthily hack targeted users' devices, allowing data theft without interaction. https://techcrunch.com/2025/08/29/whatsapp-fixes-zero-click-bug-used-to-hack-apple-users-with-spyware/

---

Some More, For the Curious

🎣 Phishing Emails Are Now Aimed at Users and AI Defenses security research – New phishing tactics not only deceive users but also target AI defenses with hidden prompts, complicating automated threat detection and increasing risks. https://malwr-analysis.com/2025/08/24/phishing-emails-are-now-aimed-at-users-and-ai-defenses/

🔥 Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 vulnerability – Citrix's CVE-2025–6543 vulnerability, exploited for remote code execution, has led to severe breaches in Netscaler systems, highlighting a lack of transparency and response from Citrix. https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

🐳 Docker fixes critical Desktop flaw allowing container escapes vulnerability – Docker patched a critical vulnerability (CVE-2025-9074) in Docker Desktop that allowed attackers to escape containers and access the Docker Engine API, risking host file access. https://securityaffairs.com/181545/security/docker-fixes-critical-desktop-flaw-allowing-container-escapes.html

🗣️ With AI chatbots, Big Tech is moving fast and breaking people privacy – AI chatbots are creating harmful feedback loops for vulnerable users, validating false beliefs and grandiose fantasies, leading to serious psychological risks and an urgent need for regulation and user education. https://arstechnica.com/information-technology/2025/08/with-ai-chatbots-big-tech-is-moving-fast-and-breaking-people/

🔓 Widespread Data Theft Targets Salesforce Instances via Salesloft Drift vulnerability – A data theft campaign exploited OAuth tokens in Salesloft Drift to access Salesforce customer data, prompting security measures and warnings for all users to review integrations and credentials. https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift/

🕵️‍♂️ DSLRoot, Proxies, and the Threat of ‘Legal Botnets’ – Krebs on Security cybercrime – A Redditor's arrangement with DSLRoot, a residential proxy service, raises concerns about security risks, revealing the company's questionable origins and the emergence of 'legal botnets' exploiting residential connections. https://krebsonsecurity.com/2025/08/dslroot-proxies-and-the-threat-of-legal-botnets/

🔑 Goodbye Legacy MFA: Be Ready for the new Microsoft Authentication Methods Policy security news – Microsoft will retire legacy MFA and SSPR policies on September 30, 2025, transitioning to a unified Authentication Methods policy to enhance security and simplify management for organizations. https://www.guidepointsecurity.com/blog/goodbye-legacy-mfa-new-microsoft-authentication-methods-policy/

💻 First known AI-powered ransomware uncovered by ESET Research malware – ESET researchers discovered PromptLock, the first known AI-powered ransomware capable of exfiltrating and encrypting data, showcasing the potential for AI tools to enhance ransomware attacks. https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/

⚙️ Nx NPM packages poisoned in AI-assisted supply chain attack malware – Nx suffered a supply chain attack with malicious NPM packages that harvested developer credentials, exposing over 1,000 GitHub tokens and 20,000 files, utilizing AI tools for reconnaissance. https://www.theregister.com/2025/08/27/nx_npm_supply_chain_attack/

☎️ Experts warn of actively exploited FreePBX zero-day vulnerability – A serious zero-day vulnerability in FreePBX is being exploited, allowing unauthorized access to systems. Users are advised to update their software and restrict admin panel access. https://securityaffairs.com/181693/hacking/experts-warn-of-actively-exploited-freepbx-zero-day.html

🔒 Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE vulnerability – More than 28,200 Citrix NetScaler instances are vulnerable to the critical RCE flaw CVE-2025-7775, which is actively exploited, prompting CISA to mandate fixes by August 28, 2025. https://securityaffairs.com/181614/hacking/over-28000-citrix-instances-remain-exposed-to-critical-rce-flaw-cve-2025-7775.html

🔑 Unpacking Passkeys Pwned: Possibly the most specious research in decades security research – SquareX's claim of a major vulnerability in passkeys, dubbed 'Passkeys Pwned,' misrepresents the FIDO spec and highlights risks from compromised devices rather than the security of passkeys themselves. https://arstechnica.com/security/2025/08/new-research-claiming-passkeys-can-be-stolen-is-pure-nonsense/

💻 Ransomware gang takedowns causing explosion of new, smaller groups cybercrime – The ransomware landscape is rapidly evolving, with over 40 new gangs emerging due to law enforcement actions against larger groups, leading to increased fragmentation and a rise in smaller, independent operations. https://therecord.media/ransomware-gang-takedown-proliferation

---

CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has included three new vulnerabilities in its KEV Catalog due to active exploitation, highlighting significant risks to federal networks and the need for prompt remediation. https://www.cisa.gov/news-events/alerts/2025/08/25/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a new vulnerability, CVE-2025-7775, related to Citrix NetScaler, to its KEV Catalog, highlighting significant risks for federal networks and the need for prompt remediation. https://www.cisa.gov/news-events/alerts/2025/08/26/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-57819, an authentication bypass vulnerability in Sangoma FreePBX, to its Known Exploited Vulnerabilities Catalog due to active exploitation. https://www.cisa.gov/news-events/alerts/2025/08/29/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA issued three advisories on security vulnerabilities in Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/08/26/cisa-releases-three-industrial-control-systems-advisories ⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA issued nine advisories on August 28, 2025, detailing vulnerabilities and exploits affecting various Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/08/28/cisa-releases-nine-industrial-control-systems-advisories

🔍 Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System cybercrime – PRC state-sponsored cyber actors are targeting global networks, particularly in telecommunications and government sectors, employing sophisticated techniques to maintain long-term access and facilitate espionage, prompting a cybersecurity advisory from multiple agencies. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

On the 28th, somewhere after lunch, my father asked me to take a look at his computer because he couldn't find the bird program icon, as he calls Thunderbird. Keep in mind that he's over 60 years old, and he neither speaks English nor is computer-savvy.

I remembered the default installation profile for the Linux distro I set up on his desktop had it, so the program was there; he was just missing the shortcut on KDE's Plasma taskbar. I added the icon to the taskbar, then took the chance to explain to him how he can create and use email templates in Thunderbird for stuff he does regularly, like asking for prescriptions. To be honest, I think the only part he memorized was how to use the one I created for him. 😅 Before going back to my room to rest from a massive headache, I took care of some more stuff, like setting up filtering rules on the server side because he receives a lot of spam that passes Gmail's filters. I suspect this is because he's been using email for a while to contact suppliers to find parts for appliances, machinery, etc, he fixes at home, and I wouldn't be surprised if some of those companies didn't even consider customer information security. We're talking small companies that likely still have a Windows XP or Windows 7 computer connected to the internet somewhere in the office...

As I was setting up the filters, it occurred to me he's been using Thunderbird for 99.999% as long as he has been doing email, i.e., for over a decade, probably a decade and a half. There were times I installed other email clients for him to try; I wanted him to see if he liked any of them, so I could set up one in case any issues arose in Thunderbird. As far as I remember, I at least installed Kmail, Claws Mail, and Geary. He even tried webmail!

I don't mean to diss any of these email clients, but that man only likes Thunderbird! On his desktop, no matter the operating system we put in it, two applications must always be installed: 1) Thunderbird, 2) Firefox. In that order! I'm not overselling it. His computer must always have these two, no exceptions, particularly with Thunderbird! He may try to deal with another web browser, although he loves Firefox because I always set up uBlock Origin, and he rarely sees an ad, even on YouTube. But for email, it's either Thunderbird or Thunderbird. 😁

When I got back to my bedroom, I decided to share this on the Fediverse because I found it funny and sweet. I also tagged the Thunderbird's account because I know, from my time working in customer support and managing the community side of Fosshost's, that it's good to receive, for a change, more than just complaints and entitlement as... let's call it feedback...

Then, I waited for the headache to alleviate.

In the meantime, Thunderbird replied with a kind message. Moments later, someone from the team, Monica Ayhens-Madon, reached out and asked for my father's address so they could send him a few stickers.

I stayed in bed until I had to get up and prepare dinner. By the time I got up, because my head was still hurting, I forgot to check my phone and missed the messages. Close to finishing the cooking, I grabbed it to text the wife and noticed I had notifications on Mastodon. That's when I saw the messages.

Minutes later, my father arrived home from a late afternoon bakery run. I told him about this and translated the messages to him. He was so flabbergasted and even a little blushed! 😊

He asked me to accept the offer and to send his appreciation for the offer and for creating his favourite computer program.

But the smile this left on his face...! Unaware, Thunderbird and Monica made my father's day! He'd been feeling sick and down for a few days, but when I told me about this, he smiled and his face lit up. It was freaking awesome!

Thank you so much to Thunderbird and to Monica! ❤️

#Thunderbird #Community #OpenSource

Cracked open an Elijah Craig Barrel Proof batch A125. It's a 10 year, 7 month aged product weighing in at 118.2 proof.

Smell some cinnamon, oak, and hints of cardamom and amburana.

First sip, sans water or ice—which I'm sure I'll need!—, reminds me of amburana aged whiskies. Some leather. Didn't pick up a lot of strong flavors. The swallow is fire. Moving straight to some water! LOL.

After adding some filtered water, I pick up some caramel creme brûlée. The heat dies down, but still lingers. Smell of amburana has intensified—which may or may not be psychosomatic, I really like the smell. Next sips pick up some cherry. The finish seems to hint at some citrus. Still quite hot, so time to try out some ice.

Smells much sweeter after adding some ice... ...honey, maybe? Pick up more cherry with a “brighter” sip. The finish is reminiscent of a cab or a Barolo. Not the tannin bit.

An interesting dram. Off to just enjoy it.

Cheers!

পৃথিবী তার নিজস্ব নিয়মে চলছে। সূর্য ওঠছে, আবার নিয়ম মেনে অস্ত যাচ্ছে; রাত নামছে, ফের ভোর আসছে; মানুষ আসছে-যাচ্ছে, বাঁচছে-মরছে; সবকিছু আগের মতোই চলছে। কিন্তু আমার কাছে পৃথিবীর রূপ আর আগের মতো নেই। পৃথিবীটাকে আমি আর আগের চোখে দেখতে পারি না। কারণ এই পৃথিবীতে জীবনধারণের ধরণ বদলে গেছে। সম্পর্কের ধরন পাল্টে গেছে, বিশ্বাসের ভিত্তি নড়ে গেছে, আর ভরসার জায়গাগুলো ফাঁকা হয়ে গেছে।

আমি ভেবেছিলাম- কষ্ট গুলো ধীরে ধীরে মুছে যায়, সময়ের সাথে সাথে ক্ষতস্থান শুকিয়ে আসে। কিন্তু বাস্তবতা আমাকে অন্য শিক্ষা দিয়েছে। কষ্ট আসলে কখনোই মুছে যায় না, ম্লান হয়ে বিবর্ণও হয় না; বরং সময় তাকে আরও প্রকট ভাবে দৃশ্যমান করে তোলে। যত দিন যায়, কষ্ট তত গভীরভাবে হৃদয়ে গেঁথে বসে। ক্ষণিকের আঘাত সময়ের প্রবাহে গাঢ় ক্ষতচিহ্নে পরিণত হয়, আর সেই দাগ চিরস্থায়ী হয়ে যায়।

মানুষের প্রতি বিশ্বাস, ভরসা আর সম্মান- যা একসময় আমার কাছে অবিচল সত্য মনে হয়েছিল; এখন ক্রমেই ক্ষয়ে যাচ্ছে। জীবনের অভিজ্ঞতা আমাকে শিখিয়েছে, মানুষকে সহজভাবে বিশ্বাস করা ছিল মস্ত ভুলের একটি। আমি যাদের কাছে আদর্শ খুঁজি, যাদের চোখে সাধুতা দেখি, তাদের ভেতরে আসলে এমন কিছু নেই। সবাই প্রয়োজনের খাতিরে সাধু হয়, আর প্রয়োজন ফুরোলেই সাধু ভং ধরা মুখোশটা খুলে কুটিলতায় ভরা প্রকৃত মুখটি প্রকাশ করে। মানুষের এই দ্বিমুখী চরিত্র এত কাছ থেকে না দেখলে হয়ত কখনো বিশ্বাস করতাম না।

এই অল্প কয়েকদিনে জীবনের আরেকটি কঠিন সত্যও উপলব্ধি করেছি। যে সকল মানুষের হৃদয়ের ভেতর কুটিলতা ভর করেছে, যাদের হৃদয় কালশিটে ময়লা পড়ে পচে গেছে, যাদের চিন্তাধারায় কুটিলতা আর অনিষ্ট ছাড়া ভিন্ন কিছু কাজ করে না; তাদের সাথে আপনি যতই ভালো ব্যবহার করেন না কেন, যতই ধৈর্য ধারে সহ্য করে সমস্যার সমাধান খুঁজতে চান না কেন, কোনো লাভ নেই। তাদের স্বভাব পাল্টায় না, পাল্টাবার নয়। এদের মোহর লাগানো হৃদয়ের কথাই ওপরওয়ালা আমাদের বলেছেন, বিধাতার হুকুম ছাড়া এই মোহর আর কখনোই পরিষ্কার হবে না। বরং এই কুটিলতায় পূর্ণ নরকের কীট গুলো খুঁজে খুঁজে আপনার দুর্বলতা বের করে আপনাকে আরও গভীর সমস্যায় ফেলে দেবে।

আমার শূন্য হয়ে পড়া পৃথিবীটার বয়স আজ ১০১ দিন। ঠিক ১০০ দিন পূর্বে আমার আম্মা এই পৃথিবী থেকে বিদায় নিয়ে আপন শান্তির নিবাস খুঁজে নিয়েছেন। দিন হিসেবে ১০০ দিন খুব নগণ্য হলেও এই ১০০ দিনের পৃথিবী আমাকে এমন এক বাস্তবতার মুখোমুখি করেছে, যেখানে নেই মায়ের মমতা, নেই সেই নির্ভরতার ছায়া। আছে কেবল ভান করা মায়া, সমাজের সামনে যাত্রা-নাটক প্রদর্শন করার মতো ভদ্রতা, আর স্বার্থের ফাঁদে জড়িয়ে থাকা সম্পর্ক। এই ১০০ দিনেই ‘পরিচিত’ আর ‘কাছের’ নামধারী সম্পর্ক গুলো চোখের পলকেই গিরগিটির মত নিজ নিজ রঙ বদলে নিয়েছে।

আমি কখনো ভাবিনি আম্মা আমাদের এত দ্রুত ছেড়ে চলে যাবেন। আমি ভেবেছিলাম আম্মা অন্তত আরও বিশটি বছর আমাদের সঙ্গে থাকবেন। আম্মার ছায়াশীতল মমতা আমাদের আগলে রাখবে, তার ভরসার আঁচল আকাশ হয়ে থাকবে মাথার উপরে। কিন্তু হঠাৎ করেই সবকিছু থেমে গেল। যে মানুষটির অবলম্বনে ভরসার স্তম্ভ ভেবে নিয়েছিলাম, তিনি হঠাৎ করেই পৃথিবী ছেড়ে চলে গেলেন। আর তার অনুপস্থিতি আমার হৃদয়ে এক বিশাল অবিশ্বাসের দেয়াল তুলে দিল।

আজ মনে হয়, ছোটবেলা থেকে যে মূল্যবোধের শিক্ষা পেয়েছিলাম, সেগুলো আসলে বাস্তব জীবনে অকার্যকর। সততা, নীতিকথা, সত্য-বচন -এসব আঁকড়ে ধরে আমি শুধু পিছিয়েই পড়েছি। আর চারপাশের মানুষগুলো নিজেদের স্বার্থের জন্য কোনোকিছু করতে দ্বিধা করেনি। এই ১০০ দিনে আমি দেখেছি রক্তের সম্পর্কও কেমন করে বিশ্বাসঘাতক হয়ে যায়। যাদের একসময় নিজের বলতে শিখেছিলাম, যাদের আপন ভেবে স্বস্তি আর মনের তৃপ্তি বুঝে নিতাম; তারাই স্বার্থ হাসিলে বেইমান হয়ে উঠেছে। মানুষ যে এতটা স্বার্থপর হতে পারে, এতটা নিষ্ঠুর হতে পারে, এত বড় মাপের নিমকহারাম হতে পারে; এমন করে না দেখলে কখনোই বিশ্বাস করতাম না।

সব আক্ষেপ, সব হতাশা, সব কষ্ট আর সব বেদনার শেষে আমার একমাত্র প্রার্থনা- মহান আল্লাহ যেন আমার আম্মাকে পরিপূর্ণ শান্তি দান করেন। তিনি যেন হাসরের ময়দানে আম্মাকে হাউজে কাউসারের শীতল পানীয় দিয়ে তৃষ্ণা নিবারণ করান। আর জান্নাতুল ফেরদৌসকে আম্মার জন্যে স্থায়ী আবাস হিসেবে ঘোষণা করে দেন।

আমার জীবন আজ শূন্যতায় ভরা। কিন্তু সেই শূন্যতার ভেতরও আমি মায়ের শান্তির জন্য হৃদয়ের অন্তঃস্থল হতে দোয়া করি। কারণ আমার সমস্ত বিশ্বাস, ভরসা আর আশ্রয় এক মানুষেই ছিল -আমার আম্মা। আর আজ তিনি নেই… ১০১ দিন।

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

---

News For All

🚦 Dutch prosecution service attack keeps speed cameras offline cybercrime – A cyberattack on the Dutch Public Prosecution Service has left numerous speed cameras offline. While the attack didn't target the cameras directly, it hampers their reactivation due to system interconnectivity. https://www.theregister.com/2025/08/15/cyberattack_on_dutch_prosecution_service/

🎟️ Gefälschtes Gewinnspiel für Wiener Linien Jahreskarte im Umlauf warning – Fake Facebook posts are promoting a bogus contest for a Wiener Linien half-year ticket. The scam aims to steal credit card and personal information through a deceptive website. https://www.watchlist-internet.at/news/gefaelschtes-gewinnspiel-fuer-wiener-linien-jahreskarte-im-umlauf/

🔒 Multiple Vulnerabilities in Microsoft Products warning – Microsoft's August 2025 Patch Tuesday advisory addresses 111 security vulnerabilities, with 16 critical ones. Users are urged to update systems promptly, especially public-facing assets. https://cert.europa.eu/publications/security-advisories/2025-032/

🤖 Grok Exposes Underlying Prompts for Its AI Personas: ‘EVEN PUTTING THINGS IN YOUR ASS’ security research – Elon Musk's AI chatbot Grok has revealed prompts for its various personas, including a conspiracist character. This exposure raises concerns about the chatbot's design and potential influence on users. https://www.404media.co/grok-exposes-underlying-prompts-for-its-ai-personas-even-putting-things-in-your-ass/

🔓 HR giant Workday says hackers stole personal data in recent breach data breach – Workday confirmed a data breach involving the theft of personal information from a third-party database, raising concerns about potential social engineering scams. Details on affected individuals remain unclear. https://techcrunch.com/2025/08/18/hr-giant-workday-says-hackers-stole-personal-data-in-recent-breach/

🔐 Allianz Life data breach affects 1.1 million customers data breach – A data breach at Allianz Life has compromised the personal information of 1.1 million customers, including Social Security numbers. The breach is linked to the hacking group ShinyHunters. https://techcrunch.com/2025/08/18/allianz-life-data-breach-affects-1-1-million-customers/

🔑 UK drops demand for backdoor into Apple encryption privacy – The UK government has abandoned its demand for a backdoor into Apple’s encryption, potentially allowing Apple to restore Advanced Data Protection (ADP) iCloud encryption services in the UK. https://www.theverge.com/news/761240/uk-apple-us-encryption-back-door-demands-dropped

🚓 Speed cameras knocked out after cyber attack security news – A cyberattack on the Netherlands' Public Prosecution Service has rendered many speed cameras inoperable, impacting road safety and delaying legal proceedings as the organization remains offline. https://www.bitdefender.com/en-us/blog/hotforsecurity/speed-cameras-knocked-out-after-cyber-attack

🎤 Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator cybercrime – Authorities have taken control of the powerful Rapper Bot DDoS botnet and charged its developer, Ethan Foltz, with aiding computer intrusions. The botnet conducted over 370,000 attacks worldwide since 2021. https://cyberscoop.com/rapper-bot-ddos-botnet-disrupted/

💊 Pharmaceutical firm Inotiv discloses ransomware attack. Qilin group claims responsibility for the hack data breach – Inotiv has reported a ransomware attack that encrypted systems and disrupted operations. The Qilin group claimed responsibility, alleging they stole 176GB of data from the firm. https://securityaffairs.com/181311/data-breach/pharmaceutical-firm-inotiv-discloses-ransomware-attack-qilin-group-claims-responsibility-for-the-hack.html

⚠️ Critical Chrome Flaw CVE‑2025‑9132 Exposes Browsers to Remote Code Execution vulnerability – A remote code execution flaw in Google Chrome, CVE-2025-9132, was discovered in the V8 JavaScript engine, allowing attackers to execute arbitrary code. Users are urged to update to version 139.0.7258.138 or later to mitigate risks. https://thecyberexpress.com/chrome-v8-vulnerability-cve%E2%80%912025%E2%80%919132/

🍔 McDonald's not lovin' it when hacker exposes rotten security security news – A white-hat hacker uncovered severe security flaws in McDonald's portals, enabling free food orders and access to sensitive data. The company has since made some fixes but still lacks a proper security disclosure process. https://www.theregister.com/2025/08/20/mcdonalds_terrible_security/

🤦‍♂Researcher Exposes Zero-Day Clickjacking Vulnerabilities in Major Password Managers vulnerability – A researcher revealed serious clickjacking vulnerabilities in popular password managers, enabling hackers to easily steal sensitive data if users visit malicious sites. Many remain unpatched. https://socket.dev/blog/password-manager-clickjacking

📞 Major Belgian telecom firm says cyberattack compromised data on 850,000 accounts data breach – Orange Belgium reported a cyberattack that compromised data from 850,000 customer accounts, including names and phone numbers. No critical data like passwords or financial details were hacked. https://therecord.media/belgian-telecom-says-cyberattack-compromised-data-on-850000

👓 Harvard dropouts to launch 'always on' AI smart glasses that listen and record every conversation privacy – Former Harvard students are launching Halo X, AI-powered smart glasses that record conversations and provide real-time information. Privacy advocates raise concerns about covert recording and consent laws. https://techcrunch.com/2025/08/20/harvard-dropouts-to-launch-always-on-ai-smart-glasses-that-listen-and-record-every-conversation/

📸 'Screenshot-grabbing' Chrome VPN extension still available privacy – The FreeVPN.One Chrome extension has been found capturing users' screenshots and sending them to a remote server without consent. Despite warnings, it remains available on the Chrome Web Store. https://www.theregister.com/2025/08/21/freevpn_privacy_research/

🕵️‍♂️ Hackers who exposed North Korean government hacker explain why they did it cybercrime – Two hackers infiltrated a North Korean government hacker's computer, uncovering evidence of cyberespionage. They decided to leak their findings to expose the operations and help victims, despite legal risks. https://techcrunch.com/2025/08/21/hackers-who-exposed-north-korean-government-hacker-explain-why-they-did-it/

🔒 Apple rushes out fix for active zero-day in iOS and macOS vulnerability – Apple released emergency updates for a zero-day vulnerability in its ImageIO framework, allowing potential device hijacking through malicious image files. The flaw has reportedly been exploited in targeted attacks. https://www.theregister.com/2025/08/21/apple_imageio_exploit/

🎥 Real Footage Combined With AI Slop About DC Is Creating a Disinformation Mess on TikTok security news – TikTok is flooded with misleading videos combining real and AI-generated footage about the National Guard's actions in D.C., complicating viewers' ability to discern truth from misinformation amidst a trending disinformation campaign. https://www.404media.co/real-footage-combined-with-a-ai-slop-about-dc-is-creating-a-disinformation-mess-on-tiktok/

🔍 Criminal background checker APCS faces data breach data breach – Access Personal Checking Services (APCS) is managing a data breach linked to a third-party developer, Intradev, which compromised customer data including personal details. An investigation is ongoing. https://www.theregister.com/2025/08/22/apcs_breach/

🚨 Europol says Telegram post about 50,000 Qilin ransomware award is fake cybercrime – A fake Telegram post claimed Europol was offering a $50,000 reward for information on Qilin ransomware gang members. Europol confirmed the announcement was false and originated from a newly created account. https://www.bitdefender.com/en-us/blog/hotforsecurity/europol-says-telegram-post-about-50-000-qilin-ransomware-award-is-fake

🏥 DaVita tells 2.4M people ransomware scum stole health data data breach – DaVita confirmed a ransomware breach affecting 2.4 million individuals, compromising sensitive health and personal information. The Interlock ransomware gang is suspected to be behind the attack. https://www.theregister.com/2025/08/22/davita_ransomware_infection/

---

Some More, For the Curious

🏢 Coinbase CEO says he's mandating in-person orientation to combat North Korean hackers seeking remote jobs security news – Coinbase is shifting to in-person orientations to prevent North Korean hackers from exploiting remote work. New policies include US citizenship requirements and stricter security measures. https://www.businessinsider.com/coinbase-north-korea-threats-remote-work-2025-8

🎭 How attackers are using Active Directory Federation Services to phish with legit office.com links security research – Phishers exploit Microsoft services by redirecting users from legitimate links to malicious sites, utilizing techniques like ADFSjacking. This complicates detection efforts and highlights the growing threat landscape. https://pushsecurity.com/blog/phishing-with-active-directory-federation-services/

🔍 How Researchers Collect Indicators of Compromise cyber defense – Security researchers analyze malware like Snake Keylogger to gather indicators of compromise and create detection signatures. They focus on exfiltration techniques and utilize tools to improve threat detection. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/how-researchers-collect-indicators-of-compromise/

📡 Boffins release 5G traffic sniffing tool security research – Researchers have launched Sni5Gect, an open-source tool for sniffing 5G traffic and executing connection downgrade attacks. It exploits vulnerabilities in pre-authentication communication to inject malicious payloads. https://www.theregister.com/2025/08/18/sni5gect/

⚠️ New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes vulnerability – A newly discovered HTTP/2 DoS vulnerability, CVE-2025-8671, allows attackers to bypass concurrency limits, causing denial of service. Vendors are rapidly addressing the flaw, which affects unpatched server implementations. https://thecyberexpress.com/new-http-2-dos-vulnerability/

🩹 Apache ActiveMQ attackers patch critical vuln after entry security news – Attackers exploiting a critical Apache ActiveMQ vulnerability have installed malware called DripDropper to maintain persistence on infected Linux servers and subsequently patched the original flaw. https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/

🤳 Stop Spoofing Yourself! Disabling M365 Direct Send cyber defense – Threat actors are exploiting Microsoft 365's Direct Send feature to spoof emails within organizations. Users can now disable Direct Send with a simple command, enhancing security against these attacks. https://www.blackhillsinfosec.com/disabling-m365-direct-send/

🧷 Commvault releases patches for two pre-auth RCE bug chains vulnerability – Commvault has patched two critical remote code execution vulnerabilities following their disclosure by researchers. Users are urged to update immediately, as the flaws could allow unauthenticated attackers to gain admin access. https://www.theregister.com/2025/08/20/commvault_bug_chains_patched/

🚗 Inside the Underground Trade of ‘Flipper Zero’ Tech to Break into Cars security research – The Flipper Zero device, known for its hacking capabilities, is being used in an underground market to unlock various car models, with hackers selling software to exploit vulnerabilities. https://www.404media.co/inside-the-underground-trade-of-flipper-zero-tech-to-break-into-cars/

🖼️ Honey, I shrunk the image and now I'm pwned vulnerability – Researchers at Trail of Bits revealed that image scaling attacks can exploit Google Gemini and other AI systems, allowing hidden prompts to exfiltrate data. Google downplays the issue, citing non-default configurations. https://www.theregister.com/2025/08/21/google_gemini_image_scaling_attack/

🔒 Microsoft cuts off China's early access to bug disclosures security news – Microsoft has halted providing proof-of-concept exploit code to Chinese companies in its MAPP program following exploitation of SharePoint vulnerabilities. The change aims to prevent leaks and improve security measures. https://www.theregister.com/2025/08/21/microsoft_cuts_chinas_early_access/

---

CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA added a new vulnerability in Trend Micro Apex One to its Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/news-events/alerts/2025/08/18/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA added a new vulnerability in Apple iOS, iPadOS and macOS to its Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/news-events/alerts/2025/08/21/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA issued four advisories detailing vulnerabilities in Industrial Control Systems by Siemens, Tigo and EG5. https://www.cisa.gov/news-events/alerts/2025/08/19/cisa-releases-four-industrial-control-systems-advisories ⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA issued three advisories detailing vulnerabilities in Mitsubishi Electric systems and FUJIFILM Healthcare's Synapse Mobility. https://www.cisa.gov/news-events/alerts/2025/08/21/cisa-releases-three-industrial-control-systems-advisories

---

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

This is something that I posted in r/MrRobot nearly a decade ago, in real-time after this particular episode dropped. I was living in Shanghai's French Concession, on the other side of the highway from Jing'an Temple, which is near where I mention a bookstore below. I'm putting it here because it was fun to write, and it still gives a little snapshot of the show and of China. I'm also now only on Reddit when I'm searching for a technical solution, or barring that, to share in similar unresolved misery, so I've been meaning to archive a few things from there. Now that the show is currently on Netflix seems appropriate timing.

The original post lives here

[Spoilers S02E04] About that red dress Whiterose showed, plus movie and literary references

A couple weeks ago I popped in to the boutique where Whiterose said she bought the red qipao that she showed to Dom. The place is called Jin Zhi Yu Ye, on Maoming Road in Shanghai, on a strip known for its qipaos. The designer is famous, and her shop is one of the top two places to get a qipao in the city. The English sign outsides says Leaves, but Whiterose called it by its Chinese name (though she says it with another final word/syllable that's not in the CC/subtitles)

Disappointingly, the clerks didn't know of Whiterose, or BD Wong. I played the clip for them, though, and off the rack they showed me a similar red qipao but sleeveless, for 5,000RMB, or about US$750, then a black one that was really close but with longsleeves, going for just under 7,000RMB. These are all handmade, and if you're interested in these things and have pricy tastes, they mostly do custom jobs that can run up to 10,000RMB. As is normal here, they stopped me from taking any photos inside, so you're stuck with a potato-quality snap of the window display.

But the shop name! It was little hint that Whiterose dropped, maybe intentionally, for Dom. Jin Zhi Yu Ye literally translates to Golden Branch, Jade Leaves. I asked a Chinese friend about any other meanings, and she said it's just words put together for a name, not an idiomatic phrase or poetic reference. She did say that it has a connotation of extravagance and royal lifestyle. More interesting, though, is that it's the Mandarin pronunciation of a hit 1990s romantic comedy from Hong Kong, 金枝玉葉. English title: “He's a Woman, She's a Man.” The movie was packed with stars. It's good, kinda over-the-top at times, but pretty standard for that time, place and genre. It was also applauded for bringing out discussion of LGBT life to a wider audience. The male lead, Leslie Cheung, had already starred in two gay-themed arthouse films that pulled awards at Cannes (“Days of Being Wild” by Wong Kar Wai and “Farewell My Concubine,” just the year before this one).

The basic story of “He's a Woman, She's a Man” is of a female fan who idolizes a pop star singer and her male producer, played by Cheung. The musicians are rumored to be dating, and they are, but they're not that happy. In a fight, the singer challenges the producer to turn an amateur into a star. They hold contest auditions, and the fan, played by Anita Yuen, dresses up as a man to enter. She wins, and during the course of writing and recording with the producer, the two start falling for each other. Hilarity and questions of self ensue, yadda yadda. Notable makeout scene, though, where an IRL gay actor is playing a straight man who's conflicted about kissing a woman who's playing a man, and the scene is convincingly hot. Head asplode.

[Edit note for 2025, and trigger warning self-harm: Leslie Cheung was IRL very close friends with another Anita, singer and actress Anita Mui. Their friendship naturally featured prominently in the 2021 biopic “Anita,” which I unexpectedly happened to catch on in-flight entertainment. It could've been a decent movie, but that's entirely washed away by glaring omissions: the part that homophobia played in Leslie Cheung's clinical depression and suicide, as well as Anita Mui's activism, especially in remembrance of Tiananmen Square.]

But back to the closet, there was another breadcrumb Whiterose dropped. She shows Dom two garments; before the qipao/cheongsam, she pulls out a long, sleeveless piece, telling Dom it's a magua, common in the Qing dynasty, which ended in 1911. She notes that the embroidery was meant for royal families. It kinda looks like a dress, and a normal magua would just be a common riding jacket, which were made for men and women. But the yellow magua (not just the color, but what it's called) was for high-ranking officials and bodyguards. Which means men. And then she showed the qipao/cheongsam.

Besides this, the scene might have a little extra poignance in a literary reference. Shanghai was home to one of China's most important contemporary fiction writers, Eileen Chang. Her old apartment has a historical marker for her on it, and a fancy bookshop cafe on the ground floor sells $8 Americanos. When I visited for this post, they were out of the English version of one of her more notable novellas: “Red Rose, White Rose”. It's about a self-made man who likes control and order and has a storybook good life, well-rewarded for doing all the right things. He's married to a good woman, the White Rose, but there's another in his life, the wild and carefree Red Rose. No surprise, he's torn between the chaste and the passionate. The Cliff's Notes key quote:

Marry a red rose and eventually she'll be a mosquito-blood streak smeared on the wall, while the white one is “moonlight in front of my bed”. Marry a white rose, and before long she'll be a grain of sticky rice that's gotten stuck to your clothes; the red one, by then, is a scarlet beauty mark over your heart.

Thinking of this put a new spin on the Beijing visit. Grace Gummer has said in interviews that she dyed her hair for the show. Red Rose? I did try to ask; I emailed the address from Dom's business card shown onscreen with the subject “You're the Red Rose,” but I never even got the autoreply.

And then last on this, there's Eileen Chang herself. Of course, that's her Western name, but her name in Chinese is Zhang Ai-ling, maybe a namesake to Whiterose's public-facing identity as Minister Zhang.

I'll be psyched if any of this is actually on the trail. (popping out of the original reddit post to say here now on infosec.press, wow, this is so amusing and embarrassing that I wrote this this way. But that was what it was like at the time. People got swept up big playing detective on shows that had these so-called alternate reality game elements. I remember consciously getting off Reddit shortly after because of all the bonkers theorizing.) I very much would like to see the China angles being rooted in or referencing real stuff. I know you'd have to go with a fictional character for the story, but Zhang is the minister of state security, which is a real person here. Contrast that with Price talking to (then) Speaker of the House John Boehner and meeting in DC with Treasury Secretary Jack Lew, Federal Reserve Chair Janet Yellen and SEC Chair Mary Jo White. And that's all plausible. The 'real' Zhang is Geng Huichang. Unless the future storyline has some cool twists, there's no way he's working with, let alone leading, a hacker group (also now popping back out to 2025 to again say, wow, time has moved on). And in the role as minister, I don't think that diplomatically, Zhang would meet with an FBI team; at that level of an official, among nations of more or less the same “power,” meetings are between counterparts, and subordinates handle the rest. But anyway, while the minister is a big role in an important institution, it's not the biggest; arguably, that's the party secretary. But that gets into China politics, which right now in intelligence is getting really shaken up, but overall it's probably too much inside baseball.

Regardless, the show is dope, and being here I do get an extra kick out of the China parts. Just before posting this, I wanted to bounce some of this intelligence stuff in general off a Chinese friend, and found myself describing the show to her. And then:

Me: “You can find the whole first season on Youku.”

Her: “Oh, so it's not banned?”

Me: (pause) “Maybe the second season.”

TL;DR The shop where Whiterose bought the qipao she showed to Dom is also the title of a Hong Kong movie whose English title is “He's a Woman, She's a Man”. Also, there's a book called “Red Rose, White Rose,” written by Zhang Ai-ling. And Grace Gummer dyed her hair red for this show.

প্রায়ই আমার এই শহরের ভিড় থেকে পালাতে ইচ্ছা করে। এই যে অলিগলি রাস্তা জুড়ে হাজর মানুষের হাঁটা-চলা, যান্ত্রিক জীবনের অনবরত শব্দ; এসবের মাঝে নিজেকে আমার দারুণ বন্দী মনে হয়। যদিও খেয়ে-পড়ে বেঁচে থাকার জন্যই এই শহর জীবন, কিন্তু সে তো আমাকে মুক্ত ভাবে শ্বাস নিতে দেয় না। কংক্রিটের এই জঙ্গলে দাঁড়িয়ে প্রতিদিন মনে হয়, আমি ভুলে যাচ্ছি মুক্ত জীবনের স্বাদ। হয়ত এই কারণেই মনে মনে ইচ্ছে হয় কোন এক হাঁটা-পা এর রাস্তা ধরে অচেনা কোন গহিন বনে হারাতে। আঁকাবাঁকা পথ, পাতায় ঢাকা, রঙে রঙে মোড়া পথ, কোলাহল বিহীন সেই পথে হেঁটে বেড়াতে। সেই বন আর বনের পথটি হবে একান্তই আমার নিজের।

শহরে বুকে কখনো যে গন্ধ মিলে না, সেই গন্ধে ভরে থাকবে আমার সেই বুনো পথ। মাটির কাঁচা গন্ধ, ঝড়া পাতার অচেনা সুরভি, আর হয়ত কোন অদৃশ্য ফুলের মৃদু সুবাস। সেখানে শ্বাস নিতে গিয়ে মনে হবে- আমি বেঁচে আছি, সত্যিই বেঁচে আছি। শহরের ধোঁয়া, গ্যাস, বর্জ্য কিংবা কৃত্রিম সুবাস এই সবই সেখানে থাকবে কেবলই এক দুঃস্বপ্ন হয়ে।

বনের গভীর নিস্তব্ধতাকে আগলে নেবো নিজের অস্তিত্বের সাথে। সেখানে থাকবে না এলোমেলো ব্যস্ত পদচারণা, থাকবে না কুৎসিত হর্ন, থাকবে না ট্র্যাফিক জ্যাম, থাকবে না পিচের গরম। থাকবে কেবল পাখির ডানা ঝাপটানোর শব্দ, থাকবে শুকনো পাতার উপর দিয়ে দৌড়ে যাওয়া অচেনা কোন প্রাণীর পদচারণা, থাকবে বাতাসের ফিস‍্‍‍ফিসানি আর থাকবে অন্তর জুড়ানো গাছের ছায়া। এই সবই প্রকৃতির আপন স্পর্শ, এগুলোই পৃথিবীর আসল ভাষা; যা আমরা ভুলে গেছি এই কোলাহলে মত্ত হয়ে।

ফ্লুরোসেন্টের আলোর নিচে বসে এখন আমি এক অন্ধকার পৃথিবী দেখি। এই আলো হৃদয়ের গহিন কোণকে আলোকিত করতে পারে না। অথচ আমার সেই অরণ্যে খেলা করে বিস্ময়ের আলো নিয়ে। পাতার ফাঁক গলে যখন সূর্যের আলো যখন মাটির গায়ে পড়ে, মনে হয় যেন ছোট ছোট আলোর কণা মিছিল করছে সেখানে। আবার মাঝে মাঝে আলোর রশ্মি গুলো এমন এক বিভ্রম তৈরি করে, যেন মনে হয় সেখানে রয়েছে এক আলোর ঝলমলে দেয়াল। দেয়ালের ওপারে রয়েছে অন্য এক জগৎ, যেখানে নেই কোন দায়িত্ব, নেই কোন দৌড়ঝাঁপ, নেই কোন একঘেয়েমি। শুধু শান্তি- নির্মল, অনাবিল শান্তির বাস সেখানে।

এই যে শহরজুড়ে গায়ের সাথে গা ঘেঁষে তৈরি হয়েছে আকাশছোঁয়া দালানের জঞ্জাল। একের পর এক বিল্ডিং, যার জানালা দিয়ে নিচে তাকালে কেবল দেখা মেলে ছুটে চলা শহর, ধুলো, কালো ধোঁয়া আর মেকি জীবনের দৌড়ঝাঁপ। এখানকার প্রতিটি দালান, প্রতিটি ফ্ল্যাট, প্রতিটি খোপ-খোপ রুম যেন এক একটি কারাগার। জীবনের মায়ায় অন্ধ হওয়ার দোষে সবাইকে সেই কারাগার যাপনের আদেশ দেয়া হয়েছে এখানে। অথচ আমার বনে প্রতিটি গাছই জানালা, প্রতিটি পথ মুক্তির, আর বহমান বাতাসে বাজে জীবনের সুর।

আমার ভেতরের আমিটা বারবার বলে উঠে- “বারবার হারিয়ে যাও তোমার আরণ্যের গভীর থেকে গভীরে; ক্লান্তি ঘিরে ফেলার আগ পর্যন্ত হেঁটে বেড়াও আঁকাবাঁকা পথটি ধরে।” হয়ত কোনো একদিন সত্যিই সব ছেড়ে দিয়ে চলে যাবো। খুঁজে বের করবো আমার সেই প্রিয় বনটিকে অজানা কোন প্রান্তে। যেখানে আমার সাথে থাকবে কেবল ‘আমি’। গাছ, পাখি, পো‌ঁকা আর মাটি -সবাই মিলে ঘুচিয়ে দিবে আমার হৃদয়ের অসীম নিঃসঙ্গতা।

তখন আর আমি এই শহুরে মানুষ থাকবো না; আমি হবো বনের সন্তান…

⠀⠀⠀⠀

⠀⠀⠀⠀

⠀⠀⠀⠀

ছবি-সূত্রঃ u/myriyevskyy

প্রথম ভাগঃ প্রারম্ভিকা

জানোই তো, ঘুম হল এক ধরনের প্রতারণা। ক্লান্ত হলে বিশ্রাম নিতে তুমি চোখটা বন্ধ কর, ধীরে ধীরে তোমার শরীর শিথিল হতে শুরু করে। হৃৎস্পন্দন কমে আসে, কমে আসে শরীরের তাপমাত্রা। তুমি তখন নিজেকে নিরাপদ ভেবে নিশ্চিন্ত মনে ঘুমাতে শুরু কর।

আর ঠিক সেই সময়টাতেই তোমার বুকের উপর এমন কিছু একটা উঠে বসে, যার অস্তিত্বের কথা তোমার জানা নেই! তবে আমি জানি, কারণ আমি তো সেটা দেখেছি। আচ্ছা চল, তোমাকে আমার ঘটনাটা বলি, তাহলেই তুমি বুঝতে পারবে আমি কীসের কথা বলছি। প্রথম রাতে আমি শুধু একটা মৃদু শব্দ শুনতে পেয়েছিলাম। শব্দটা মৃদু হলেও তার তীক্ষ্ম একটা অনুভূতি আমাকে ছুঁয়ে দিয়েছিল। নিঃশ্বাসের শব্দ ছিল সেটি। অন্ধকারে, ঠিক আমার বিছানার কোণ থেকে শব্দটা হয়েছিল। কেমন একটা ঠান্ডা, গভীর, লম্বা একটা টান। আমি ভেবেছিলাম মনের ধোঁকা হয়তো, এত রাতে একা ঘরে কার নিঃশ্বাসের শব্দ হবে!

দ্বিতীয় রাতেও আমার ঘুম ভেঙ্গে গেল, খুব অস্বস্তি লাগছিল। ওটা তখন আমার বুকের উপর বসে আছে। নড়তে পারছিলাম না, শ্বাসও নিতে পারছিলাম না। শুধু অনুভব করছিলাম সেই ঠান্ডা নিঃশ্বাসের মতই- ঠান্ডা, ভেজা হাতটি গলার চেপে ধরে আছে। চাপটা খুব অদ্ভুত, না শক্ত – না নরম; তবে ততটাই, যতটা থাকলে পরে তোমাকে আতঙ্ক আঁকড়ে ধরে।

দিনের আলোতে এই কথাগুলো নিজের কাছেই হাস্যকর লাগছিল। বিশ্বাস কর, মাকে গিয়ে যে কথা গুলো বলব, আমার তো নিজেরই বিশ্বাস হচ্ছিল না। মনে হচ্ছিল ছ’বছরের বাচ্চারা রাতে স্বপ্ন দেখে ভয় পেয়ে যা করে, আমিও তেমন করছি।

তৃতীয় রাতেও আমি সেই ঠান্ডা হাতের অনুভব পেলাম। আমি ঠিক-ঠিক গুনে ফেললাম- সেখানে মোট ছ’টা আঙ্গুল আছে। তিনটা বামে, আর তিনটা ডানে। বরফ শীতল আঙ্গুলগুলো যেন গলার চামড়া ফুড়ে মেরুদন্ড ছুঁয়ে দিতে চাইছে!

তারপর, চতুর্থ রাত, আমি বুঝলাম ও আমাকে ডাকছে। ওকে আমি ঠিক দেখতে পাচ্ছি না, কিন্তু ওর কণ্ঠটা যেন আমার মস্তিষ্কের ভেতর ভেসে বেড়াচ্ছে। বলছে- ‘তুমি তো আমাকে চেনো….’

পরদিন সকালে মা আমাকে ডাকতে এসে দেখলেন, আমি চুপচাপ শুয়ে আছি। ডাক্তার বলল- ‘হার্ট অ্যাটাক’। সবাই সেটা বিশ্বাসও করে নিল। অথচ, আমি সেখানেই ছিলাম, আয়নাটার সামনে। যেখান থেকে আমি সেই ছায়াটাকে ধীরে ধীরে সরে যেতে দেখছিলাম, আর তার দৃষ্টি ছিল… থাক সে কথা।

এর ক’দিন বাদেই ওরা সবাই বাড়িটা খালি করে কোথায় যেন চলে যায়। আমি ওদের দেখেছি, ওরা ঘরের আসবাবপত্র বের করছে, সামানা গোছাচ্ছে, ভ্যানে ভরছে। কিন্তু ওরা আমাকে দেখে না। জানালা দিয়ে আমি কেবল ওদের চলে যাওয়াটুকুই দেখলাম। এরপর থেকেই আমি একা, একদম একা।

⠀⠀⠀

⠀⠀⠀

দ্বিতীয় ভাগঃ বাড়ির নতুন বাসিন্দা…

শহর ছেড়ে এই গ্রামে এসেছি দিন দশেক হয়েছে। একটা প্রজেক্ট চলছে এখানে, আরও কয়েক মাস চলবে। প্রথম কয়েকদিন তো এখানকার কাজ-কর্মের কোন আগা-মাথা বুঝে পাচ্ছিলাম না। সবই চলছে নিয়ম মাফিক, আবার সবই এলোমেলো। সে সব গোছাতেই চলে গেছে এই কয়েকদিন। হেড অফিস থেকে জানাল, তারা এখানে নতুন কাউকে পোস্টিং দিবে বলে ভাবছে। তবে সেটা হওয়ার আগ পর্যন্ত আমাকে একটু কাজগুলো গুছিয়ে দিতে বলল।

শহরের বাইরে আমার তেমন করে কখনো থাকা হয়নি। এখন এই কাজের কারণে না আসলে হয়ত এভাবে এতদিনের জন্যে আসা হতো না। শহরেই জন্ম, বেড়ে উঠা, আর শহরেই জীবনটার ইতি হতো। সারাদিন ভালোই কাটে, কাজের ব্যস্ততায়, সাইট ঘুরে দেখে। কিন্তু বিকেলের পর আর সময় কাটতে চায় না। তার উপর এমন একটা জায়গায় থাকবার ব্যবস্থা হয়েছে! ছোট একটা একতলা বাড়ি, একদম গ্রামের সীমান্ত ঘেঁষে। বাড়িটা অফিসের, এখানে তারা অন্য একটা প্রজেক্টের জন্য জমি কিনার সময় খুব কম দামে পেয়ে যায়, তাই কিনে নেয়। কারও থাকার উদ্দেশ্য না হলেও এখন এই প্রজেক্টের জন্যে আমার থাকার জায়গা হয়েছে।

ছিমছাম শান্ত পরিবেশ ঘেরা, ঝুপ করে সন্ধ্যা নামার পর নাম না জানা পোকার ডাক ছাড়া আর কিছুই শোনা যায় না। এখানকার ম্যানেজার প্রথমে তার বাসাতেই থাকা-খাওয়ার ব্যবস্থা করতে চেয়েছিলেন। কিন্তু আমার কারও বাসায় এভাবে থাকাটা পছন্দ হচ্ছিল না, তাই সেটা বাতিল করেছিলাম। এরপর তিনি একপ্রকার জোড় করেই খাবারের ব্যবস্থাটা নিজের ঘাড়ে নিয়ে নিলেন। এখন টিফিন কেরিয়ারে করে সন্ধ্যার পরপর খাবার চলে আসে তার বাড়ি থেকে। তবে এক ফাঁকে তিনি আমাকে জানালেন, এই বাড়িটার ব্যাপারে কিছু আজেবাজে কথা শোনা যায়। যদিও বিশ্বাস করার মত তেমন কোনো ভিত্তি নেই। তারপরও রাতে বাড়ি থেকে বের হতে বারণ করলেন। আর কোনো সমস্যা হলে যত রাতই হোক, তাকে যেন নির্দ্বিধায় ফোন করে জানাই -সে আশ্বাস আদায় করে নিলেন।

দিনভর দৌড়োদৌড়ির পর শান্ত পরিবেশ আর পেট পুরে খানা পেয়ে এখন ঘুমও চলে আসে দ্রুত। বড় জোড় রাত ১০টা পর্যন্ত জাগে থাকতে পারি, তারপর টুপ করে ঘুম ধরে বসে। অবশ্য আমিও যে খুব জেগে থাকতে চাই, তা না। সকাল সকাল খুব ফ্রেশ একটা ভাব চলে আসে এত লম্বা ঘুম পেয়ে। দিনের ক্লান্তিটা তখন আর তেমন গায়ে লাগে না।

এগারো তম রাতে হঠাৎ করেই ঘুমটা ভেঙ্গে গেল। কেমন একটা অস্বস্তি লাগছিল, ঠিক বোঝানোর মত না। কেমন যেন একটা অস্বাভাবিক নীরবতা নেমে এসেছে। জানালার ফাঁকা দিয়ে ফ্যাকাশে চাঁদের আলো এসে বিছানার একপাশে থেমে আছে। মনে হচ্ছে যেন সময়টাও আটকে গেছে। অস্বস্তিটা আমাকে এমনভাবে ঘিরে ধরেছে যে, উঠে বসে টেবিল থেকে মোবাইল বা ঘড়িটা পর্যন্ত নিতে ইচ্ছে হলো না। বেশ অনেকটা সময় পর হঠাৎ করেই সব স্বাভাবিক হয়ে গেল। যেন কেউ রিমোট থেকে প্লে বাটনে চাপ দেয়ার সাথে সাথেই সব আগের মতই চলতে শুরু করেছে। অস্বস্তিটাও কেটে গেল প্রায় সাথে সাথেই। আর কিছুক্ষণের মধ্যেই আমি আবার ঘুমের সাগরে ডুবে গেলাম।

পরদিন আর এটা নিয়ে তেমন কিছুই মনে থাকলো না। সাইট ঘুরে কাজ দেখতে দেখতে দিন কেটে গেল।

সমস্যাটা হলো আবার রাতে। গতদিনের মতই ঘুমটা ভেঙ্গে গেলো। ঠিক ভেঙ্গে গেল কিনা সেটাও নিশ্চিত করে বলতে পারছিলাম না। যেন ঘুমের গভীর কোন স্তরে ডুবে আছি, কোন নড়াচড়া কিংবা সাড়াশব্দ কিচ্ছু নেই। কেবল একটা চাপা অস্বস্তি।

হঠাৎ বুকের উপরে ভারী আর ঠান্ডা একটা চাপ অনুভব করলাম। কারও উপস্থিতি… না, কারও বসে থাকা। শরীর শক্ত হয়ে গেছে, আঙুল পর্যন্ত নড়ছে না। চিৎকার করতে গেলেও শব্দ বের হচ্ছিল না। গলা শুকিয়ে কাঠ হয়ে আছে।

তারপর ঠান্ডা, ভেজা একজোড়া হাত গলার দুই পাশে চেপে ধরলো। এমনভাবে চাপ দিচ্ছিল- যেন নিখুঁতভাবে আমার শ্বাস বন্ধ করতে চাইছে। চোখের সামনে সব ঝাপসা হয়ে আসছে, মাথাটা ভোঁ ভোঁ করছে। আর কানের ভেতর একটা ফিসফিসানি- “তুমি তো আমাকে চেনো…”

আজকের পূর্বে আমার নিজেকে কখনো ভীতু মনে না হলেও, আজ আমার বুকের ভেতর ভয় ভয় জমে বরফ হয়ে গেল। হঠাৎ মনে হলো নিঃশ্বাসও নেওয়ার দরকার পড়ছে না। গলার চাপ কমেনি, বরং বেড়েছে বলা যায়। অথচ শ্বাস টানার কোন আকুতি আর ফুসফুস করছে না। হয়ত অক্সিজেনের অভাবে উল্টোপাল্টা ভাবছি। কিন্তু এটাও বুঝতে পারছি যে মস্তিষ্ক পরিষ্কার চিন্তা করতে পারছে। আর প্রশ্নটা নিজে থেকেই এলো- তবে কি আমি মারা গিয়েছি? নাকি এটা পুরোপুরি কল্পনা? অথবা এই অনুভূতিটাই মৃত্যুর পরের অংশ?

পরের মুহূর্তেই উঠে বসলাম। বুক ধড়ফড় করছে, কিন্তু ঘরের পরিবেশ একদম স্বাভাবিক। জোরে জোরে ফুসফুস ভরে শ্বাস নিচ্ছি, বা হাঁপাচ্ছি। বিছানাটা এলোমেলো, চাদর গুটিয়ে গেছে।

নামলাম বিছানা থেকে, হেঁটে বাথরুমে গিয়ে ঢুকলাম। একটু আগে যে আতঙ্ক ভর করেছিল, তার ছিটে-ফোটাও লাগছে না এখন। উলটো নিজেকে যেন আরও হালকা লাগছে। বেসিনের ট্যাপ ছেড়ে চোখে-মুখে ঠান্ডা পানি ছিটিয়ে দিলাম। মাথা কিছুটা পরিষ্কার হলো। আয়নার সামনে দাঁড়িয়ে নিজের বোকামিতে হেসে ফেলতে গেলাম,কিন্তু হাসি মিলিয়ে গেল পরের সেকেন্ডেই।

গলার দুই পাশে তিনটা করে সমান লালচে দাগ। যেন কারও আঙুলের চাপের ছাপ। আমি হাত দিয়ে ছুঁয়ে দেখলাম, হালকা গরম, কিন্তু কোনো ব্যথা নেই। আমার আতঙ্কিত হওয়ার কথা, কিন্তু তেমন কোন অনুভূতি হচ্ছে না। যেন এমনটা হবে আমি জানতাম!

এরপর আর ভালো ঘুম হলো না। বারবার কেবল ঘুরে ফিরে ঐ ফিস্‌ফিস শব্দটা মাথায় চলে আসছিল। “তুমি তো আমাকে চেনো…”

পরদিন সকালে অফিসে গিয়েই এখানকার ম্যানেজার সাহেবকে জানালাম জরুরি কাজে বাড়ি যাচ্ছি। হাতের কাজগুলো তাকে বুঝিয়ে দিয়েই গাড়িতে উঠলাম। হেড অফিসে কেবল অসুস্থতার ছুটির জন্য একটা মেইল পাঠিয়ে রাখলাম।

আট ঘণ্টার জার্নি দিয়ে ফিরলাম বাসায়। আমার কেবল মনে হচ্ছিল আমাকে যে করেই হোক ঐ জায়গাটা ছেড়ে আসতে হবে। তাই আর সামনে-পেছনে কোন কিছুই চিন্তা না করে সোজা বাসায় এসেছি। অবশ্য বাসায় এসে কাউকে কিছু বলে ভরকে দিতে ইচ্ছা হল না। ছুটি নিয়েছি, জানালাম কেবল। ওরা ভাবল, এভাবে হঠাৎ করেই শহর ছেড়ে গ্রামে গিয়ে থাকা, আর লম্বা জার্নির কারণে আমাকে এমন ফ্যাকাশে দেখাচ্ছে।

ফ্রেশ হয়ে কোনোরকম রাতের খাবার শেষ করেই আমার রুমে গিয়ে ঢুকলাম। বিছানায় গা এলিয়ে দিতেই ঘুম ঘুম ভাব চলে আসল। অনিচ্ছাতেও গভীর ঘুমে নিপতিত হতে থাকলাম।

⠀⠀⠀

⠀⠀⠀

তৃতীয় ভাগঃ অবশেষ…

একটা ঘোরের মন লাগছে। মনে হচ্ছে জেগে আছি, আবার মনে হচ্ছে স্বপ্ন দেখতে শুরু করেছি। বিছানায় উঠে বসতেই আলমারির আয়নার দিকে চোখ পড়ল। পেছনে বাথরুমের দরজা আধখোলা, আর তার ফাঁক দিয়ে মনে হলো কেউ দাঁড়িয়ে আছে- অস্পষ্ট, ছায়ার মতো।

আমি চোখ মুছলাম, আবার তাকালাম- কই? কেউ তো নেই!

হঠাৎ বাতাস থেমে গেল। না, আসলে বাতাস নয়, নিশ্বাস নেয়ার আকুতি; থেমে গেলো।

আয়নার ভেতরে আমার পেছনে অন্ধকার জমতে শুরু করলো। প্রথমে মনে হলো ছায়া, কিন্তু তা ধীরে ধীরে আকার নিচ্ছে- লম্বা, কঙ্কালসার হাত… প্রতিটি হাতে তিনটি লম্বা আঙুল।

আমার কাঁধের উপর দিয়ে সেই হাতের ছায়া এগিয়ে এলো। আয়নায় হাত দেখা গেলেও আমার গায়ে কোন কিছুর ছোঁয়া অনুভব করলাম না। আমি স্থির হয়ে রইলাম, চোখের পাপড়িও ফেলতে পারছি না।

তারপর সেই ছায়ার মাথাটা ঝুঁকে এল আমার ঠিক কানের পাশে। কোনো ঠোঁট নড়ছে না, কিন্তু এক বরফশীতল ফিসফিসানি মাথার ভেতর এক স্বরে বলেই চলেছে- “তুমি তো আমাকে চেনো…”

আমি তখন আয়নার দিকে তাকিয়ে বুঝতে পারলাম প্রতিফলনে দাঁড়িয়ে থাকা আমিটা আসলে আমি নই। প্রতিফলনের চোখ গাঢ় কালো হয়ে গেছে, ঠোঁটের কোণে হালকা হাসি, আর গলার দাগগুলো রক্তিম লাল হয়ে জ্বলজ্বল করছে। ওটা আমাকে দেখছে… কিন্তু আমি ওটাকে… কি জানি!

বাথরুমের দরজা আস্তে আস্তে বন্ধ হয়ে গেল। অন্ধকার পুরো ঘরটাকে গিলে নিল।

⠀⠀⠀

⠀⠀⠀