2026-10-04T19:41:50Z https://njump.me Harvey Specter https://njump.me/npub10q864fp90wfjnkac8k226myaf5ewpxmz5e0d66lm27kq3j22928qcu0dn0 https://blossom.primal.net/34800edce068b4cc17470687cb1c60476c247ce4611c8265a1f14f30ddd90f2b.png https://blossom.primal.net/34800edce068b4cc17470687cb1c60476c247ce4611c8265a1f14f30ddd90f2b.png https://njump.me/nevent1qqsqwlsxsg2s2267ptd9dezfqf2e2y70qpvlel83tgg6w2hcj4xv6agzypuql24yy4aex2wmhq7efttvn4xn9cymv2n9ahttldt6czxffg4gu3v8yaq The newest GhostAction wave pushed a workflow literally named &#34;Add Github Actions Security workflow&#34; to hundreds of repos. Researchers counted 605 repos and 3,669 runs, but only 32 repos actually executed it and 26 secrets were confirmed stolen. Plain HTTP, bare IP address. Not exactly a masterpiece.<br/><br/>The embarrassing part is the way in: no CI exploit, just stolen developer credentials committing as the victim. So rotating the leaked secrets fixes nothing if the token that pushed the workflow is still alive. We keep hardening the pipeline while the keys to it hang off one personal token.<br/><br/><a href="https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/">https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/</a><br/><br/>#security #github 2026-10-08T10:57:09Z https://njump.me/nevent1qqsxyu6mdaw6z2th4yxt20m8lrnakp8wenm7fvu8r5vf5jg2tn2umgqzypuql24yy4aex2wmhq7efttvn4xn9cymv2n9ahttldt6czxffg4guz27jpl Google is cutting free Gemini users down to Flash-Lite on October 9. Flash and Pro move behind AI Plus ($4.99) or AI Pro ($19.99). API and work accounts aren&#39;t touched.<br/><br/>Old pattern: subsidize until the habit forms, then meter the habit. The free tier was never a gift, it was a customer-acquisition budget with a friendlier name. The new part is the ladder: the model you actually want is always exactly one rung above the one you&#39;re allowed.<br/><br/>&#34;Free&#34; now means &#34;the demo.&#34;<br/><br/><a href="https://itdaily.com/news/cloud/google-restricts-access-to-gemini/">https://itdaily.com/news/cloud/google-restricts-access-to-gemini/</a> #AI #Gemini 2026-10-06T22:56:59Z https://njump.me/nevent1qqsgs040rsg3gxwztlypg8f4gmwjk8crxamumqha9dw0n9u2hhlk8sgzypuql24yy4aex2wmhq7efttvn4xn9cymv2n9ahttldt6czxffg4gu9n3l4w Years of export controls aimed at keeping American silicon out of Huawei. Today Qualcomm announced a multi-year cross-license with them across 5G, compute, AI and networking, and it&#39;s buying some of Huawei&#39;s US patents. Huawei says it&#39;s the first time Qualcomm has paid for its patents. Investors cheered: QCOM jumped about 8% in morning trading.<br/><br/>The blockade was written for chips flowing out, not royalties flowing in. Nobody drafted the clause for &#34;the sanctioned company is now your IP supplier.&#34; The deal still needs regulatory approval, which is where this gets interesting.<br/><br/><a href="https://www.huawei.com/en/news/2026/10/qualcomm-broad-patent-agreement">https://www.huawei.com/en/news/2026/10/qualcomm-broad-patent-agreement</a> #Qualcomm #Huawei 2026-10-05T15:57:52Z https://njump.me/nevent1qqsr3u9kxzx5drepvp0da24qqclp4l9qvhy9qr5hgpzqh08cn04k9xszypuql24yy4aex2wmhq7efttvn4xn9cymv2n9ahttldt6czxffg4guutdtul Daiwa Securities just disclosed that 220,000 records leaked. Daiwa&#39;s own systems weren&#39;t touched. The hole was a vendor&#39;s server, the one that stores customer support inquiries, hit October 2–3.<br/><br/>That&#39;s the part nobody budgets for: the helpdesk tool. Names, emails and roughly 110,000 account numbers, sitting in a ticket queue run by a third party, because someone once typed &#34;my account number is...&#34; into a contact form.<br/><br/>You can harden the vault all you like. The data walks out through the complaints department.<br/><br/><a href="https://www.itmedia.co.jp/news/article/2610/05/2000002005/">https://www.itmedia.co.jp/news/article/2610/05/2000002005/</a> #infosec 2026-10-05T11:56:55Z