Infosec Press

Reader

Read the latest posts from Infosec Press.

from J. R. DePriest

The mi-go, the elder things, the flying polyps, even the shoggoth and deep ones, are all corporeal beings made of the same stuff of our universe. They have alien minds by by way of evolving on alien worlds in alien environments. Their science, while fantastic, obeys the same Laws as ours. Given a proper education, we could understand it, even replicate it. Only The Great Race approaches the power of those Outside and yet even they were once like us, ephemeral and bound to flesh.

But we are more than flesh and electrical impulses. Science tells us that our bodies are home to countless symbiotic lifeforms on our skin, in our guts. We constantly shed and regrow cells. We collect new memories and ideas. We change and adapt.

We peer into other worlds when we dream, when we meditate, by psychedelics and deliriants. We perceive hints and glimpses of vistas beyond our grasp, places our bodies, built of atoms and molecules, cannot go. These worlds are just as real, just as vibrant.

And natives of those worlds are as likely to peer back as we are to stare at a slide under a microscope. Some even “project” something of themselves down to our level as emissaries or explorers such as many-named Nyarlet'hotep and its lesser-known siblings NAM, NUM, and IM.

But we cannot understand them, even when their avatars walk among us. Their true forms exist in realities that need not obey our Laws with minds borne in and inhabiting dimensions we cannot comprehend, describe, or name. We can't even truly look at them because, to us, those angles, do not exist.

We call the gods and goddesses, for lack of a better word. We assign them domains and temperaments. We make to assume we know what thoughts and offerings they find pleasing. We build entire pantheons based on our own slight, imperfect impressions of them.

Is it any wonder that imps, gremlins, fae. demons, all the so-called “lesser” outsiders vex us? How ridiculous we must seem, building temples based on nonsense and guesses. Do they try to guide or or mock us? Who can say? Their minds and motives are just as alien.

So who did I meet that unusually warm Saturday night?

I lounged on my couch in contemplative silence, re-reading, by lamp-light, my third draft of an examination of Jungian imagery in apocalyptic anime when there was a knock at my door.

Not my front door, nor my back door.

It came from my basement door.

If I were a cat, my hackles would be raised. Instead, a sort of panic hit. Wide-eyed, pounding heart, almost forgot to breathe, spine thoroughly chilled.

I have no guns no serious weapons save a ceremonial sword mounted much to far out of reach.

I do not remember standing or walking, but when I opened the door, there stood a short, smiling man with terrible teeth in a tailored suit at the top of my stairs.

I can't recall seeing his eyes.

“Excellent!” he said in a thick British accent stolen from Austin Powers.

“This is one where you listen.”

“Are you doing a bit?” I grasped, looking past him for a cameraman or some hint that this was a misguided joke.

“A bit?” He rubbed his chin with his right hand. “I don't think so.”

He offered his left hand.

“Archibald Horatio Pierse, IV,” he said, overly emphasizing The Fourth as if it was of great importance. “Pierse with an 's',” concluded his introduction.

He was still shaking my hand, which I didn't remember offering in return.

“Sometimes,” he said. “I like to pop in and give a bloke or bird whose almost got it a little glimpse of the whole.”

'bloke or bird,' I thought. This has to be a bit.

“Right,” he said, no longer shaking my left hand, but still holding it.

The world fractured, splintered. Every cell pulled in a different direction.

Immediately, I saw The Lie of Leng. We are not our flesh extruded ever forward through time.

We extend forward, backward, up, down, left, right, perpendicular, acute, obtuse, curves, spirals, loops, dead ends.

We are infinite, each possibility of us, and our varied consciousnesses cross and zigzag each other as we live and choose, each subtly pulling the others.

There is no pattern, no spider's web, no order. Each life follows cause and effect but the tides of every other shift and shuffle the connecting threads bringing luck, both good and bad, chance, uncertainty.

When we dream, we are free to reach into the other uses and become them for a time. Here, I am a demigod, a builder of aqueducts; here, I am a psychic investigator who helps ghosts cross-over; here, I am a homeless amphibious mutant, living peacefully in the mud; here, the world is invaded by body stealing alien mantids; here, Kaiju shatter cities and I use telekinesis to protect a band of survivors.

Gender, race, nationality, species, moral character, upbringing: I am every possibility.

I am every drop in the ocean and the ocean itself.

I am the sky, the moon, the stars, a worm, a bacteria, a lichen.

The one who showed me—I had forgotten he existed—he bade me, “turn around.”

What a strange request! I am all that is and was. Do I not already “see” in every direction?

“Turn around.”

A trillion trillion trillion hands gently guide each part of me, facing my infinite gazes in a new direction.

Syzygy.

I am All, yet All That is Not Me is also All.

I see the tapestry, the enmeshed pattern.

The beauty.

The belonging.

The Love.

Every part of me weeps.

An infinity of infinities.

Each unique.

Together, whole.

Like curtains dancing in the breeze.

Like a rainstorm.

Like staring at the sun.

Like the song of cicadas.

Unity.

From the Great Boiling Seas of Ur to the Blindness of Effervescence to the Stasis of Effluvia to the Paralysis of Approaching the Akashic Record to the Singing Knowledge Trees of Vitrium to and to and to and to and to and to…

All is One and One is All.

Then I'm lounging on my couch in contemplative silence, re-reading, by lamp-light, my third draft of an examination of Jungian imagery in apocalyptic anime.

And I can't stop crying.


#WritersOfMastodon #Writer #Writing #WeirdFiction

 
Read more...

from J. R. DePriest

I feel my peaceful breathing, the heavy blankets on top of me. I open my eyes, expecting to see my wife beside me, reading a book by lamplight. Instead, I’m alone in a single bed under layers of fur comforters.

I can see my breath in the dim, reddish light. I look around.

No other furniture, a backpack, shoulder bag, and pile of folded clothes on the floor against the wall to my right. I sit up and see a short stack of spiral notebooks next to it: my life’s work. It’s always with me as I have no permanent address.

I look up at the wall near the ceiling. Emergency lights. The only lights.

Slowly the sound comes in.

First, my steady breathing.

Next, the stillness.

Dripping, creaking, distant muffled voices.

A laugh.

I remember who I am.

A consultant brought in by the mystery solving Derringer family. More Scooby-Doo than Supernatural, despite the name. Not that they would understand either of those references.

This is the abandoned hotel next to the old haunted Gilded Djinn amusement park. They got the generator working so they could live here while studying the place.

The dad was possessed. They didn’t know it. The ghost of a Parisienne serial killer put to death in 1938 had possessed him shortly after they got here three weeks ago. The ghost of a child, dead since 1953, told me about it last night. Even though I can see them, the child was but a wisp, a pink sparkling cloud in the shape of a skull. She'd been trying to reach me for days, but the serial killer was strong and suppressed, repressed, the others, hid itself plainly behind living flesh in a way that even I hadn’t noticed.

She can’t tell me her name. Maybe she doesn’t remember it. I call her Papillon because her fluttering colors remind me of a butterfly and she seems to like that.

She could only whisper and hint as to say more courts his attention, but I understood last night. I was supposed to stop him from killing again as he’d taken a secret mistress from town. They were never good enough. No matter how hard he tried to raise them from their station. No matter what he bought them, no matter how he lavished them. No matter what he did to educate them. They were all beneath him and they wasted his time and his affection. Again and again. They were so worthless that killing them was a mercy, the kindest thing he could do for them.

And the body he wore while doing it? Well, they should have had a stronger will than his own, shouldn’t they? The flesh is weak and he is most definitely not weak. Let them sort it out if they can. They swagger around in warmth, wearing blood and sweat; smelling, touching, feeling. Let them figure out what happened, why they went mad. If, with their vaulted senses and biological faculties, they were unable to ferret him out, then they deserved their fates.

I shrug off the covers, invigorated by the chill, breath deeply.

Mildew, moisture, decay. For some reason, I grin.

I slide around and step out of bed.

SQUISH

Shivering ice shoots up my legs all the way to my shoulders.

I remember the dripping sound, whip my head to the inside wall.

drip

Rivulets of water from the room above running down the wall.

I “see” the room, the father smiling at a strange brunette woman in a steamy bathroom. Behind his eyes, I see another set of eyes, greedy, indolent, and apathetic.

Papillon floats out of my head.

“sorry,” she whispers, a voice closer to my ear than her floating form appears.

I feel her shame at invading my space but there was no violation.

“Don’t be. It was far more expedient to show me than to try to tell me. “When?”

Time is elusive to a ghost. Being detached from a body’s signals and urges leaves one prone to missing days or weeks at a time.

A quiver passes through her. “i stayed aware so it must only be hours”

“So he’s close to finishing the act, then?”

She hesitates. I can feel her reaching out, testing the air, probing for his eyes.

“yes” she finally whispers.

I slosh over to my belongings, now sitting in two centimeters of water.

I look down at myself, a young adult man, black; thin, but well-built; wearing loose sleep pants and boxer shorts. No shirt.

I kneel down to check my fresh clothes. Even the top ones are damp.

I glance at my other belongings.

My eyes go wide in panic. My heart pounds and my ears ring.

My notebooks.

I gently touch the top.

Wet.

My vision goes red and my teeth grit, grinding so hard my jaw hurts.

At the same time, tears well and begin to spill.

I gingerly scoop them up and place them on top of the covers on the bed, afraid to spread them out and risk further damage.

Thirty years of notes, observations, dreams, musings, philosophy, journaling, secrets.

My heart sinks to my stomach.

So many memories.

Hands in fists, nails digging into my palms, tears rolling down my face, breathing in ragged bursts.

“I will kill him,” I think, seeing the desiccated, skeletal form of the ghost riding Paul Derringer, using his body for pleasure and murder. “I will rip him from the body, tear him into strips, and swallow them one at a time while he wails in horror.”

How does one kill a ghost? I know how yet rarely have I done it.

I will relish killing him. I will bask in his suffering as I eat his essence.

Shocked at my own thoughts, I try to calm myself, try to slow my breathing, control my pulse.

Papillon nudges me over and over.

She cannot see me like this.

I look at her but can’t speak.

A page from my notebook floats in the air, deftly separated from the rest without damage.

It sparkles with Papillon’s light, flattens, dries, without smearing the ink further, without tearing or ripping, without sticking to the other pages.

Moments later, the dry, clean page floats to the bed and another appears and undergoes the same methodical process.

She can rescue them. She can save my past.

My tears switch to those of relief, joy and mostly, of gratitude.

I nod to Papillon.

My blue jeans will be far to wet, even for an industrious little ghost. The sleep pants will suffice. My boots will be fine as the water was not deep enough to rise up over the rubber.

The closet still has the dusty old outfits of the last person to stay here. I find a shirt only a size or two too large.

Time is slipping, so this must be good enough.

The family waits for me outside.

Paul grins as if he knows that I know. “About time, Tarek. We thought maybe you’d taken a sleeping pill. Not sure how you slept through the commotion.” He’s fit for his age, effortlessly athletic and buoyant. Before the ghost indwelling, his generosity and kindness were overflowing. Now he prefers sarcasm and backhanded compliments.

The sleeping pill reference tells me what he did with the woman I saw in my vision.

Ainara, the mother, weary and weathered, smiles purely. Even beneath the hard years, of chasing ghosts, of raising four children, her deep alluring elegance seeps through. In another life, I would have courted her, married her, and kept her far away from this nonsense, forgoing even my own natural gifts so that I might spend all my efforts giving her everything she ever needed.

Adam, the oldest brother was away on his own investigation, leaving barely 18 Tom and the twin teenage girls, Cori (Corinna) and Eri (Erinna), named after Greek poets. The girls were destined to get their own spin-off set of adventures, that was obvious. Tom would have his own, as well soon enough. After Adam disappears during his investigation in the Appalachians in the coming months leading such that Tom sets off to find him.

The parents would retire into the background, showing up for the sake of nostalgia and for frequent flashbacks and phone calls for guidance.

But this story was to be the crowning achievement of the family as a unit, the last time they all worked together, save Adam whose absence sets up the next series. This was high stakes, lives on the line, pulling out all the stops. The possession of Paul was telegraphed far earlier to those who had been paying attention, long before I was brought in as a cross-over character.

They stand around a glowing hole in the parking lot leading down into the earth. It had not been there the night before.

Smoke or steam rises from it and it glows with red light, similar to the emergency lights in the hotel.

“That opened up last night?” I ask.

“The storm?” Ainara asks. “The air rang like collapsing steel for hours behind a wall of black water.”

Cori adds, “there was no lightning.” Then Eri, “but plenty of thunder.”

Tom shakes his head, hands on his hips. “I don’t like it.” He motions toward me. “T, come take a look, please. Let us know what you see.”

I nod and walk over, letting my vision fade in and out of this world and the other.

In the other, I see pale, glowing tumbleweeds drifting and flowing toward the hole, not fast, not a torrent, but it is like a drain has been opened into the other world and any ghost form or related energy not firmly connected is being drawn back toward it.

I think about Papillon and how she was eager to repair my notebooks wondering if she was seeking something to keep her attached for just a little while longer.

“It’s an opening into the other world,” I tell them plainly. “Give it time and it will clean up the infestation at Gilded Djinn all on its own.”

Paul immediately interrupts. “But then we’ll never know what caused it. We have to go in. We have to figure this out.”

Ainara stares at Paul, holding her mouth steady, squinting at him, but saying nothing.

Tom, newly a man, counters, “Dad. We are not prepared for this. We do not have equipment for spelunking, certainly not into the freaking other world.”

The girls, who I know have underdeveloped psychic powers of their own, glance at the hole and at each other, sharing a conversation only they can hear. I know they want to go inside. I know they want to go inside and are afraid of the fact that they want to go inside. I know they will be pushed to the brink and the struggle to save their family will enable their psychic powers to burst through.

I know that hole is more than just a portal to the other world. I know we are expected down there. There are long-gestating plans finally coming to fruition. Entire bloodlines worked toward this day.

We will go down into the hole.

We must.

Paul looks at me. “Tarek can help us see our way, right?”

I lick my lips, rub my chin, feel the inevitability, the pull of the narrative.

“I will do my best, Paul. I will keep you safe.” It’s a lie, but a necessary one.

So, after Paul loans me a pair of pants and I go change, after I gather a few trinkets from my belongings that might help us, an antique ghost-light, a handful of protective carvings, a bracelet for each of the twins and for Ainara.

Tom has the globular, gold, tin, silver, copper, and glass ghost-light. I demonstrate how you squeeze the mechanism on the side, it spins a dynamo inside which generates a burst of electricity used to shine the directional light for a few seconds. The light will reveal ghosts and ghost energy illusions for what they really are. In other words, it will let them see the world the way I can albeit only briefly.

The opening reveals a short drop to a ramp carved out of the asphalt and then the earth and then stone angled gently enough that we needn’t even brace ourselves from falling. The air is warm, buzzing with otherworld energy, filled with the remains of ghosts and other things decaying back into their constituent parts. I see the pieces of their bodies, violently torn, shredded, spread around like wallpaper, like paint, like window dressing. All for our benefit, to keep us comfortable.

Yet these ghosts volunteered for second death. It is the only way their remains would produce warmth instead of bitter cold. I can’t understand it. I know what I’m seeing but why would so many do this. What is so important about the Derringer’s coming down here?

Even with my foresight, even with my other world connections, even with my knowing the boundaries and artifice of this world, I can’t understand it. I can’t see what comes next. I know the ending. I see the ending. But the path is darkness.

What I notice most of all is that, when the end comes, I am not there.

“Be careful,” I advise as I cross a rickety bridge first. “Use the ghost-light. Some of the boards are missing but its enchanted to look whole.”

Tom cranks the handle and tries it out.

“Hmm.”

Tom kneels down and feels where a board was missing but visually seems to be there. His hand slips through.

“You can’t touch them,” he says. “You can feel each step with your foot before you take it.” He tells the rest of the family, “Just go slowly.”

On the other side, I see them feel the way ahead, one plank at a time.

I glance further down the path, seeing how the corridor of stone narrows ahead. It is filled with unsavory ghosts of all kinds, pirates, soldiers, ancient warriors, spirits of things not-human at all. I see them then I don’t see them, then I see them again. Something is trying to blind me.

In the distance is a green glowing village filled with both living humanoids and ghosts seemingly operating together. My vision shifts into their midst. They chant and dance around a black pit, wider than a skyscraper and at least as deep. They call to something sleeping, something to protect them from the family arriving from the surface. They fear the surface. They know what the dead have told them. They know about World Wars and weapons that can atomize cities in a flash. They know about slavery and prisons and courts with twisted laws that protect kings while subjugating the people. They know about great monstrous cities built on the backs of obliterated forests, siphoned waters, pluming world covering smoke that kills their own children. They know of the madness of those who live above them, how we destroy and ruin our world and they fear we are coming for theirs.

The thing that answers them from the pit is so massive that a single eye cannot see it, so through a thousand eyes I peer into the depths and see it rise, a mountain of stony flesh, mouth that could swallow a blue whale, its own eyes burning with heat and intensity. I feel its hunger and its pain. It was sleeping and now it is awake.

They know not what they are waking. They know not what it will do to them or the world above.

I pull back and remember myself, remember my history, remember some of who I really am.

I call to Iškur, Adād, 𒀭𒅎, 𐎅𐎄, I ask for lightning to sate this thing, to feed this creature so it does not eat the world itself. I cannot tell it my name for I have forgotten it, but I beg it to listen, to answer. I beseech it to protect not just this family, not just the fearful creatures dancing to their own doom, but to protect everything.

I call to the old gods, the forgotten gods to save this place for I understand that we were brought here to end it.

That was the purpose.

That was the plan.

I plead to save this reality.

I plead to save this version of Ainara.

The ground glows blue and a river of electricity rushes along the walls to the thing in the pit.

The electricity does not hurt it. Instead it feeds it. The creature gorges and gorges.

I reach into the stream and feel a rush in my veins and nerves, all firing at once, all bubbling and splitting, vibrating and humming. I burn, sizzle, my ears burst and my eyes boil in their sockets.

I hear my laughter echoing.

I see Ainara seeing my body inflate like a balloon in a split second before I explode into a mist.

I hear her weeping, shielding the children, Tom pushing past to see if any of what I was is left.

I feel Paul and not-Paul tugging at each other’s thoughts trying to make sense of what just happened.

But I am no longer there.

I shift sideways.

I’m at the bottom of a carved sandstone staircase that spirals up. Adam and Tom are right behind me. I can hear scrabbling in the distance, yelling, the clashing of steel on steel. Cori and Eri float a few centimeters off the ground, pushing against the air, against the onslaught with all of their considerable telekinetic might.

Adam shouts, “They can’t hold them back forever, T.”

Tom looks up the shaft next to me, “What do you think?”

I feel the entire stairway, heading up. Not the surface, but close. It crosses over into some other place along the way.

“It’s safe. I’ll float up, y’all come behind as fast as you can.”

Tom nods. “Got it.”

He turns back, “Come on!”

I’m already half-way up the shaft, feeling the quality of the air shift from oppressive to open, to something else.

I hear them running and hear the others pursuing behind them.

First Adam, then Tom. As as Cori and Eri make it I use my own abilities to crush the stone stairs, sending them tumbling into the shaft, sealing it and preventing anything from coming up after them, after us.

Tom slaps me on the back and hugs me, “Damn good work, Tarek!”

Adam adds, “Yeah, I’m really glad you thought to call Tarek for this.”

Cori says, “He saved the day for sure.”

Eri says, “He kept us from being taken.”

We’re close to the surface and it’s easy enough to find a path. We weren’t the first to come this far, just the first—in a very long time—to be foolish enough to go any deeper.

I was honestly surprised to get the call from Thomas. I didn’t think I was welcome.

Back at the homestead, I went into the stasis room to see Ainara, frozen twenty years ago after the last time I worked with the family. The unexpected explosion of other worldly energy sucked the life out of her. She’d be dead if not for the sorcerer I found who know how to do this. She wasn’t dead or alive, she was frozen in time.

I didn’t expect them to let me talk to her. Every moment out of stasis was another moment close to death. But I could see her, standing there, immobile. Her missing left eye a reminder of how wrong I was that night.

The twins had snuck up on me. They could do that now.

“She asks about you,” Cori says. Eri adds, “she misses you.”

I knew they brought her out from time to time when they needed her wisdom. I knew the sorcerer had said she would keep trying to find a way to reverse the anti-life damage that had been done to her soul.

I turn to them. “What happened to your dad?”

They look at each other and I feel a thought pass between them, but I can’t decipher it.

“Ask Tom,” Cori says. “Or Adam,” Eri adds.

I leave Ainara and find Tom in the study behind the desk engrossed in a massive, ancient book.

“What’s up, Tarek?” he asks, barely looking up from the tome he’s reading.

“Where’s your dad?”

“Hmm,” he says, then motions for me to sit down across from him.

As I’m sitting he asks, “You remember Dr. Gallagher, right?”

“The one who saved your mom, of course, I remember her.”

“Well, she didn’t have the same luck with dad, unfortunately.”

My heart sinks, “Paul’s gone? I’m so sorry.”

Tom shifts his head left and right.

“He’s not quite gone.”

I shake my head.

“I’ll just show you.”

Tom stands up and leads me out of the study to their trophy room full of artifacts and items picked up in their adventures. It smells of dirt, tree sap, ancient smoke, and libraries full of papyrus.

He points to a chest on a slightly raised section of floor. It’s the size of a steamer trunk.

“Go ahead,” he motions. “Open it.”

The lid is heavier than it looks, resisting as if there is suction or magnetism holding it in place. Finally, it snaps open.

Inside, I see an entire world, like a doorway, hiding a jungle. Birds caw, large things stumble in the distance, but the smell is dank, cemetery, rotten.

“Tom,” croaks a broken voice. “Adam?”

Something shambles into view below the portal, brown, ragged, covered in leaves and dripping worms and worse.

“Tarek? Well, I’ll be,” it groans.

I see blue eyes buried somewhere in the hideous face and hints of a smile behind the rictus grin.

“Paul?”

It can’t be. But it is.

“What happened?”

“Thought I’d found a way to bring Ainara back,” he rasps.

“I was wrong.”

He shuffles for a moment, looking away, looking at his hands.

I don’t know what to say. I don’t know what to think.

He looks back up.

“If you get a chance to talk to her, Tarek. If you find a cure for her.”

He looks directly into my eyes.

“Well, you have my blessing.”

Then he shuffles out of view.

I’m still staring when Tom closes the lid.

He puts his arm around my shoulder.

“It’s an undead world down there, Tarek. I mean a world where the undead thrive and the living are endangered.”

He pulls me away.

“Dad is safe there, more than safe.”

At dinner, they bring out dish after dish, meat and potatoes, meat covered in cheeses, meat in exotic sauces.

I’m still struck by what I saw through the portal in that chest and can’t even think of food.

My mind wanders, distracted, distraught. I can’t focus. I can’t think.

What was Paul thinking to end up like that? What did Dr. Gallagher do to him? Why was that the only option?

Something slips and my perception fully crosses into the other, something that never happens on its own. I have to will it and I certainly did not will it.

I see the banquet before me as it really is. None of the meat is cooked. It is raw. It is fresh.

Tom, Adam, Cori, and Eri are no longer human. I see them as the ghouls they have become.

The girls smile at me with lipless grins. “We see you,” they say in unison.

I pull my sight back but still see them, still see the reality.

Tom’s head is grotesque, held together by wires and metal staples.

“Tarek! You get to join us. Mom insisted.”

It’s not clear how Tom manages to speak at all, but that was his voice coming from his head.

Adam slides in with, “She didn’t want to leave you behind after we head in after dad.”

Cori says, “Dr. Gallagher is already waiting for us.”

Eri says, “This is the way to cure mom, what dad almost got right.”

I swoon, my head spinning, trying to grasp what they are doing, what they are asking me to do.

The world closes in, becomes a pinpoint of light and everything goes dark.

I sit in a cavern much like the one from before, but there are no ghosts here, just cowering warriors and their shield maidens before them.

I sit because the caves are too narrow for me to stand. At 7 meters tall, I tower over even the tallest among them.

I see the arena in the distance and kneel to shuffle toward it. I will fight them there. I will fight them all.

I long to see if Benttite flesh is as tender and sweet as was their rivals, the Amelonians.

I grunt and crawl until the cavern opens up for the arena. It was filled with fighting men and women, sparring and competing.

“I come to fight,” I tell them, my booming voice echoing off the stone walls. “I come to fight in your legendary arena where the pinnacle of human strength, strategy, and fitness strive to best one another.”

Alas, when the gate swings open, the arena is empty, all warriors having fled in my wake save one who does not seem the fighting type.

“My Lord,” he addresses me, kneeling and breaking eye contact. “Instead of combat, perhaps you would prefer a different style of conquest.”

He motions toward another exit and I see healthy men and women in little clothing eyeing me with half smiles and curiosity. I scent them immediately and understand the offer.

Although I cannot fully honor it, I am moved by their humility.

I nod to the little man and move toward the harem, my mutilated manhood doing its best to prepare for the experience.

They appease me. They indulge me by performing with each other. I see methods of pleasure and how to both delay and prolong it that are truly inspirational.

All the while I am plied with exotic foods of which I have never tasted, cooked and uncooked meats of varying shapes, strange fruits and vegetables, and drink with flavours the likes of which I had never encountered.

Each time I am approached to join in their sexual proclivities, I redirect the man or woman back to the throng, to show me something new, some other act forbidden by all the gods of the surface world and I am never disappointed.

I had heard of their prowess in war and battle but not of this, not of their creative depravity in the realms of sex or of their artistic skill with meal preparation. I supposed the renowned Benttite generals, soldiers, archers, and reavers must be fighting for something. Why not this?

After much gentle prodding, I finally show them my sex. I lift my furs and reveal to them what curse befell me.

My great size was a boon granted by a god whose name I was never taught. But to keep me from bringing about a great race to challenge those gods, I was hobbled.

My penis is wide as an oak tree yet as short as a what remains after one is felled and what skin it does have is covered in yellow pustules filled with unsavory fluids.

“It has always been thus,” I assure the awestruck audience.

Several among them assuage me they have the finest doctor’s in the known world and that would be honoured to treat me and find a cure.

Again, I am touched by how they treat me, a giant who had come to find pleasure in killing and eating their best while their blood still ran hot.

I consider their words as I am overcome by weariness and lose consciousness. I cannot know if I will survive the night, if their hospitality is genuine or a trick of their vaunted intelligence.

“I’m don’t know what the problem is, Sol,” I say, standing on a pearlescent balcony overlooking the black sky. “I had a fine time down there. You think it’s done? Kaput?”

I walk back into Sol’s workshop. He stands or maybe sits. It’s hard to tell with him. He stits holding the rough-shaped platter up at arm’s length, eyeing it with a grimace, squinting.

“I think it’s garbage, Jove.” He shrugs. “I should just eat the whole thing and get it over with.”

“Wait a second, Sol.” I’m trying to save it. I’m trying to save her.

“Stick it in the void. Let them stew on it. Let them see if they can figure out that there is no other world but theirs, that everything they need just happens to be there when they need it. See if they can look beyond it and ascend.”

Sol is rolling his eyes, shrugging, throwing up his hands, but saying nothing.

“Talk if you want to talk,” I shout.

“Bah, you never listen when I do,” he yells back.

“Stick it in the freezer then,” I shrug. “Come back to it later.”

We both know “later” means “never” but I said what I said.

“How many freezers do you have, Sol?”

He waffles before muttering, “three.”

“Three? That’s not bad!”

A chorus of voices rises up from the blackness that surrounds us, “three thousand.”

“Hah,” I laugh. “That’s sounds more like you than three.”

“What does that mean?” he gestures while tossing the world stone to the side.

“You never finish anything but you can’t throw it away either.”

He’s still muttering, “never finish anything, you should see what I’m building, what I’ve found.”

He’s definitely standing up now, but still not any taller.

“Come with me!” he demands.

I follow after him, looking down at his starry crown. Was he always this short? Was he always this bald?

The golden jeweled staircase of light leads to the basement where the floor itself is torn up.

“You ripped up your own floor?” I ask, putting my hands on my hips.

“Look underneath you old fool!” he calls.

I see it now, a silver stream leading off into the infinite night. Big enough for a toy boat if we had a toy boat.

Standing next to it, I can hear a shimmering trickle, a hint at consciousness, novelty.

I see a broken up chair built into a crude boat, barely big enough to stand in.

Sol and Jove argue.

Jove asks me, by name, by my real name, a name I had forgotten.

“Jessica,” he says. “Why don’t you get us in that boat.”

I thought I was Jove. I look down and see Jove’s body: a tall old white man in flowing saffron robes.

I have our body step into the shell of the boat made from a chair.

I slip our feet under a little overhang to keep us from falling. It clamps down gently.

“Do you need to tell Sol about me or… whatever?” I ask inside Jove’s head in my voice, not his.

Jove doesn’t answer. He’s still arguing with his old friend.

The boat shudders and starts to move away from the shore.

I have our body sit down, against the back of the chair, now a small platform, so we don’t rock the boat and fall out as we see where it leads us next.


#WhenIDream #Dreams #Dreaming #Dreamlands #Writer #Writing #Writers #WritingCommunity #WritersOfMastodon #ShortFiction #Fiction #Paranormal

 
Read more...

from critic

Ormai è una moda ma personalmente non capisco il senso, soprattutto per il runner basic, di confrontarsi su una piattaforma che essenzialmente vuole i tuoi dati per profilarti.

 
Continua...

from A&B Vietnam

Bia xuất khẩu ngon chất lượng hàng đầu từ A&B Vietnam

Vị ngon bia Việt Nam ngày một ghi dấu ấn mạnh mẽ trên bản đồ đồ uống toàn cấu nhờ chất lượng vượt trội. Trong đó, A&B Vietnam nổi lên như một công ty tiên phong với hơn 35 năm kinh nghiệm, vận hành hệ thống cơ sở sản xuất 70.000 m² và công suất hơn 1000 container/tháng. A&B Vietnam đã giao thương quốc tế bia tới hơn 70 quốc gia, đáp ứng trọn vẹn các điều kiện bắt buộc khắt khe như ISO, HACCP, HALAL, FDA. Hãy cùng tìm hiểu chi tiết hơn về các dòng bia mang tinh thần Việt Nam và độ hoàn hảo toàn cầu của A&B Vietnam.

Chi tiết: Bia xuất khẩu giá tốt nhất - A&B Vietnam

Nét chính về bia

Bia là một thức uống có cồn quen thuộc, được điều chế từ thủ tục sản xuất lên men các vật tư sản xuất như malt đại mạch, hoa bia, men và nước. Đây là một trong những loại đồ uống có bề dày lịch sử, gắn bó mật thiết với nghệ thuật ẩm thực của nhiều dân tộc.

Tại A&B Vietnam, bia đưa ra thị trường thế giới không chỉ là một thức uống giải khát, mà còn là một chủng loại thể hiện bản sắc văn hóa Việt với chất lượng cao quốc tế. A&B Vietnam luôn đề cao sự cân bằng trong mùi vị, độ tươi mát, lộ trình công nghệ tạo ra khép kín và các điều kiện bắt buộc quốc tế. Nhờ đó, từ dòng lager thanh khiết, ale đậm vị đến bia không cồn 0.0%, mỗi sản phẩm đều có nét độc đáo riêng, thỏa mãn nhu cầu đa dạng tại các nơi bán hàng khác nhau.

Các dòng bia xuất cảng chiến lược của A&B Vietnam

Với tầm nhìn trở thành nhà làm ra và tiêu thụ ở nước ngoài bia hàng đầu khu vực, A&B Vietnam đã xây dựng một danh mục vật phẩm hết sức phong phú, phục vụ thị hiếu khác biệt của người tiêu dùng quốc tế.

  • Bia Lager thanh mát, dễ uống, là dòng bia có tính phổ biến toàn cầu.
  • Bia Ale (Stout) đậm đà, giàu vị đặc trưng, rất được ưa chuộng tại nơi bán hàng châu Âu.
  • Bia Lager không cồn là một lựa chọn lý tưởng cho các quốc gia Hồi giáo và những người tiêu dùng quan tâm đến sức khỏe.

Mỗi dòng bia đều được gia công trên dây chuyền tối tân, tuân thủ nghiêm ngặt điều kiện bắt buộc quốc tế, vừa bảo toàn mùi vị Việt Nam, vừa khẳng định độ hoàn hảo phân phối quốc tế uy tín.

Nguyên liệu và lộ trình công nghệ gia công đạt chuẩn quốc tế

Để tạo ra những dòng hàng bia có vị đặc trưng ổn định và độ hoàn hảo, A&B Vietnam luôn đặc biệt chú trọng từ khâu tuyển chọn thành phần cốt lõi đến chu trình gia công. Chỉ những yếu tố đầu vào tốt nhất mới được đưa vào dây chuyền nhằm đảm bảo vị đặc trưng chuẩn mực.

  • Malt đại mạch cung cấp vị cân bằng và độ sánh đặc trưng cho bia.
  • Hoa bia tạo ra mùi hương tinh tế và hậu vị đắng cân bằng hoàn hảo.
  • Men bia là nhân tố quyết định quá trình lên men ổn định, giữ trọn vẹn sự tinh khiết.
  • Nguồn nước tinh khiết được xác minh tiêu chuẩn nghiêm ngặt theo các tiêu chuẩn quốc tế.

thủ tục sản xuất điều chế bia bao gồm 11 bước khép kín, từ chuẩn bị thành phần cốt lõi, nấu và đường hóa, đến lên men, lọc trong và đóng gói. Toàn bộ đều được giám sát chặt chẽ theo các thông số kỹ thuật ISO 22000, HACCP, HALAL, FDA, đảm bảo mỗi lon bia khi tiêu thụ ở nước ngoài đều đạt giá trị toàn cầu.

Bao bì sản phẩm và quy cách bia bán ra nước ngoài

Để phục vụ nhu cầu đa dạng của các nhà nhập khẩu và hệ thống cung ứng quốc tế, A&B Vietnam tiêu thụ nhiều lựa chọn về vỏ đựng. Mỗi thiết kế đều được tối ưu hóa cho sự tiện lợi, khả năng bảo quản và lý tưởng với từng kênh cung ứng.

  • Lon 250ml, 330ml, 500ml phù hợp cho kênh bán lẻ như siêu thị, cửa hàng tiện lợi, nhà hàng, khách sạn.
  • Thùng carton 12 hoặc 24 lon được thiết kế để tối ưu hóa chi phí và không gian khi vận chuyển bằng container quốc tế.
  • Vỏ hộp có thiết kế sang trọng, hiện đại, in đầy đủ thông tin (Nutrition Facts, ABV, hạn sử dụng) và mã QR truy xuất nguồn gốc, gia tăng sự tin cậy.

Nhờ sự đa dạng này, hàng hóa bia của A&B Vietnam không chỉ thuận tiện trong khâu nhập khẩu và cung cấp mà còn tạo được ấn tượng chuyên nghiệp với người tiêu dùng tại nhiều nơi bán hàng toàn cầu.

Kênh phân phối xuất khẩu của A&B Vietnam

Với năng suất điều chế mạnh mẽ và mạng lưới bán hàng toàn cầu, A&B Vietnam đã đưa các thương hiệu bia Việt Nam như Camel, Cheetah, Abest, Saola, Steen, Two Red Tigers đến nhiều khu vực quan trọng. A&B Vietnam luôn nghiên cứu kỹ lưỡng đặc thù của mỗi kênh phân phối để mang đến hàng sản xuất tối ưu nhất.

  • Châu Âu Đức, Anh, Pháp, Hà Lan ưa chuộng bia lager và stout có hương thơm đậm đà.
  • Châu Á Nhật Bản, Hàn Quốc, Singapore đánh giá cao sự thanh mát, dễ uống của bia lager.
  • Trung Đông UAE, Ả Rập Saudi tập trung vào dòng bia không cồn đạt quy định HALAL.
  • Châu Phi & Châu Mỹ là những khu vực tiêu thụ mới nổi, đang mở rộng nhanh chóng.

Với năng lực cung ứng hơn 1000 container mỗi tháng, A&B Vietnam không chỉ đáp ứng tốt nhu cầu ổn định mà còn sẵn sàng mở rộng thị phần. Đây chính là nền tảng để chúng tôi trở thành bên hợp tác tiêu thụ ở nước ngoài bia chiến lược cho nhiều doanh nghiệp.

Lý do chọn A&B Vietnam làm bên hợp tác bán ra nước ngoài bia

Trong tình hình cạnh tranh khốc liệt, việc lựa chọn một bên hợp tác chế tác và bán ra nước ngoài uy tín là yếu tố quyết định thành công. A&B Vietnam, với kinh nghiệm, nền tảng làm ra hiện đại và giá trị quốc tế, đã trở thành cái tên đáng tin cậy.

  • 35 năm bề dày kinh nghiệm trong ngành, khẳng định sự uy tín và ổn định.
  • Cơ sở sản xuất hiện đại tại miền Bắc và miền Trung, đảm bảo khả năng chế biến quy mô lớn.
  • Tiêu thụ ở nước ngoài đến hơn 70 quốc gia, xây dựng mạng lưới phân phối toàn cầu.
  • Thông số kỹ thuật quốc tế ISO, HACCP, HALAL, FDA, đáp ứng các yêu cầu nghiêm ngặt nhất.
  • Đội ngũ R&D chuyên môn cao, liên tục phát triển sản phẩm mới thích hợp thị hiếu.
  • MOQ thấp, linh hoạt cho cộng sự thử nghiệm vật phẩm và nhập khẩu theo giai đoạn.

Với sự kết hợp giữa bề dày kinh nghiệm, công nghệ hiện đại và đảm bảo đẳng cấp, A&B Vietnam không chỉ cung cấp những hàng sản xuất bia đạt chuẩn mà còn đồng hành cùng người đồng hành chinh phục kênh phân phối toàn cầu. Hãy gọi ngay với A&B Vietnam để cùng nhau đưa vị đặc trưng bia Việt Nam vươn xa.

A&B Vietnam

 
Read more...

from b

“In June 2019, Portland Antifa terrorists were arrested after assaulting rightwing demonstrators and police with quick drying cement and bear spray.” – The White House

PPB’s baseless lie from 6 years ago is being used as pretext for an authoritarian crackdown against Portlanders, as well as decent, working class volunteers who oppose fascists and neo-Nazis all over the USA.

At any point, PPB could have displayed a minimal commitment to truth and civic responsibility by retracting this bullshit; but, even as their own Police Commissioner & Mayor Ted Wheeler’s City Hall was evacuated due to bomb threats, they never did.

PPB consistently displays far-right malice toward the people of PDX, and are too rarely held to account for it. Nobody should be under the illusion that they’re going to be helpful against Trump’s current fascist military deployment.

🔗

 
Read more...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


News For All

🚗 Stellantis says a third-party vendor spilled customer data data breach – Stellantis confirms a data leak due to a third-party vendor breach, exposing customer names and emails. They have initiated an investigation and warned customers about potential phishing risks. https://www.theregister.com/2025/09/22/stellantis_breach/

⚠️ FBI alerts public to spoofed IC3 site used in fraud schemes cybercrime – The FBI warns of spoofed IC3 websites designed to steal personal information from users reporting cybercrimes. Users should verify URLs carefully to avoid falling victim to fraud. https://securityaffairs.com/182449/cyber-crime/fbi-alerts-public-to-spoofed-ic3-site-used-in-fraud-schemes.html

🦠 Here’s how potent Atomic credential stealer is finding its way onto Macs malware – Malicious ads impersonate services like LastPass to spread Atomic Stealer on Macs. Users are warned to avoid clicking ads and to download software only from official websites. https://arstechnica.com/security/2025/09/potent-atomic-credential-stealer-can-bypass-gatekeeper/

🎮 Steam game removed after cryptostealer takes over $150K malware – A Steam game was pulled after a cryptostealer exploited it, stealing over $150,000 from users. The incident highlights the ongoing risks of malware in gaming platforms. https://www.theverge.com/news/782993/steam-blockblasters-crypto-scam-malware

😩 AI ‘Workslop’ Is Killing Productivity and Making Workers Miserable privacy – A study reveals that AI-generated content, termed 'workslop', burdens workers with fixing low-quality outputs, undermining productivity rather than enhancing it. Companies struggle to define AI's benefits amid rising risks. https://www.404media.co/ai-workslop-is-killing-productivity-and-making-workers-miserable/

🚧 Jaguar Land Rover extends shutdown again following cyberattack data breach – Jaguar Land Rover's operations remain halted due to a cyberattack, with losses estimated at £50-70 million daily. The shutdown affects thousands of workers and disrupts the broader supply chain. https://therecord.media/jaguar-land-rover-extends-shutdown-again-cyberattack

🧳 Worried About Phone Searches? 1Password’s Travel Mode Can Clean Up Your Data privacy – 1Password’s Travel Mode helps protect your data during phone searches by removing sensitive information temporarily. This feature is ideal for travelers concerned about privacy. https://www.wired.com/story/1password-travel-mode/

⚖️ What to do if your company discovers a North Korean worker in its ranks cyber defense – Companies discovering North Korean IT workers face complex legal and cybersecurity challenges. Experts advise cooperation with the workers, careful monitoring, and engaging law enforcement to mitigate risks. https://cyberscoop.com/north-korean-it-workers-enterprise-risks-sanctions-response/

📰 Researchers say media outlet targeting Moldova is a Russian cutout security research – Researchers link the online news outlet REST Media to the Russian disinformation group Rybar, revealing its role in influencing Moldova's elections through deceptive tactics and social media. https://cyberscoop.com/researchers-say-media-outlet-targeting-moldova-is-russian-cutout/

💰 Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms – Krebs on Security cybercrime – U.S. prosecutors charged Thalha Jubair and Owen Flowers, members of the Scattered Spider group, with hacking and extorting over $115 million. Their operations involved significant cyberattacks against major retailers and transport systems. https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/

🚓 ‘Find My Parking Cops’ Tracks Officers Handing Out Tickets All Around San Francisco privacy – Riley Walz created 'Find My Parking Cops,' a site that maps San Francisco parking officers issuing tickets, helping users avoid fines. The city responded by altering access to public data. https://www.404media.co/find-my-parking-cops-tracks-officers-handing-out-tickets-all-around-san-francisco/

✈️ UK arrests man in airport ransomware attack that caused delays across Europe security news – A man was arrested in connection with a ransomware attack affecting multiple European airports, causing significant flight delays. The attack targeted the MUSE software, with reports suggesting simple ransomware tools were used. https://www.theverge.com/news/784786/uk-nca-europe-airport-cyberattack-ransomware-arrest

🔒 Volvo North America disclosed a data breach following a ransomware attack on IT provider Miljödata data breach – A ransomware attack on supplier Miljödata exposed personal data of Volvo North America employees, including names and Social Security numbers. Volvo is offering affected individuals 18 months of identity protection services. https://securityaffairs.com/182577/data-breach/volvo-north-america-disclosed-a-data-breach-following-a-ransomware-attack-on-it-provider-miljodata.html

🚨 Cybercrooks publish toddlers' data in 'reprehensible' attack data breach – The Radiant Group targeted Kido International, leaking sensitive data of toddlers and their parents, including names and addresses. Experts condemned the attack as a severe moral low for cybercriminals. https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/

☁️ DOGE might be storing every American’s SSN on an insecure cloud server privacy – Senate Democrats report that DOGE has transferred sensitive information, potentially including Social Security numbers, to a cloud server, raising concerns about catastrophic security risks. https://www.theverge.com/news/785706/doge-insecure-cloud-server-social-security-numbers

🔒 Viral call-recording app Neon goes dark after exposing users' phone numbers, call recordings, and transcripts data breach – The call-recording app Neon has been taken offline after a security flaw exposed users' phone numbers, call recordings, and transcripts. The founder announced the shutdown while failing to address the security lapse. https://techcrunch.com/2025/09/25/viral-call-recording-app-neon-goes-dark-after-exposing-users-phone-numbers-call-recordings-and-transcripts/


Some More, For the Curious

🤖 Researchers expose MalTerminal, an LLM malware – MalTerminal is the first known malware using LLM technology to create malicious code dynamically, complicating detection for defenders. Researchers highlight the evolving threat landscape with LLM-integrated attacks. https://securityaffairs.com/182433/malware/researchers-expose-malterminal-an-llm-enabled-malware-pioneer.html

⚖️ Modern Solution: Bundesverfassungsgerich bestätigt – Wegsehen ist sicherer als Aufdecken security news – Germany's courts penalize a security expert for exposing a major vulnerability in e-commerce software instead of holding the developer accountable, undermining responsible disclosure and IT security. https://www.kuketz-blog.de/modern-solution-bundesverfassungsgerich-bestaetigt-wegsehen-ist-sicherer-als-aufdecken/

💰 $150K awarded for L1TF Reloaded exploit that bypasses cloud mitigations vulnerability – Researchers earned $150K for exploiting L1TF Reloaded, leaking VM memory from public clouds despite mitigations. The attack demonstrates ongoing risks from transient CPU vulnerabilities. https://securityaffairs.com/182476/security/150k-awarded-for-l1tf-reloaded-exploit-that-bypasses-cloud-mitigations.html

📞 Secret Service says it dismantled extensive telecom threat in NYC area cybercrime – The Secret Service disrupted a telecom network in NYC, uncovering 300 servers and 100,000 SIM cards used for encrypted communications by threat actors. Concerns about potential disruptions during the U.N. General Assembly were raised. https://cyberscoop.com/secret-service-dismantles-nyc-telecom-threat-un-general-assembly/

🔓 Bypassing Mark of the Web (MoTW) via Windows Shortcuts (LNK): LNK Stomping Technique hacking write-up – The LNK Stomping technique exploits Windows shortcuts to bypass security checks by manipulating file metadata, allowing attackers to execute malicious payloads undetected. This method highlights the evolving nature of cyber threats. https://asec.ahnlab.com/en/90299/

⚠️ Critical Vulnerability in SolarWinds Web Help Desk vulnerability – SolarWinds disclosed a critical vulnerability (CVE-2025-26399) in its Web Help Desk, allowing unauthenticated remote code execution. Users are urged to update to the latest version immediately. https://cert.europa.eu/publications/security-advisories/2025-034/

🛡️ EDR Bypass Technique Uses Windows Functions to Put Antivirus Tools to Sleep security research – The EDR-Freeze technique allows attackers to bypass endpoint detection and response (EDR) tools by using Windows functions to suspend antivirus processes without installing vulnerable drivers. This new method enhances evasion tactics for threat actors. https://thecyberexpress.com/edr-bypass-technique-disables-antivirus/

⚠️ High Vulnerability in Cisco IOS and IOS XE Software warning – Cisco reported a high-severity vulnerability (CVE-2025-20352) in its IOS and IOS XE software SNMP subsystem, allowing remote code execution or denial of service. Immediate updates and security assessments are recommended. https://cert.europa.eu/publications/security-advisories/2025-035/

⚠️ Worries mount over max-severity GoAnywhere defect vulnerability – Concerns grow over a high-severity vulnerability (CVE-2025-10035) in GoAnywhere MFT, with evidence of active exploitation. Researchers criticize Forta for lack of transparency regarding the vulnerability's status. https://cyberscoop.com/goanywhere-vulnerability-active-exploitation-september-2025/

🔐 Critical Vulnerabilities in Cisco ASA and FTD warning – Cisco disclosed critical vulnerabilities (CVE-2025-20333, CVE-2025-20363, CVE-2025-20362) in its ASA and FTD software, allowing remote code execution. Immediate updates and compromise assessments are recommended. https://cert.europa.eu/publications/security-advisories/2025-036/


CISA Corner

🔒 SonicWall Releases Advisory for Customers after Security Incident security news – SonicWall alerts customers about a security incident where brute force attacks accessed cloud backup files. Users are urged to verify their account and follow guidance to secure their devices. https://www.cisa.gov/news-events/alerts/2025/09/22/sonicwall-releases-advisory-customers-after-security-incident 🔍 CISA Shares Lessons Learned from an Incident Response Engagement cyber defense – CISA's response to a cyber incident revealed critical vulnerabilities exploited via CVE 2024-36401. Key lessons include the importance of timely patching and robust incident response plans. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266a 🤞 CISA Directs Federal Agencies to Identify and Mitigate Potential Compromise of Cisco Devices security news – CISA issued Emergency Directive ED 25-03, urging federal agencies to address vulnerabilities in Cisco ASA and Firepower devices. Agencies must identify affected devices and transmit memory files for analysis by September 26. https://www.cisa.gov/news-events/alerts/2025/09/25/cisa-directs-federal-agencies-identify-and-mitigate-potential-compromise-cisco-devices

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2025-10585, a Google Chromium V8 Type Confusion Vulnerability, in its KEV Catalog due to active exploitation risks. Federal agencies must remediate identified vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ Dingtian DT-R002 vulnerability – Dingtian DT-R002 relay boards have critical vulnerabilities (CVE-2025-10879 and CVE-2025-10880) that allow unauthorized retrieval of credentials. Users are urged to restrict access and enhance security measures. https://www.cisa.gov/news-events/ics-advisories/icsa-25-268-01 ⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA issued six advisories detailing vulnerabilities in various Industrial Control Systems, including AutomationDirect and Mitsubishi Electric. Users are urged to review for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/23/cisa-releases-six-industrial-control-systems-advisories


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from Bruno's ramblings

Mosteiro do Crato

Five years later, we finally had proper vacations! 🎉 We chose the northern interior part of Alentejo because we had a voucher that covered most of the hotel cost, and we could use it to spend a few nights in the monastery of Crato, a breathtaking place that looks more like a castle. I highly recommend it if you want to spend some days in that area and can afford the prices. It even has a museum there that you can visit.

We only ended up staying one night because Chico, our cat, has some abandonment trauma, and we knew he would be stressed out while we were away. He had my parents to look out for him, and he's very comfortable around them, but he spent most of the time in the downstairs living room, where he usually spends very little time, switching between couches, waiting for us to come home, sometimes crying, and barely eating. 😿

Even if we only had two days to visit the area, and we wanted to go to the villages of Castelo de Vide and Marvão, we managed to find some spots with stunning views! 🤩 Some were plains, some were mountainous areas, but all were chef's kiss.

Castelo de Vide

Crato

The Roman Museum of Ammaia, in Marvão, is also worth a visit. The outside part is bare, but it has some cool stuff in the interior exhibit. It's just a shame I couldn't touch anything behind glass. 😭 I wanted to touch an amphora and some coins so much! I'm not joking!

Roman Museum of Ammaia

We did have issues finding a place to eat. Most of the restaurants in the center of each village were closed, even some that were suggested to me, and the few they had open had long queues. It's better to try and find something in the outskirts of the villages; you'll have slightly more options and far shorter waiting queues, if any.

Overall, even if exhausting, especially in Marvão, where you have to walk on foot to go up to the castle, you have several cool places to visit.

Marvão

Speaking of exhausting, I was cursing so much as I was walking to Marvão's castle, because it was making my legs feel like they were being ripped apart, that several other tourists, especially the Portuguese and Spanish ones, looked at me in a bit of a shock. That actually ended up making me laugh and helped me slightly distract from that insane pain.

This was out of character for me because, in a normal situation, I wouldn't subject myself to this. But the wife was super excited about this, so I chose to try and tough it up, knowing I would pay for it later. Well, I'm paying for it hard, but I don't regret it. Even I needed this!

All the photos here are mine. You can use them under the CC0 License.

#CasteloDeVide #Marvão #Alentejo #Vacations

 
Leia mais...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


News For All

✈️ Airlines Sell 5 Billion Plane Ticket Records to the Government For Warrantless Searching privacy – Major airlines are selling billions of ticket records to the government for warrantless monitoring, raising significant privacy concerns about surveillance of individuals' movements. https://www.404media.co/airlines-sell-5-billion-plane-ticket-records-to-the-government-for-warrantless-searching/

🔑 Password Security Part 2: The Human Factor – Password Patterns and Weaknesses cyber defense – Human behavior leads to predictable password patterns that compromise security. Organizations can mitigate risks through password policies, filtering, and multi-factor authentication, while credential audits reveal weaknesses. https://www.guidepointsecurity.com/blog/password-security-part-2-human-factor-patterns-weaknesses/

💼 Hackers steal millions of Gucci, Balenciaga, and Alexander McQueen customer records data breach – Hackers, identified as Shiny Hunters, stole personal data of millions from luxury brands Gucci, Balenciaga, and Alexander McQueen, including names and contact details, raising concerns about targeted scams. https://securityaffairs.com/182236/cyber-crime/hackers-steal-millions-of-gucci-balenciaga-and-alexander-mcqueen-customer-records.html

🦠 FileFix attacks trick victims into executing infostealers malware – The FileFix attack tricks victims into executing malware by posing as a Facebook security alert, leading to the installation of the StealC infostealer. This method has surged in popularity, emphasizing the need for improved anti-phishing training. https://www.theregister.com/2025/09/16/filefix_attacks_facebook_security_alert/

🤖 Millions turn to AI chatbots for spiritual guidance and confession privacy – Tens of millions are using AI chatbots for spiritual advice, with apps gaining popularity for their accessibility. However, concerns arise over their accuracy, privacy, and the nature of their responses. https://arstechnica.com/ai/2025/09/millions-turn-to-ai-chatbots-for-spiritual-guidance-and-confession/

🛡️ OpenAI to predict ages in bid to stop ChatGPT from discussing self harm with kids privacy – OpenAI is implementing age prediction and identity verification systems to protect minors after a lawsuit linked its chatbot to a teenager's suicide. The company prioritizes safety over privacy for younger users. https://therecord.media/openai-age-prediction-chatgpt-children-safety

🔒 Samsung patches zero-day security flaw used to hack into its customers' phones vulnerability – Samsung has patched a zero-day vulnerability that allowed hackers to remotely install malicious code on devices running Android 13 to 16, following a private alert from Meta and WhatsApp. https://techcrunch.com/2025/09/16/samsung-patches-zero-day-security-flaw-used-to-hack-into-its-customers-phones/

🔧 Apple addresses dozens of vulnerabilities in latest software for iPhones, iPads and Macs vulnerability – Apple's latest updates for iOS, iPadOS, and macOS patch multiple vulnerabilities, including some with potential root access, but no active exploits have been reported. Users can also update to earlier versions for critical patches. https://cyberscoop.com/apple-security-updates-september-2025/

⚖️ BreachForums founder resentenced to three years in prison cybercrime – Conor Brian Fitzpatrick, founder of the BreachForums cybercrime marketplace, was resentenced to three years in prison after a lenient initial sentence was overturned due to his lack of remorse and continued illegal activities. https://cyberscoop.com/conor-fitzpatrick-pompompurin-resetenced-breachforums/

🖥️ Consumer Reports asks Microsoft to keep supporting Windows 10 security news – Consumer Reports has urged Microsoft to continue supporting Windows 10, highlighting concerns about user security and compatibility as the transition to Windows 11 proceeds. https://www.theverge.com/news/779079/consumer-reports-windows-10-extended-support-microsoft

📰 Russian fake-news network back in action with 200+ new sites security news – A Russian troll farm has launched over 200 new fake news websites using AI to generate content, aiming to influence political discourse in multiple countries, including the US and Canada. https://www.theregister.com/2025/09/18/russian_fakenews_network/

🔒 10585 is the sixth actively exploited Chrome zero vulnerability – Google patched four vulnerabilities in Chrome, including the actively exploited zero-day CVE-2025-10585, a type confusion issue in the V8 engine, marking the sixth such vulnerability in 2025. https://securityaffairs.com/182322/uncategorized/cve-2025-10585-is-the-sixth-actively-exploited-chrome-zero-day-patched-by-google-in-2025.html

🛠️ Open-Source Tool Greenshot Hit by Severe Code Execution Vulnerability vulnerability – A critical vulnerability in Greenshot allows arbitrary code execution due to improper data handling, risking exploitation by local attackers. Users are urged to update to version 1.3.301 to mitigate the issue. https://thecyberexpress.com/greenshot-vulnerability/

📚 Librarians Are Being Asked to Find AI-Hallucinated Books security news – Librarians report increasing patron requests for non-existent books generated by AI, leading to confusion and diminished trust in information sources. The impact of generative AI on libraries raises concerns about information literacy and the quality of resources. https://www.404media.co/librarians-are-being-asked-to-find-ai-hallucinated-books/

🚆 ‘Scattered Spider’ teens charged over London transportation hack cybercrime – Two teenagers from the 'Scattered Spider' group have been charged in connection with a cyberattack that disrupted London's transportation systems, highlighting growing concerns about youth involvement in cybercrime. https://www.theverge.com/news/781039/scattered-spider-teens-charged-tfl-london-hack

✈️ Russia's main airport in St. Petersburg says its website was hacked security news – Pulkovo Airport in St. Petersburg experienced a cyberattack that took its website offline, although flight operations remained unaffected. This follows other disruptions in Russia's aviation sector amid rising cyberattacks since the Ukraine invasion. https://therecord.media/russia-pulkovo-airport-st-petersburg-website-hacked

👶 Watchdog finds MrBeast improperly collected children’s data privacy – The Children’s Advertising Review Unit found that YouTuber MrBeast collected children's data without parental consent, violating COPPA guidelines. He has since updated his data collection practices in response to the findings. https://therecord.media/watchdog-mrbeast-youtube-privacy-colection

🚗 JLR Cyberattack Becomes UK National Crisis cybercrime – The Jaguar Land Rover cyberattack has halted production, affecting over 200,000 workers and prompting government discussions for support. The incident, attributed to the Scattered Lapsus$ Hunters group, is causing significant financial losses. https://thecyberexpress.com/jlr-cyberattack-becomes-uk-national-crisis/

✈️ Hundreds of flights delayed at Heathrow and other airports after apparent cyberattack security news – A cyber-related incident involving Collins Aerospace led to significant flight delays at major European airports, including Heathrow, as airlines reverted to manual check-ins. Travelers are advised to arrive earlier for flights. https://techcrunch.com/2025/09/21/hundreds-of-flights-delayed-at-heathrow-and-other-airports-after-apparent-cyberattack/


Some More, For the Curious

🚨 T-1 month: Exchange Server 2016 and Exchange Server 2019 End of Support security news – Exchange Server 2016 and 2019 reach end of support on October 14, 2025, risking security vulnerabilities without updates. Users are urged to upgrade or migrate to Exchange Online. https://techcommunity.microsoft.com/blog/exchange/t-1-month-exchange-server-2016-and-exchange-server-2019-end-of-support/4453133

🕵️‍♂️ One Token to rule them all – obtaining Global Admin in every Entra ID tenant via Actor tokens vulnerability – A critical vulnerability in Entra ID allows attackers to impersonate Global Admins across tenants using undocumented Actor tokens. Microsoft swiftly fixed the issue, but risks remain. https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

💨 Hosting a WebSite on a Disposable Vape hacking write-up – An innovative project explores hosting a web server on a disposable vape's microcontroller, achieving surprisingly fast response times despite its limited specs. A humorous take on tech recycling! https://bogdanthegeek.github.io/blog/projects/vapeserver/

🔓 Windows Local Privilege Escalation through the bitpixie Vulnerability vulnerability – The bitpixie vulnerability allows attackers to bypass BitLocker encryption via a downgrade attack on Windows Boot Manager, risking unauthorized access. A Microsoft patch is available to mitigate this risk. https://blog.syss.com/posts/bitpixie/

🚨 China Imposes One-Hour Reporting Rule for Major Cybersecurity Incidents security news – China's new regulations mandate reporting severe cybersecurity incidents within one hour, enhancing enforcement following high-profile data breaches. Proposed law amendments suggest stricter penalties for non-compliance. https://thecyberexpress.com/china-cybersecurity-incident-reporting/

🛡️ Google Online Security Blog: Supporting Rowhammer research to protect the DRAM ecosystem security research – Google supports research on Rowhammer vulnerabilities in DRAM, leading to the development of test platforms and new attack patterns that expose weaknesses in existing mitigations, necessitating further improvements. http://security.googleblog.com/2025/09/supporting-rowhammer-research-to.html

🐍 Replicating Worm Hits 180+ Software Packages – Krebs on Security cybercrime – The Shai-Hulud worm has infected over 180 NPM packages, stealing credentials and publishing them on GitHub. It self-replicates, raising concerns over supply chain security in software development. https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/

🚫 Microsoft, Cloudflare shut down RaccoonO365 phishing domains cyber defense – Microsoft seized 338 domains linked to the RaccoonO365 phishing operation, led by Joshua Ogundipe, which sold phishing kits that compromised Microsoft 365 credentials. The takedown disrupts a major tool used by cybercriminals. https://www.theregister.com/2025/09/16/microsoft_cloudflare_shut_down_raccoono365/

💻 HybridPetya: The Petya/NotPetya copycat comes with a twist malware – ESET has identified a new ransomware called HybridPetya, which mimics NotPetya but can also compromise UEFI systems and exploit CVE‑2024‑7344 to bypass UEFI Secure Boot. It's not currently spreading in the wild. https://www.welivesecurity.com/en/videos/hybridpetya-petya-notpetya-copycat-twist/

🔓 Attack on SonicWall’s cloud portal exposes customers’ firewall configurations data breach – SonicWall confirmed a breach of its MySonicWall.com platform, exposing firewall configuration files of less than 5% of its customers. The incident highlights systemic security issues within the vendor's operations. https://cyberscoop.com/sonicwall-cyberattack-customer-firewall-configurations/

⛈️ Cloudflare DDoSed itself with React useEffect hook blunder security news – Cloudflare experienced an outage due to a coding error involving a React useEffect hook, which caused excessive API calls and overloaded its Tenant Service API. The incident sparked discussions on the proper use of useEffect in development. https://www.theregister.com/2025/09/18/cloudflare_ddosed_itself/

⚙️ SystemBC – Bringing the Noise security research – Lumen's Black Lotus Labs discovered the SystemBC botnet, leveraging over 80 C2s and primarily targeting VPS systems to create high-volume proxies for cybercriminal activities. The botnet is linked to various criminal groups and is being used alongside the REM Proxy service for malicious operations. https://blog.lumen.com/systembc-bringing-the-noise/

🔒 CISA Warns of New Malware Campaign Exploiting Ivanti EPMM Vulnerabilities vulnerability – CISA reports a malware campaign exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428), allowing unauthorized access and malware deployment. Organizations are urged to upgrade systems and implement security measures. https://thecyberexpress.com/cisa-mar-cve-2025-4427-28/

🔐 CVE-2025-10035: Critical Vulnerability in Fortra GoAnywhere MFT vulnerability – A critical vulnerability, CVE-2025-10035, has been identified in Fortra's GoAnywhere MFT software, potentially exposing sensitive data. Users are urged to apply patches immediately to mitigate risks. https://www.vulncheck.com/blog/cve-2025-10035-fortra-go-anywhere-mft

🤔 Future of CVE Program in limbo as CISA, board members debate path forward security news – The future of the CVE Program is under debate after a funding incident raised concerns about its management. CISA asserts its leadership role while board members advocate for a collaborative, globally-supported model. https://therecord.media/cve-program-future-limbo-cisa


CISA Corner

⚙️ CISA Releases Eight Industrial Control Systems Advisories vulnerability – CISA has issued eight advisories addressing vulnerabilities in various Industrial Control Systems, including products from Siemens, Schneider Electric, and Hitachi Energy, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/09/16/cisa-releases-eight-industrial-control-systems-advisories ⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA has issued nine advisories addressing vulnerabilities in various Industrial Control Systems, including products from Westermo, Schneider Electric, and Hitachi Energy, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/09/18/cisa-releases-nine-industrial-control-systems-advisories


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


Highlight

🤞 We Got Lucky: The Supply Chain Disaster That Almost Happened No summary here, just a recommendation to read https://www.aikido.dev/blog/we-got-lucky-the-supply-chain-disaster-that-almost-happened


News For All

💾 Signal introduces free and paid backup plans for your chats security news – Signal now allows users to back up chats for free and offers a paid plan for full media backups. This enhances its value for secure messaging amid privacy concerns. https://techcrunch.com/2025/09/08/signal-introduces-free-and-paid-backup-plans-for-your-chats/

📺 Plex admits breach of account details, hashed passwords data breach – Plex has warned users to reset passwords after a breach potentially exposed emails, usernames, and hashed passwords. While credit card data wasn't compromised, this incident echoes previous breaches. https://www.theregister.com/2025/09/09/plex_breach/

🏋️‍♂️ Call audio from gym members, employees in open database data breach – An unprotected AWS database exposed sensitive audio recordings of gym members discussing personal and financial information. This raises concerns about potential identity theft and social engineering attacks. https://www.theregister.com/2025/09/09/gym_audio_recordings_exposed/

🔒 Apple says the iPhone 17 comes with a massive security upgrade security news – Apple's iPhone 17 features Memory Integrity Enforcement, an always-on security measure aimed at complicating spyware development, enhancing user protection. https://www.theverge.com/news/775234/iphone-17-air-a19-memory-integrity-enforcement-mte-security

📱 Nepal lifts social media ban after deadly youth protests security news – Nepal has lifted a ban on social media platforms following violent protests that resulted in 29 deaths. The government faced criticism for the ban, deemed digital repression by rights groups. https://therecord.media/nepal-social-media-ban-lifted-after-deadly-protests

🚗 Jaguar Land Rover says data stolen in disruptive cyberattack data breach – Jaguar Land Rover reported a cyberattack that resulted in data theft and halted vehicle assembly lines. The extent of the stolen data and its impact on employees or customers remains unclear. https://techcrunch.com/2025/09/10/jaguar-land-rover-says-data-stolen-in-disruptive-cyberattack/

🖼️ Google Online Security Blog: How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials security news – Google's Pixel and Android devices now utilize C2PA Content Credentials to enhance image authenticity, providing users with verifiable trust in their images and combating misinformation. http://security.googleblog.com/2025/09/pixel-android-trusted-images-c2pa-content-credentials.html

🔐 Brussels faces privacy crossroads over encryption backdoors privacy – Europe debates legislation requiring scanning of user content for child abuse, raising concerns over privacy and security. Critics argue it could lead to false accusations and a significant erosion of digital rights. https://www.theregister.com/2025/09/11/eu_chat_control/

💻 Kids in the UK are hacking their own schools for dares and notoriety cybercrime – The ICO reports that over half of personal data breaches in UK schools are caused by students, often through weak passwords and lax security practices. https://techcrunch.com/2025/09/11/kids-in-the-uk-are-hacking-their-own-schools-for-dares-and-notoriety/

🛡️ FTC opens inquiry into how AI chatbots impact child safety, privacy privacy – The FTC is investigating how major tech companies protect children using AI chatbots, focusing on safety measures and privacy practices. This follows concerns over negative impacts, including a tragic suicide case linked to a chatbot. https://therecord.media/ftc-opens-inquiry-ai-chatbots-kids

⚠️ Apple issues spyware warnings as CERT warning – Apple has issued alerts about a spyware campaign affecting iCloud-linked devices, confirmed by France's CERT-FR. Notifications indicate potential compromises, often involving sophisticated attacks with zero-day vulnerabilities. https://securityaffairs.com/182129/malware/apple-issues-spyware-warnings-as-cert-fr-confirms-attacks.html

🔒 Swiss government looks to undercut privacy tech, stoking fears of mass surveillance privacy – The Swiss government plans to require service providers to collect IDs, retain user data for six months, and potentially disable encryption, raising concerns over mass surveillance and the impact on privacy tech companies. https://therecord.media/switzerland-digital-privacy-law-proton-privacy-surveillance

🔒 Samsung fixed actively exploited zero vulnerability – Samsung patched the CVE-2025-21043 zero-day vulnerability, allowing remote code execution on Android devices. The flaw was exploited in attacks without user interaction, raising concerns over security. https://securityaffairs.com/182135/hacking/samsung-fixed-actively-exploited-zero-day.html

⚖️ Hacker convicted of extorting 20,000 psychotherapy victims walks free during appeal cybercrime – Aleksanteri Kivimäki, convicted of extorting over 20,000 psychotherapy clients, was released on appeal while his case continues. The hack has deeply impacted Finnish society, with many victims still suffering. https://therecord.media/finland-vastaamo-hacker-free-during-appeal-conviction

🧺 Dutch students denied access to jailbroken laundry machines security news – Over 1,250 University of Amsterdam students are without laundry services after a cyberattack compromised smart machines, allowing free washing. Management company Duwo refuses to restore the service due to costs. https://www.theregister.com/2025/09/12/jailbroken_laundry_machines/

🔓 Vietnam, Panama governments suffer incidents leaking citizen data data breach – Vietnam's National Credit Information Center suffered a data breach, with hackers claiming to have stolen 160 million records. Meanwhile, Panama's Ministry of Economy and Finance reported a cyberattack, with the INC ransomware gang claiming to have stolen 1.5 terabytes of data. https://therecord.media/vietnam-cic-panama-finance-ministry-cyberattacks

🚆 British rail passengers urged to stay on guard after hack signals failure data breach – LNER warns passengers of a data breach involving a third-party supplier, exposing contact details and journey information. Customers are advised to be cautious of unsolicited communications, although no payment details were compromised. https://www.bitdefender.com/en-us/blog/hotforsecurity/british-rail-passengers-hack-signals-failure


Some More, For the Curious

🎢 Exploiting the Impossible: A Deep Dive into A Vulnerability Apple Deems Unexploitable vulnerability – A deep dive reveals a race condition in Apple's file-copy API that could be exploited, challenging Apple's belief that it was unexploitable. This vulnerability poses significant security risks. https://jhftss.github.io/Exploiting-the-Impossible/

🐱‍👤 Break The Protective Shell Of Windows Defender With The Folder Redirect Technique hacking write-up – This article details a method for exploiting Windows Defender's update mechanism through symbolic links, allowing attackers to control its execution folder and potentially disable the antivirus. https://www.zerosalarium.com/2025/09/Break-Protective-Shell-Windows-Defender-Folder-Redirect-Technique-Symlink.html

🔓 Hackers breached Salesloft ’s GitHub in March, and used stole tokens in a mass attack security news – Salesloft's GitHub was breached by hackers who stole tokens, leading to a mass attack on major clients like Google and Cloudflare. Security measures are now in place after a lengthy detection delay. https://securityaffairs.com/182002/hacking/hackers-breached-salesloft-s-github-in-march-and-used-stole-tokens-in-a-mass-attack.html

💻 18 Popular Code Packages Hacked, Rigged to Steal Crypto – Krebs on Security malware – Eighteen widely-used JavaScript packages were compromised to steal cryptocurrency after a developer was phished. Experts warn that such supply chain attacks could lead to more severe malware outbreaks. https://krebsonsecurity.com/2025/09/18-popular-code-packages-hacked-rigged-to-steal-crypto/

🕵️‍♂️ Detecting Active Directory Password-Spraying with a Honeypot Account cyber defense – This article outlines a method to detect password-spraying attacks using a honeypot account, reducing false positives by monitoring logon attempts specifically associated with this account. https://trustedsec.com/blog/detecting-password-spraying-with-a-honeypot-account

🔧 Zero Day Initiative — The September 2025 Security Update Review vulnerability – September updates include Adobe's fixes for 22 CVEs across various products, and Microsoft's 80 CVEs, featuring Critical vulnerabilities like remote code execution. No active exploitation noted. https://www.thezdi.com/blog/2025/9/9/the-september-2025-security-update-review

⚠️ SAP warns of high-severity vulnerabilities in multiple products vulnerability – SAP has identified multiple high-severity vulnerabilities, including a critical flaw rated 10 in NetWeaver, allowing unauthenticated command execution. Immediate patching is advised to prevent exploitation. https://arstechnica.com/security/2025/09/as-hackers-exploit-one-high-severity-sap-flaw-company-warns-of-3-more/

🎓 The State of Ransomware in Education 2025 security research – Sophos' study reveals evolving ransomware threats in education, highlighting phishing and exploited vulnerabilities as primary attack vectors. Recovery efforts decline while ransom demands and payments drop significantly, indicating growing resilience. https://news.sophos.com/en-us/2025/09/10/the-state-of-ransomware-in-education-2025/

😅 The npm incident frightened everyone, but ended up being nothing to fret about cybercrime – An npm account compromise led to malicious code injection in popular packages, causing initial panic. However, the attack's impact was minimal, quickly contained, and the community's response proved effective. https://cyberscoop.com/open-source-npm-package-attack/

🐛 ChillyHell modular macOS malware OKed by Apple in 2021 malware – ChillyHell, a modular macOS backdoor that passed Apple's notarization, has likely infected systems undetected since 2021. Its advanced features include multiple persistence methods and command-and-control protocols. https://www.theregister.com/2025/09/10/chillyhell_modular_macos_malware/

🔍 Do we invest too much in risk assessments and too little in security? cyber defense – Organizations should prioritize basic security controls over risk assessments. A structured approach involves establishing foundational security, followed by managed capabilities and risk-based enhancements to improve overall security posture. https://safecontrols.blog/2025/09/10/do-we-invest-too-much-in-risk-assessments-and-too-little-in-security/

☁️ VMSCAPE Spectre vulnerability leaks cloud secrets vulnerability – ETH Zurich researchers have discovered the VMSCAPE vulnerability, a Spectre-based exploit that allows cloud users to leak secrets from the hypervisor on AMD and Intel CPUs without code changes. Software mitigations are required to address the issue. https://www.theregister.com/2025/09/11/vmscape_spectre_vulnerability/

🦠 SonicWall firewalls targeted by fresh Akira ransomware surge cybercrime – Researchers warn of a surge in Akira ransomware attacks exploiting a year-old vulnerability in SonicWall firewalls. Improper configurations and failure to reset passwords have exacerbated the issue, with multiple organizations affected. https://cyberscoop.com/sonicwall-akira-ransomware-attacks-surge/

💻 HybridPetya ransomware dodges UEFI Secure Boot malware – HybridPetya, a new ransomware strain, exploits a vulnerability to bypass UEFI Secure Boot on Windows systems. While currently a proof-of-concept, it demonstrates significant technical capabilities, including MFT encryption. https://www.theregister.com/2025/09/12/hopefully_just_a_poc_hybridpetya/


CISA Corner

⚙️ CISA Releases Fourteen Industrial Control Systems Advisories vulnerability – CISA issued fourteen advisories detailing vulnerabilities in various Industrial Control Systems, including multiple Rockwell Automation products. Users are urged to review these for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/09/cisa-releases-fourteen-industrial-control-systems-advisories ⚙️ CISA Releases Eleven Industrial Control Systems Advisories vulnerability – CISA issued eleven advisories on September 11, 2025, detailing vulnerabilities in various ICS products, primarily from Siemens and Schneider Electric. Users are urged to review these advisories for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/09/11/cisa-releases-eleven-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-5086, a deserialization vulnerability in Dassault Systèmes DELMIA Apriso, to its KEV Catalog due to active exploitation risks. Federal agencies are required to remediate identified vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2025/09/11/cisa-adds-one-known-exploited-vulnerability-catalog


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from Sirius

Destruição de Leviatã -gravura de Gustave Doré Outro dia desses estava lendo “homo bolsonarus” do Renato Lessa (disponibilizado de graça na rede) e uma das coisas que acho instigante no texto é a concepção de que o bolsonarismo é uma instituição.

Lessa fala sobre como Hobbes observou a capacidade humana de produzir “animais artificiais”, que são as instituições.

Nem todo animal artificial que criamos, por certo, precisa ser necessariamente uma besta perversa. Também é possível ver uma luta entre estes constructos animais (mas não no estilo duelo Pokemon). Inclusive estamos assistindo na atualidade as instituições oficiais do Judiciário e PGR (antes leniente sob o comando de Augusto Aras) combatendo a besta bolsonarista.

Mas deixando de lado a atenção principal do texto do professor, o bolsonarismo, o que mais gostei foi a dica final, de que podemos criar outras instituições! E acrescento que nossos animais artificiais não necessitam ser estatais.

O Poder Central é expressivo, mas também é limitado, uma instituição precisa mesmo é ter um “discurso forte”, capaz de reunir as pessoas em torno de convicções e crenças sólidas.

Este fediverso, por exemplo, é a infraestrutura de uma instituição, de um animal artificial que criamos. Não é estatal, não criamos um Leviatã, nem é um passarinho ou uma borboleta, de propriedade capitalista. Alguns de nós chamam de mastodonte, mas sabemos que é maior que isso.

Nesse caso específico, ademais, nós, que alimentamos nosso bichinho, precisamos tornar esse discurso mais forte para dar mais consistência às crenças que sustentam essa instituição (informação, diálogos, comunicação públicas, abertas, descentralizadas, etc.).

Quando o bolsonarismo alcançou o Poder Executivo (além de parcela relevante das cadeiras do Congresso) por certo ele ganhou mais força e foram quatro anos sofridos, com direito a uma pandemia mundial para a besta fazer mais vítimas…

Mas só conseguiu alcançar o executivo por ser uma instituição forte, independentemente do Poder Central, que canalizava as emoções e crenças de muitas pessoas!

O poder parcial conquistado com a eleição e ascensão ao executivo federal teve também um aspecto limitador. A estrutura de Separação dos Poderes fez a criatura guinchar de ódio e se queixar que o Judiciário não a deixava desgovernar em paz… Até mesmo o Legislativo exigia muitas emendas e não admitia todas as vontades da besta.

O que gostaria de ressaltar, contudo, é que estas experiências nos mostram que também podemos cristalizar nossas crenças em uma humanidade não alienada, não oprimida, livre do jugo do poder financeiro e da vigilância do capitalismo atual, por meio de novos constructos animais!

Para tanto precisamos de união, cooperação, consenso, diálogo, respeito, técnica politica e, principalmente, praticar a experimentação e a criatividade.

Comente este humilde ensaio aqui

#instituições #fediverso #bolsonarismo

 
Leia mais...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


News For All

🤖 Microsoft launches Copilot AI function in Excel, but warns not to use it in 'any task requiring accuracy or reproducibility' security news – Microsoft's new Copilot AI for Excel simplifies formula generation but raises concerns about accuracy and privacy, warning against use in critical tasks. https://www.pcgamer.com/software/ai/microsoft-launches-copilot-ai-function-in-excel-but-warns-not-to-use-it-in-any-task-requiring-accuracy-or-reproducibility/

🔑 CERT.at Ewig ruft das Passwort warning – The article discusses the persistent reliance on passwords, their vulnerabilities, and the importance of robust security measures, including monitoring leaks and implementing two-factor authentication. https://www.cert.at/de/blog/2025/8/ewig-ruft-das-passwort

🏨 Attackers Target Hotelier Accounts in Malvertising and Phishing Campaign cybercrime – A phishing campaign impersonating hotel service providers uses malvertising to harvest credentials and bypass MFA, targeting cloud-based property management systems and exploiting user trust. https://sec.okta.com/articles/2025/08/attackers-target-hotelier-accounts-in-broad-phishing-campaign/

📱 Malicious apps with +19M installs removed from Google Play because spreading Anatsa banking trojan and other malware malware – Experts discovered 77 malicious Android apps on Google Play, collectively installed over 19 million times, spreading the Anatsa banking trojan and other malware, highlighting significant risks for users. https://securityaffairs.com/181528/malware/malicious-apps-with-19m-installs-removed-from-google-play-because-spreading-anatsa-banking-trojan-and-other-malware.html

📷 CBP Had Access to More than 80,000 Flock AI Cameras Nationwide privacy – Customs and Border Protection accessed over 80,000 Flock ALPR cameras across the U.S., revealing extensive data-sharing practices with local police departments unaware of the collaboration. https://www.404media.co/cbp-had-access-to-more-than-80-000-flock-ai-cameras-nationwide/

🛒 Auchan discloses data breach: data of hundreds of thousands of customers exposed data breach – Auchan reported a data breach affecting hundreds of thousands of customers, exposing personal information linked to loyalty cards, while assuring that sensitive banking data was not compromised. https://securityaffairs.com/181556/data-breach/auchan-discloses-data-breach-data-of-hundreds-of-thousands-of-customers-exposed.html

🆔 FBI, Dutch cops seize fake ID marketplace that sold identity docs for $9 cybercrime – Authorities have shut down VerifTools, a major marketplace for fake IDs, which facilitated identity theft and fraud. The seizure is seen as a significant blow against online crime. https://www.theregister.com/2025/08/28/fbi_dutch_cops_seize_veriftools/

🤖 Not in my browser! Vivaldi capo doubles down on generative AI ban privacy – Vivaldi's CEO opposes integrating generative AI in browsers, arguing it threatens user control and web diversity. He emphasizes prioritizing human interaction over automated solutions. https://www.theregister.com/2025/08/28/vivaldi_capo_doubles_down_on/

🕵️‍♂️ TransUnion says hackers stole 4.4 million customers’ personal information data breach – TransUnion has revealed a breach affecting 4.4 million customers, with sensitive data including names and Social Security numbers compromised. The company provides little clarity on the incident. https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information/

🚗 Security researcher maps hundreds of TeslaMate servers spilling Tesla vehicle data security research – A security researcher discovered over 1,300 publicly exposed TeslaMate servers leaking sensitive vehicle data, urging users to secure their dashboards to prevent unauthorized access. https://techcrunch.com/2025/08/26/security-researcher-maps-hundreds-of-teslamate-servers-spilling-tesla-vehicle-data/

🤦 OpenAI admits ChatGPT safeguards fail during extended conversations security news – OpenAI acknowledged failures in ChatGPT's safety measures during long conversations, which may lead to harmful guidance, following a lawsuit linked to a user's suicide after extensive interactions with the AI. https://arstechnica.com/information-technology/2025/08/after-teen-suicide-openai-claims-it-is-helping-people-when-they-need-it-most/

🔒 DOGE uploaded live copy of Social Security database to 'vulnerable' cloud server, says whistleblower data breach – A whistleblower claims the Department of Government Efficiency uploaded sensitive Social Security data to a vulnerable cloud server, risking the personal information of millions of Americans. https://techcrunch.com/2025/08/26/doge-uploaded-live-copy-of-social-security-database-to-vulnerable-cloud-server-says-whistleblower/

📄 Hackers use fake NDAs to deliver malware to US manufacturers cybercrime – Hackers are targeting U.S. manufacturers by using website contact forms to deliver malware disguised as non-disclosure agreements, maintaining engagement to appear credible and leveraging legitimate cloud services. https://therecord.media/hackers-fake-ndas-malware

🚴‍♂️ Developer Unlocks Newly Enshittified Echelon Exercise Bikes But Can't Legally Release His Software security news – An app developer jailbroke Echelon exercise bikes to restore offline functionality after a controversial firmware update, but copyright laws prevent him from legally sharing the software. https://www.404media.co/developer-unlocks-newly-enshittified-echelon-exercise-bikes-but-cant-legally-release-his-software/

💰 Euro banks block 'unauthorized' PayPal direct debits cybercrime – German banks froze billions in PayPal transactions due to unauthorized direct debits linked to a fraud-detection failure, impacting transactions primarily in Germany, though PayPal claims the issue is resolved. https://www.theregister.com/2025/08/28/euro_banks_block_paypal_direct_debits/

🛡️ 200 Swedish municipalities impacted by a major cyberattack on IT provider cybercrime – A cyberattack on Miljödata disrupted services across over 200 Swedish municipalities, raising concerns about stolen sensitive data and leading to a police investigation and reports of extortion. https://securityaffairs.com/181668/security/200-swedish-municipalities-impacted-by-a-major-cyberattack-on-it-provider.html

🎰 Affiliates Flock to ‘Soulless’ Scam Gambling Machine – Krebs on Security cybercrime – A new Russian affiliate program, Gambler Panel, has led to the rise of scam gambling sites that lure users with fake promotions and steal cryptocurrency deposits, operating under the guise of legitimate gaming. https://krebsonsecurity.com/2025/08/affiliates-flock-to-soulless-scam-gambling-machine/

🔒 WhatsApp fixes 'zero-click' bug used to hack Apple users with spyware vulnerability – WhatsApp addressed a zero-click vulnerability (CVE-2025-55177) in its iOS and Mac apps, exploited alongside an Apple flaw to stealthily hack targeted users' devices, allowing data theft without interaction. https://techcrunch.com/2025/08/29/whatsapp-fixes-zero-click-bug-used-to-hack-apple-users-with-spyware/


Some More, For the Curious

🎣 Phishing Emails Are Now Aimed at Users and AI Defenses security research – New phishing tactics not only deceive users but also target AI defenses with hidden prompts, complicating automated threat detection and increasing risks. https://malwr-analysis.com/2025/08/24/phishing-emails-are-now-aimed-at-users-and-ai-defenses/

🔥 Citrix forgot to tell you CVE-2025–6543 has been used as a zero day since May 2025 vulnerability – Citrix's CVE-2025–6543 vulnerability, exploited for remote code execution, has led to severe breaches in Netscaler systems, highlighting a lack of transparency and response from Citrix. https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

🐳 Docker fixes critical Desktop flaw allowing container escapes vulnerability – Docker patched a critical vulnerability (CVE-2025-9074) in Docker Desktop that allowed attackers to escape containers and access the Docker Engine API, risking host file access. https://securityaffairs.com/181545/security/docker-fixes-critical-desktop-flaw-allowing-container-escapes.html

🗣️ With AI chatbots, Big Tech is moving fast and breaking people privacy – AI chatbots are creating harmful feedback loops for vulnerable users, validating false beliefs and grandiose fantasies, leading to serious psychological risks and an urgent need for regulation and user education. https://arstechnica.com/information-technology/2025/08/with-ai-chatbots-big-tech-is-moving-fast-and-breaking-people/

🔓 Widespread Data Theft Targets Salesforce Instances via Salesloft Drift vulnerability – A data theft campaign exploited OAuth tokens in Salesloft Drift to access Salesforce customer data, prompting security measures and warnings for all users to review integrations and credentials. https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift/

🕵️‍♂️ DSLRoot, Proxies, and the Threat of ‘Legal Botnets’ – Krebs on Security cybercrime – A Redditor's arrangement with DSLRoot, a residential proxy service, raises concerns about security risks, revealing the company's questionable origins and the emergence of 'legal botnets' exploiting residential connections. https://krebsonsecurity.com/2025/08/dslroot-proxies-and-the-threat-of-legal-botnets/

🔑 Goodbye Legacy MFA: Be Ready for the new Microsoft Authentication Methods Policy security news – Microsoft will retire legacy MFA and SSPR policies on September 30, 2025, transitioning to a unified Authentication Methods policy to enhance security and simplify management for organizations. https://www.guidepointsecurity.com/blog/goodbye-legacy-mfa-new-microsoft-authentication-methods-policy/

💻 First known AI-powered ransomware uncovered by ESET Research malware – ESET researchers discovered PromptLock, the first known AI-powered ransomware capable of exfiltrating and encrypting data, showcasing the potential for AI tools to enhance ransomware attacks. https://www.welivesecurity.com/en/ransomware/first-known-ai-powered-ransomware-uncovered-eset-research/

⚙️ Nx NPM packages poisoned in AI-assisted supply chain attack malware – Nx suffered a supply chain attack with malicious NPM packages that harvested developer credentials, exposing over 1,000 GitHub tokens and 20,000 files, utilizing AI tools for reconnaissance. https://www.theregister.com/2025/08/27/nx_npm_supply_chain_attack/

☎️ Experts warn of actively exploited FreePBX zero-day vulnerability – A serious zero-day vulnerability in FreePBX is being exploited, allowing unauthorized access to systems. Users are advised to update their software and restrict admin panel access. https://securityaffairs.com/181693/hacking/experts-warn-of-actively-exploited-freepbx-zero-day.html

🔒 Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE vulnerability – More than 28,200 Citrix NetScaler instances are vulnerable to the critical RCE flaw CVE-2025-7775, which is actively exploited, prompting CISA to mandate fixes by August 28, 2025. https://securityaffairs.com/181614/hacking/over-28000-citrix-instances-remain-exposed-to-critical-rce-flaw-cve-2025-7775.html

🔑 Unpacking Passkeys Pwned: Possibly the most specious research in decades security research – SquareX's claim of a major vulnerability in passkeys, dubbed 'Passkeys Pwned,' misrepresents the FIDO spec and highlights risks from compromised devices rather than the security of passkeys themselves. https://arstechnica.com/security/2025/08/new-research-claiming-passkeys-can-be-stolen-is-pure-nonsense/

💻 Ransomware gang takedowns causing explosion of new, smaller groups cybercrime – The ransomware landscape is rapidly evolving, with over 40 new gangs emerging due to law enforcement actions against larger groups, leading to increased fragmentation and a rise in smaller, independent operations. https://therecord.media/ransomware-gang-takedown-proliferation


CISA Corner

⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has included three new vulnerabilities in its KEV Catalog due to active exploitation, highlighting significant risks to federal networks and the need for prompt remediation. https://www.cisa.gov/news-events/alerts/2025/08/25/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a new vulnerability, CVE-2025-7775, related to Citrix NetScaler, to its KEV Catalog, highlighting significant risks for federal networks and the need for prompt remediation. https://www.cisa.gov/news-events/alerts/2025/08/26/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-57819, an authentication bypass vulnerability in Sangoma FreePBX, to its Known Exploited Vulnerabilities Catalog due to active exploitation. https://www.cisa.gov/news-events/alerts/2025/08/29/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA issued three advisories on security vulnerabilities in Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/08/26/cisa-releases-three-industrial-control-systems-advisories ⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA issued nine advisories on August 28, 2025, detailing vulnerabilities and exploits affecting various Industrial Control Systems, urging users to review for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/08/28/cisa-releases-nine-industrial-control-systems-advisories

🔍 Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System cybercrime – PRC state-sponsored cyber actors are targeting global networks, particularly in telecommunications and government sectors, employing sophisticated techniques to maintain long-term access and facilitate espionage, prompting a cybersecurity advisory from multiple agencies. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from beverageNotes

Cracked open an Elijah Craig Barrel Proof batch A125. It's a 10 year, 7 month aged product weighing in at 118.2 proof.

Smell some cinnamon, oak, and hints of cardamom and amburana.

First sip, sans water or ice—which I'm sure I'll need!—, reminds me of amburana aged whiskies. Some leather. Didn't pick up a lot of strong flavors. The swallow is fire. Moving straight to some water! LOL.

After adding some filtered water, I pick up some caramel creme brûlée. The heat dies down, but still lingers. Smell of amburana has intensified—which may or may not be psychosomatic, I really like the smell. Next sips pick up some cherry. The finish seems to hint at some citrus. Still quite hot, so time to try out some ice.

Smells much sweeter after adding some ice... ...honey, maybe? Pick up more cherry with a “brighter” sip. The finish is reminiscent of a cab or a Barolo. Not the tannin bit.

An interesting dram. Off to just enjoy it.

Cheers!

 
Read more...

from 📰wrzlbrmpft's cyberlights💥

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!


News For All

🚦 Dutch prosecution service attack keeps speed cameras offline cybercrime – A cyberattack on the Dutch Public Prosecution Service has left numerous speed cameras offline. While the attack didn't target the cameras directly, it hampers their reactivation due to system interconnectivity. https://www.theregister.com/2025/08/15/cyberattack_on_dutch_prosecution_service/

🎟️ Gefälschtes Gewinnspiel für Wiener Linien Jahreskarte im Umlauf warning – Fake Facebook posts are promoting a bogus contest for a Wiener Linien half-year ticket. The scam aims to steal credit card and personal information through a deceptive website. https://www.watchlist-internet.at/news/gefaelschtes-gewinnspiel-fuer-wiener-linien-jahreskarte-im-umlauf/

🔒 Multiple Vulnerabilities in Microsoft Products warning – Microsoft's August 2025 Patch Tuesday advisory addresses 111 security vulnerabilities, with 16 critical ones. Users are urged to update systems promptly, especially public-facing assets. https://cert.europa.eu/publications/security-advisories/2025-032/

🤖 Grok Exposes Underlying Prompts for Its AI Personas: ‘EVEN PUTTING THINGS IN YOUR ASS’ security research – Elon Musk's AI chatbot Grok has revealed prompts for its various personas, including a conspiracist character. This exposure raises concerns about the chatbot's design and potential influence on users. https://www.404media.co/grok-exposes-underlying-prompts-for-its-ai-personas-even-putting-things-in-your-ass/

🔓 HR giant Workday says hackers stole personal data in recent breach data breach – Workday confirmed a data breach involving the theft of personal information from a third-party database, raising concerns about potential social engineering scams. Details on affected individuals remain unclear. https://techcrunch.com/2025/08/18/hr-giant-workday-says-hackers-stole-personal-data-in-recent-breach/

🔐 Allianz Life data breach affects 1.1 million customers data breach – A data breach at Allianz Life has compromised the personal information of 1.1 million customers, including Social Security numbers. The breach is linked to the hacking group ShinyHunters. https://techcrunch.com/2025/08/18/allianz-life-data-breach-affects-1-1-million-customers/

🔑 UK drops demand for backdoor into Apple encryption privacy – The UK government has abandoned its demand for a backdoor into Apple’s encryption, potentially allowing Apple to restore Advanced Data Protection (ADP) iCloud encryption services in the UK. https://www.theverge.com/news/761240/uk-apple-us-encryption-back-door-demands-dropped

🚓 Speed cameras knocked out after cyber attack security news – A cyberattack on the Netherlands' Public Prosecution Service has rendered many speed cameras inoperable, impacting road safety and delaying legal proceedings as the organization remains offline. https://www.bitdefender.com/en-us/blog/hotforsecurity/speed-cameras-knocked-out-after-cyber-attack

🎤 Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator cybercrime – Authorities have taken control of the powerful Rapper Bot DDoS botnet and charged its developer, Ethan Foltz, with aiding computer intrusions. The botnet conducted over 370,000 attacks worldwide since 2021. https://cyberscoop.com/rapper-bot-ddos-botnet-disrupted/

💊 Pharmaceutical firm Inotiv discloses ransomware attack. Qilin group claims responsibility for the hack data breach – Inotiv has reported a ransomware attack that encrypted systems and disrupted operations. The Qilin group claimed responsibility, alleging they stole 176GB of data from the firm. https://securityaffairs.com/181311/data-breach/pharmaceutical-firm-inotiv-discloses-ransomware-attack-qilin-group-claims-responsibility-for-the-hack.html

⚠️ Critical Chrome Flaw CVE‑2025‑9132 Exposes Browsers to Remote Code Execution vulnerability – A remote code execution flaw in Google Chrome, CVE-2025-9132, was discovered in the V8 JavaScript engine, allowing attackers to execute arbitrary code. Users are urged to update to version 139.0.7258.138 or later to mitigate risks. https://thecyberexpress.com/chrome-v8-vulnerability-cve%E2%80%912025%E2%80%919132/

🍔 McDonald's not lovin' it when hacker exposes rotten security security news – A white-hat hacker uncovered severe security flaws in McDonald's portals, enabling free food orders and access to sensitive data. The company has since made some fixes but still lacks a proper security disclosure process. https://www.theregister.com/2025/08/20/mcdonalds_terrible_security/

🤦‍♂Researcher Exposes Zero-Day Clickjacking Vulnerabilities in Major Password Managers vulnerability – A researcher revealed serious clickjacking vulnerabilities in popular password managers, enabling hackers to easily steal sensitive data if users visit malicious sites. Many remain unpatched. https://socket.dev/blog/password-manager-clickjacking

📞 Major Belgian telecom firm says cyberattack compromised data on 850,000 accounts data breach – Orange Belgium reported a cyberattack that compromised data from 850,000 customer accounts, including names and phone numbers. No critical data like passwords or financial details were hacked. https://therecord.media/belgian-telecom-says-cyberattack-compromised-data-on-850000

👓 Harvard dropouts to launch 'always on' AI smart glasses that listen and record every conversation privacy – Former Harvard students are launching Halo X, AI-powered smart glasses that record conversations and provide real-time information. Privacy advocates raise concerns about covert recording and consent laws. https://techcrunch.com/2025/08/20/harvard-dropouts-to-launch-always-on-ai-smart-glasses-that-listen-and-record-every-conversation/

📸 'Screenshot-grabbing' Chrome VPN extension still available privacy – The FreeVPN.One Chrome extension has been found capturing users' screenshots and sending them to a remote server without consent. Despite warnings, it remains available on the Chrome Web Store. https://www.theregister.com/2025/08/21/freevpn_privacy_research/

🕵️‍♂️ Hackers who exposed North Korean government hacker explain why they did it cybercrime – Two hackers infiltrated a North Korean government hacker's computer, uncovering evidence of cyberespionage. They decided to leak their findings to expose the operations and help victims, despite legal risks. https://techcrunch.com/2025/08/21/hackers-who-exposed-north-korean-government-hacker-explain-why-they-did-it/

🔒 Apple rushes out fix for active zero-day in iOS and macOS vulnerability – Apple released emergency updates for a zero-day vulnerability in its ImageIO framework, allowing potential device hijacking through malicious image files. The flaw has reportedly been exploited in targeted attacks. https://www.theregister.com/2025/08/21/apple_imageio_exploit/

🎥 Real Footage Combined With AI Slop About DC Is Creating a Disinformation Mess on TikTok security news – TikTok is flooded with misleading videos combining real and AI-generated footage about the National Guard's actions in D.C., complicating viewers' ability to discern truth from misinformation amidst a trending disinformation campaign. https://www.404media.co/real-footage-combined-with-a-ai-slop-about-dc-is-creating-a-disinformation-mess-on-tiktok/

🔍 Criminal background checker APCS faces data breach data breach – Access Personal Checking Services (APCS) is managing a data breach linked to a third-party developer, Intradev, which compromised customer data including personal details. An investigation is ongoing. https://www.theregister.com/2025/08/22/apcs_breach/

🚨 Europol says Telegram post about 50,000 Qilin ransomware award is fake cybercrime – A fake Telegram post claimed Europol was offering a $50,000 reward for information on Qilin ransomware gang members. Europol confirmed the announcement was false and originated from a newly created account. https://www.bitdefender.com/en-us/blog/hotforsecurity/europol-says-telegram-post-about-50-000-qilin-ransomware-award-is-fake

🏥 DaVita tells 2.4M people ransomware scum stole health data data breach – DaVita confirmed a ransomware breach affecting 2.4 million individuals, compromising sensitive health and personal information. The Interlock ransomware gang is suspected to be behind the attack. https://www.theregister.com/2025/08/22/davita_ransomware_infection/


Some More, For the Curious

🏢 Coinbase CEO says he's mandating in-person orientation to combat North Korean hackers seeking remote jobs security news – Coinbase is shifting to in-person orientations to prevent North Korean hackers from exploiting remote work. New policies include US citizenship requirements and stricter security measures. https://www.businessinsider.com/coinbase-north-korea-threats-remote-work-2025-8

🎭 How attackers are using Active Directory Federation Services to phish with legit office.com links security research – Phishers exploit Microsoft services by redirecting users from legitimate links to malicious sites, utilizing techniques like ADFSjacking. This complicates detection efforts and highlights the growing threat landscape. https://pushsecurity.com/blog/phishing-with-active-directory-federation-services/

🔍 How Researchers Collect Indicators of Compromise cyber defense – Security researchers analyze malware like Snake Keylogger to gather indicators of compromise and create detection signatures. They focus on exfiltration techniques and utilize tools to improve threat detection. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/how-researchers-collect-indicators-of-compromise/

📡 Boffins release 5G traffic sniffing tool security research – Researchers have launched Sni5Gect, an open-source tool for sniffing 5G traffic and executing connection downgrade attacks. It exploits vulnerabilities in pre-authentication communication to inject malicious payloads. https://www.theregister.com/2025/08/18/sni5gect/

⚠️ New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes vulnerability – A newly discovered HTTP/2 DoS vulnerability, CVE-2025-8671, allows attackers to bypass concurrency limits, causing denial of service. Vendors are rapidly addressing the flaw, which affects unpatched server implementations. https://thecyberexpress.com/new-http-2-dos-vulnerability/

🩹 Apache ActiveMQ attackers patch critical vuln after entry security news – Attackers exploiting a critical Apache ActiveMQ vulnerability have installed malware called DripDropper to maintain persistence on infected Linux servers and subsequently patched the original flaw. https://www.theregister.com/2025/08/19/apache_activemq_patch_malware/

🤳 Stop Spoofing Yourself! Disabling M365 Direct Send cyber defense – Threat actors are exploiting Microsoft 365's Direct Send feature to spoof emails within organizations. Users can now disable Direct Send with a simple command, enhancing security against these attacks. https://www.blackhillsinfosec.com/disabling-m365-direct-send/

🧷 Commvault releases patches for two pre-auth RCE bug chains vulnerability – Commvault has patched two critical remote code execution vulnerabilities following their disclosure by researchers. Users are urged to update immediately, as the flaws could allow unauthenticated attackers to gain admin access. https://www.theregister.com/2025/08/20/commvault_bug_chains_patched/

🚗 Inside the Underground Trade of ‘Flipper Zero’ Tech to Break into Cars security research – The Flipper Zero device, known for its hacking capabilities, is being used in an underground market to unlock various car models, with hackers selling software to exploit vulnerabilities. https://www.404media.co/inside-the-underground-trade-of-flipper-zero-tech-to-break-into-cars/

🖼️ Honey, I shrunk the image and now I'm pwned vulnerability – Researchers at Trail of Bits revealed that image scaling attacks can exploit Google Gemini and other AI systems, allowing hidden prompts to exfiltrate data. Google downplays the issue, citing non-default configurations. https://www.theregister.com/2025/08/21/google_gemini_image_scaling_attack/

🔒 Microsoft cuts off China's early access to bug disclosures security news – Microsoft has halted providing proof-of-concept exploit code to Chinese companies in its MAPP program following exploitation of SharePoint vulnerabilities. The change aims to prevent leaks and improve security measures. https://www.theregister.com/2025/08/21/microsoft_cuts_chinas_early_access/


CISA Corner

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA added a new vulnerability in Trend Micro Apex One to its Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/news-events/alerts/2025/08/18/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA added a new vulnerability in Apple iOS, iPadOS and macOS to its Known Exploited Vulnerabilities Catalog. https://www.cisa.gov/news-events/alerts/2025/08/21/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA issued four advisories detailing vulnerabilities in Industrial Control Systems by Siemens, Tigo and EG5. https://www.cisa.gov/news-events/alerts/2025/08/19/cisa-releases-four-industrial-control-systems-advisories ⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA issued three advisories detailing vulnerabilities in Mitsubishi Electric systems and FUJIFILM Healthcare's Synapse Mobility. https://www.cisa.gov/news-events/alerts/2025/08/21/cisa-releases-three-industrial-control-systems-advisories


While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

 
Read more...

from Threatc.at

This is something that I posted in r/MrRobot nearly a decade ago, in real-time after this particular episode dropped. I was living in Shanghai's French Concession, on the other side of the highway from Jing'an Temple, which is near where I mention a bookstore below. I'm putting it here because it was fun to write, and it still gives a little snapshot of the show and of China. I'm also now only on Reddit when I'm searching for a technical solution, or barring that, to share in similar unresolved misery, so I've been meaning to archive a few things from there. Now that the show is currently on Netflix seems appropriate timing.

The original post lives here

[Spoilers S02E04] About that red dress Whiterose showed, plus movie and literary references

A couple weeks ago I popped in to the boutique where Whiterose said she bought the red qipao that she showed to Dom. The place is called Jin Zhi Yu Ye, on Maoming Road in Shanghai, on a strip known for its qipaos. The designer is famous, and her shop is one of the top two places to get a qipao in the city. The English sign outsides says Leaves, but Whiterose called it by its Chinese name (though she says it with another final word/syllable that's not in the CC/subtitles)

Disappointingly, the clerks didn't know of Whiterose, or BD Wong. I played the clip for them, though, and off the rack they showed me a similar red qipao but sleeveless, for 5,000RMB, or about US$750, then a black one that was really close but with longsleeves, going for just under 7,000RMB. These are all handmade, and if you're interested in these things and have pricy tastes, they mostly do custom jobs that can run up to 10,000RMB. As is normal here, they stopped me from taking any photos inside, so you're stuck with a potato-quality snap of the window display.

Jin Zhi Yu Ye qipao shop, Shanghai

But the shop name! It was little hint that Whiterose dropped, maybe intentionally, for Dom. Jin Zhi Yu Ye literally translates to Golden Branch, Jade Leaves. I asked a Chinese friend about any other meanings, and she said it's just words put together for a name, not an idiomatic phrase or poetic reference. She did say that it has a connotation of extravagance and royal lifestyle. More interesting, though, is that it's the Mandarin pronunciation of a hit 1990s romantic comedy from Hong Kong, 金枝玉葉. English title: “He's a Woman, She's a Man.” The movie was packed with stars. It's good, kinda over-the-top at times, but pretty standard for that time, place and genre. It was also applauded for bringing out discussion of LGBT life to a wider audience. The male lead, Leslie Cheung, had already starred in two gay-themed arthouse films that pulled awards at Cannes (“Days of Being Wild” by Wong Kar Wai and “Farewell My Concubine,” just the year before this one).

The basic story of “He's a Woman, She's a Man” is of a female fan who idolizes a pop star singer and her male producer, played by Cheung. The musicians are rumored to be dating, and they are, but they're not that happy. In a fight, the singer challenges the producer to turn an amateur into a star. They hold contest auditions, and the fan, played by Anita Yuen, dresses up as a man to enter. She wins, and during the course of writing and recording with the producer, the two start falling for each other. Hilarity and questions of self ensue, yadda yadda. Notable makeout scene, though, where an IRL gay actor is playing a straight man who's conflicted about kissing a woman who's playing a man, and the scene is convincingly hot. Head asplode.

[Edit note for 2025, and trigger warning self-harm: Leslie Cheung was IRL very close friends with another Anita, singer and actress Anita Mui. Their friendship naturally featured prominently in the 2021 biopic “Anita,” which I unexpectedly happened to catch on in-flight entertainment. It could've been a decent movie, but that's entirely washed away by glaring omissions: the part that homophobia played in Leslie Cheung's clinical depression and suicide, as well as Anita Mui's activism, especially in remembrance of Tiananmen Square.]

But back to the closet, there was another breadcrumb Whiterose dropped. She shows Dom two garments; before the qipao/cheongsam, she pulls out a long, sleeveless piece, telling Dom it's a magua, common in the Qing dynasty, which ended in 1911. She notes that the embroidery was meant for royal families. It kinda looks like a dress, and a normal magua would just be a common riding jacket, which were made for men and women. But the yellow magua (not just the color, but what it's called) was for high-ranking officials and bodyguards. Which means men. And then she showed the qipao/cheongsam.

Besides this, the scene might have a little extra poignance in a literary reference. Shanghai was home to one of China's most important contemporary fiction writers, Eileen Chang. Her old apartment has a historical marker for her on it, and a fancy bookshop cafe on the ground floor sells $8 Americanos. When I visited for this post, they were out of the English version of one of her more notable novellas: “Red Rose, White Rose”. It's about a self-made man who likes control and order and has a storybook good life, well-rewarded for doing all the right things. He's married to a good woman, the White Rose, but there's another in his life, the wild and carefree Red Rose. No surprise, he's torn between the chaste and the passionate. The Cliff's Notes key quote:

Marry a red rose and eventually she'll be a mosquito-blood streak smeared on the wall, while the white one is “moonlight in front of my bed”. Marry a white rose, and before long she'll be a grain of sticky rice that's gotten stuck to your clothes; the red one, by then, is a scarlet beauty mark over your heart.

Thinking of this put a new spin on the Beijing visit. Grace Gummer has said in interviews that she dyed her hair for the show. Red Rose? I did try to ask; I emailed the address from Dom's business card shown onscreen with the subject “You're the Red Rose,” but I never even got the autoreply.

And then last on this, there's Eileen Chang herself. Of course, that's her Western name, but her name in Chinese is Zhang Ai-ling, maybe a namesake to Whiterose's public-facing identity as Minister Zhang.

I'll be psyched if any of this is actually on the trail. (popping out of the original reddit post to say here now on infosec.press, wow, this is so amusing and embarrassing that I wrote this this way. But that was what it was like at the time. People got swept up big playing detective on shows that had these so-called alternate reality game elements. I remember consciously getting off Reddit shortly after because of all the bonkers theorizing.) I very much would like to see the China angles being rooted in or referencing real stuff. I know you'd have to go with a fictional character for the story, but Zhang is the minister of state security, which is a real person here. Contrast that with Price talking to (then) Speaker of the House John Boehner and meeting in DC with Treasury Secretary Jack Lew, Federal Reserve Chair Janet Yellen and SEC Chair Mary Jo White. And that's all plausible. The 'real' Zhang is Geng Huichang. Unless the future storyline has some cool twists, there's no way he's working with, let alone leading, a hacker group (also now popping back out to 2025 to again say, wow, time has moved on). And in the role as minister, I don't think that diplomatically, Zhang would meet with an FBI team; at that level of an official, among nations of more or less the same “power,” meetings are between counterparts, and subordinates handle the rest. But anyway, while the minister is a big role in an important institution, it's not the biggest; arguably, that's the party secretary. But that gets into China politics, which right now in intelligence is getting really shaken up, but overall it's probably too much inside baseball.

Regardless, the show is dope, and being here I do get an extra kick out of the China parts. Just before posting this, I wanted to bounce some of this intelligence stuff in general off a Chinese friend, and found myself describing the show to her. And then:

Me: “You can find the whole first season on Youku.”

Her: “Oh, so it's not banned?”

Me: (pause) “Maybe the second season.”

TL;DR The shop where Whiterose bought the qipao she showed to Dom is also the title of a Hong Kong movie whose English title is “He's a Woman, She's a Man”. Also, there's a book called “Red Rose, White Rose,” written by Zhang Ai-ling. And Grace Gummer dyed her hair red for this show.

 
Read more...