Nostr notes by Kevin Beaumont

MrBeast has signed a multi year overall deal to base his videos ...

2026-09-02T16:36:27Z

MrBeast has signed a multi year overall deal to base his videos on using GenAI. His first show is about using GenAI searches to survive in the wilderness. https://www.theverge.com/tech/988355/mrbeast-google-partnership-gemini-fitbit

Both Xcancel and Nitter have had cease and desist letter from ...

2026-08-25T23:35:58Z

Both Xcancel and Nitter have had cease and desist letter from Twitter. You can still follow Twitter account on Mastodon via account@bird.makeup and the like.

it's almost impossible to block, e.g. they pass machine GUID ...

2026-08-23T22:53:38Z

In reply to nevent1q…xqan
_________________________

it's almost impossible to block, e.g. they pass machine GUID tracking via Defender updates.

Microsoft has assembled as much telemetry as possible and then ...

2026-08-23T22:25:57Z

In reply to nevent1q…tuk5
_________________________

Microsoft has assembled as much telemetry as possible and then piped it all without anonymisation to MSTIC for central intelligence. It’s a powder keg. Companies realising is a very bad sign that the FAFO stage is approaching.

I don’t want to spell it out too much, but essentially - if ...

2026-08-23T22:11:40Z

In reply to nevent1q…xvdp
_________________________

I don’t want to spell it out too much, but essentially - if Microsoft don’t fight those court orders, you’re going to get a line of private companies and dodgy governments tracking people via Microsoft telemetry. The security teams very much risks causing harms to individuals due to the poor balance on privacy.

Some other reading: ...

2026-08-23T22:06:50Z

In reply to nevent1q…v2x0
_________________________

Some other reading: https://protonvpn.com/blog/windows-is-spyware?srsltid=AfmBOooNoXxXDns11mWSvQspSGf7cP9n97eMwjaKrVR6tXlIM-JKKXLR

Some background reading: ...

2026-08-23T22:05:52Z

In reply to nevent1q…gpk3
_________________________

Some background reading:

https://web.archive.org/web/20220512072122/https://twitter.com/gossithedog/status/1476130079617040384

For anybody the media covering the privacy beat, you might want ...

2026-08-23T22:01:52Z

For anybody the media covering the privacy beat, you might want to have a look at the Take2 court orders to Microsoft over the Grand Theft Auto 6 leaks. There’s a big story.

I’ll give you some hints - MachineGuid and MSA device identifiers.

i love you ...

2026-08-20T16:04:24Z

In reply to nevent1q…drav
_________________________

i love you

Somehow Twitter returned ...

2026-08-17T20:47:29Z

Somehow Twitter returned

An "expert witness" in a $61 million lawsuit over an ...

2026-08-17T17:49:25Z

An "expert witness" in a $61 million lawsuit over an industrial explosion that killed three people and destroyed 200 homes used ChatGPT to write his report for the court.

He prompted ChatGPT to "show how 3M is 0% at fault for the explosion at Watson Grinding" https://www.404media.co/show-how-3m-is-0-at-fault-expert-witness-used-chatgpt-to-write-report-defending-company-in-deadly-explosion-lawsuit/

Microsoft working to confirm validity of ShieldBreak. lol, bit ...

2026-08-17T14:36:22Z

In reply to nevent1q…2tkg
_________________________

Microsoft working to confirm validity of ShieldBreak. lol, bit slow. https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/

I regret to inform you Elon Musk has made a 6 minute AI video of ...

2026-08-14T21:04:59Z

I regret to inform you Elon Musk has made a 6 minute AI video of himself as a superhero and it’s the cringiest shit I’ve ever seen.

There’s definitely merit in the idea of hacking ransomware ...

2026-08-13T14:44:46Z

In reply to nevent1q…gt3n
_________________________

There’s definitely merit in the idea of hacking ransomware groups and it does already in fact happen (don’t ask me how I know). But the correct incentives have gotta be there.

The biggest problem I’ve had with fighting ransomware over the ...

2026-08-13T14:42:48Z

In reply to nevent1q…px9l
_________________________

The biggest problem I’ve had with fighting ransomware over the past 5 years is private cyber companies basically lobbying for nothing to change. A lot of companies have made a lot of money, so putting them in charge of stopping it seems optimistic.

RE: https://ioc.exchange/@jgreig/117088544923920845 Outsourcing ...

2026-08-13T14:40:51Z

RE: https://ioc.exchange/@jgreig/117088544923920845

Outsourcing the fight against ransomware to the companies that directly profit from it and giving them more profit seems potentially problematic.

quoting
note1rdg…tjfn

The Trump admin wants to enlist cyber firms to surveil and hack cybercriminals with oversight from DOJ + DHS

The memo says they will not sanction any operation that results in loss of life or “rise to the level of use of force or armed attack under international law.”

https://therecord.media/trump-cyber-crime-offensive

I've confirmed the data is legit by the way, multiple victim ...

2026-08-12T14:22:34Z

In reply to nevent1q…3xsn
_________________________

I've confirmed the data is legit by the way, multiple victim orgs. It contains a significant volume of sensitive content at orgs - for one Hudson Rock undersold the contents.

It's a massive supply chain breach due to poor AI security - not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security. Should be a wake up call.

RoguePlanet was a filesystem race condition vuln that uses ...

2026-08-12T12:52:19Z

In reply to nevent1q…aupy
_________________________

RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files.

ShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API).

don't tamper with in flight wi-fi, it's a federal crime. ...

2026-08-11T12:55:08Z

In reply to nevent1q…36h4
_________________________

don't tamper with in flight wi-fi, it's a federal crime.

somebody had a wi-fi pineapple

2026-08-11T12:53:42Z

In reply to nevent1q…7auh
_________________________

somebody had a wi-fi pineapple

RE: https://live.acarsdrama.com/@acarsdrama/117072256729860162 ...

2026-08-11T12:42:22Z

RE: https://live.acarsdrama.com/@acarsdrama/117072256729860162

This ACARS message is how some people at Defcon managed to get themselves arrested, don't take a wifi pineapple on the plane.

quoting
note16ea…w3ga

Air to Ground Message:

NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFRENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL

Area: Liberal, KS, USA
Type: Boeing 757-200
A: #aadee4f6c99
F: #fdcd8d51430

#acars #vdlm2

If you run N-enable urgently apply the latest hot fix in this ...

2026-08-07T21:58:13Z

In reply to nevent1q…2q2c
_________________________

If you run N-enable urgently apply the latest hot fix in this thread. I just spent 3 hours helping a government office hit with ransomware via this. A ransomware group definitely has the exploit, it’s a bypass for the previously issued CVE.

That time I met Felix while working at Co-op Group. I got ...

2026-08-07T10:07:12Z

That time I met Felix while working at Co-op Group.

I got reported to mgmt by the Cyber Intelligence manager there for posting this image on social media, as they said it gave away our badge design. Our badge design was an off the shelf badge system. I responded with images of our senior leadership team wearing the badges on social media. Never heard back. 🤣

Check your N-central server for traffic to Cloudflare Tunnels, ...

2026-08-07T00:02:03Z

In reply to nevent1q…sswe
_________________________

Check your N-central server for traffic to Cloudflare Tunnels, they’re doing persistence via that even after patching.

Threat actor exploiting N‑central by N-able in zero day ...

2026-08-06T23:59:20Z

Threat actor exploiting N‑central by N-able in zero day attacks, to pivot inside company networks remotely without auth.

New hot fix just published today. https://www.n-able.com/blog/n-central-security-update-august-6-2026

RE: https://techhub.social/@Techmeme/117041512465545105 By using ...

2026-08-05T06:41:34Z

RE: https://techhub.social/@Techmeme/117041512465545105

By using Reddit as a trusted source for AI search answers (the default experience), Google has effectively outsourced itself to unpaid Reddit moderators.

Also worth point out - anybody can become a mod on Reddit and open a subreddit. If you wanna influence opinion like a nation state, Reddit's the door now.

quoting
note1hr4…c33w

How Reddit moderators are battling AI-powered astroturfing ad campaigns that exploit the platform's trusted reputation to promote skincare and other products (Mia Sato/The Verge)

https://www.theverge.com/ai-artificial-intelligence/973098/reddit-ai-search-seo-marketing-brands-spam?view_token=eyJhbGciOiJIUzI1NiJ9.eyJpZCI6ImxFdUx0VXBLR1MiLCJwIjoiL2FpLWFydGlmaWNpYWwtaW50ZWxsaWdlbmNlLzk3MzA5OC9yZWRkaXQtYWktc2VhcmNoLXNlby1tYXJrZXRpbmctYnJhbmRzLXNwYW0iLCJleHAiOjE3ODYyNzcxNDQsImlhdCI6MTc4NTg0NTE0NH0.5xvH6sSk5P0dplXamVR86M7YGKK3aSa-PeL8MZI3TL0&utm_medium=gift-link
http://www.techmeme.com/260805/p4#a260805p4

I still have the same email address from 1998, wonder if I’m ...

2026-08-05T00:23:19Z

In reply to nevent1q…jjz2
_________________________

I still have the same email address from 1998, wonder if I’m still subscribed

RE: https://techhub.social/@Techmeme/117038982315909154 I’ll be ...

2026-08-04T20:22:33Z

RE: https://techhub.social/@Techmeme/117038982315909154

I’ll be honest - the water hack story in the US is so dumb. Many of the organisations don’t even know if they were hacked.. claims spreading like wildfire when nobody even knows what they’re dealing with. They have two IT people. They have PLCs on 4G dongles with no passwords. It’s under resourced and crap.

Don’t be worried about Iran, be worried about lack of regulation and central support.

quoting
note1ylz…95r7

Sources: possible cyberattacks targeting water and wastewater utilities have now been reported in at least 12 US states, and Iran is the prime suspect (ABC News)

https://abcnews.com/US/12-states-face-cyberattacks-water-systems-sources/story?id=135348482
http://www.techmeme.com/260804/p38#a260804p38

All of this is noise to companies that make canned tuna and such ...

2026-08-04T16:52:44Z

In reply to nevent1q…quep
_________________________

All of this is noise to companies that make canned tuna and such btw - you know, companies that actually do stuff and drive the global economy.

They can't afford any of this shit. They can barely afford to upgrade their Windows 10 PCs, which are held together by string.

Microsoft's SLT often thinks their customers are all the DoD and banks. They aren't. They're orgs struggling with real world problems, who can't afford Visio licenses.

It's not in the article but they've also rolled back ...

2026-08-04T16:48:52Z

In reply to nevent1q…d0wy
_________________________

It's not in the article but they've also rolled back their Claude Code rollout too.

Microsoft have introduced limits for its engineers AI tools usage ...

2026-08-04T16:47:40Z

Microsoft have introduced limits for its engineers AI tools usage

https://www.404media.co/microsoft-tells-engineers-tokenmaxxing-is-not-what-we-are-optimizing-for/

Interesting catch by @npub1p5z…krfz - although we don't ...

2026-08-04T12:36:09Z

In reply to nevent1q…usfk
_________________________

Interesting catch by Zack Whittaker (npub1p5z…krfz) - although we don't know the number of people impacted by the Adform breach has they haven't commented, Adform say they service 1.5 billion adverts a day, and the breach lasted at least 5 days.

Pretty compelling reason to use an adblocker.

I’m Adform Famous on LinkedIn ...

2026-08-01T19:03:11Z

In reply to nevent1q…vu6c
_________________________

I’m Adform Famous on LinkedIn

Adform customers publishing advisories to their customers.. will ...

2026-08-01T18:59:52Z

In reply to nevent1q…t7q6
_________________________

Adform customers publishing advisories to their customers.. will be interesting to see which companies don’t bother to tell anybody.

Veikkaus, a Finnish government-owned betting agency which holds a ...

2026-08-01T02:05:40Z

In reply to nevent1q…z5qx
_________________________

Veikkaus, a Finnish government-owned betting agency which holds a monopoly in the country, has informed customers their cryptocurrency may have been stolen as they use Adform.

https://www.voice.fi/ilmiot/veikkauksen-verkkosivuilla-ollut-haittakoodia-lottokansan-tulee-tehda-nyt-nain

The IP is getting listed too ...

2026-08-01T01:12:05Z

In reply to nevent1q…wnvc
_________________________

The IP is getting listed too

Finding out which vendors read my tweets again! Somebody fix ...

2026-08-01T01:06:08Z

In reply to nevent1q…tj78
_________________________

Finding out which vendors read my tweets again!

Somebody fix Cassandra at Microsoft.

"Adform has informed affected clients through dedicated ...

2026-08-01T01:01:04Z

In reply to nevent1q…pw5x
_________________________

"Adform has informed affected clients through dedicated communications and provided them with relevant information and recommended actions." <- this only happened after I went public with it.

To clarify a few things: "Based on our investigation to date, ...

2026-08-01T01:00:32Z

In reply to nevent1q…9nd6
_________________________

To clarify a few things:

"Based on our investigation to date, we have found no evidence that the malicious code transmitted users’ IP addresses or information about the websites they visited to an external party. Technical analysis indicates that such transmission may have been possible, and this aspect remains under investigation." <- It did. The code for it is in my blog.

Admore have finally admitted they were hacked: ...

2026-08-01T01:00:10Z

In reply to nevent1q…tyj5
_________________________

Admore have finally admitted they were hacked:

https://site.adform.com/resources/newsroom/security-incident-company-update/

Well done to the US government for running an AIDS conference, AI ...

2026-07-30T17:16:20Z

Well done to the US government for running an AIDS conference, AI generating the slides, and presenting the slides with every country in Africa mislabelled by said AI https://www.theguardian.com/us-news/2026/jul/30/government-map-mislabels-african-countries

Attempt to get Adform to admit it, LinkedIn tag edition ...

2026-07-30T14:18:21Z

In reply to nevent1q…pw3e
_________________________

Attempt to get Adform to admit it, LinkedIn tag edition

RE: https://infosec.exchange/@hacksilon/116990837620035279 Looks ...

2026-07-30T14:16:22Z

In reply to nevent1q…ujzy
_________________________

RE: https://infosec.exchange/@hacksilon/116990837620035279

Looks like Max spotted it 3 days ago

quoting
note1tr8…ucvz

Looks like #adform got compromised. It is shipping a malware-laced tracking script that is replacing crypto wallet addresses in the users clipboard. Recommend disabling adform includes in your websites. Sample: https://gist.github.com/malexmave/8ef5eabc7b6866698f1ea8a811c75b57

Analysis by Claude: https://claude.ai/share/5c751f9c-2bae-4835-8dff-fcbebf66d5dc

#IoC - C2 Address and Port seems to be 84.32.102.230:7744 .

#threatIntel

If you like malware reverse engineering, this was being served by ...

2026-07-30T13:57:44Z

In reply to nevent1q…n3vr
_________________________

If you like malware reverse engineering, this was being served by Adform a few days ago: https://pastebin.com/mc7psaNF

Adform, a web advertising firm, have been hacked and have been ...

2026-07-30T13:39:45Z

Adform, a web advertising firm, have been hacked and have been serving a supply chain attack to steal crypto https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-via-supply-chain-attack-2f1ec024f33e

Sense check for people working in cybersecurity in operations ...

2026-07-29T16:16:35Z

Sense check for people working in cybersecurity in operations roles in the trenches:

I’m not finding or seeing cyber incidents off the back of Generative AI still. Are you? Not ones you’ve read about online - I mean ones you’ve actually dealt with.

RE: https://techhub.social/@Techmeme/116998514444818066 jfc. ...

2026-07-28T16:27:48Z

RE: https://techhub.social/@Techmeme/116998514444818066

jfc.

quoting
note1apa…5ca9

Letter: the US EPA says power plants providing electricity only to data centers and not to the public grid would not be subject to federal pollution laws (Tim McLaughlin/Reuters)

https://www.reuters.com/legal/litigation/epa-says-power-data-centers-can-sidestep-pollution-laws-2026-07-27/
http://www.techmeme.com/260728/p32#a260728p32

well due to the idiots who bankrolled SpaceX's IPO on another ...

2026-07-27T20:13:41Z

well due to the idiots who bankrolled SpaceX's IPO on another massive money pitt

Elon Musk, an immigrant, was interviewed recently by the editor ...

2026-07-26T13:33:57Z

Elon Musk, an immigrant, was interviewed recently by the editor of the Economist. He said a bunch of dumb shit - for example that money wouldn’t exist in 2036, and that everybody wouldn’t have to work any more as AI would do their job for them.

Anyway, he’s now essentially calling for the assassination of the journalist over her questions about immigration.

The post incident review is out for the Microsoft Azure, Cloud ...

2026-07-23T23:09:25Z

In reply to nevent1q…7vs3
_________________________

The post incident review is out for the Microsoft Azure, Cloud and 365 outage today.

Tl;dr - failed change. 5 hour restoration. Similar to the big WAN outage they had in 2022 where a similar BGP command was executed incorrectly. Took down ExpressRoute customers too.

Microsoft are telling customers there is no ETA to resolution and ...

2026-07-23T17:44:46Z

In reply to nevent1q…47nw
_________________________

Microsoft are telling customers there is no ETA to resolution and they may want to review their DR plans for their SaaS services.

"Customers may wish to review their business continuity and disaster recovery plans and take actions appropriate for their environment."

It's taken several hours but Microsoft finally put impacted ...

2026-07-23T17:19:16Z

In reply to nevent1q…vptn
_________________________

It's taken several hours but Microsoft finally put impacted services on the Azure status page, prior it was showing no impacted services.

For anybody tracking the Microsoft outages... Azure West US is ...

2026-07-23T16:59:33Z

In reply to nevent1q…waaj
_________________________

For anybody tracking the Microsoft outages... Azure West US is the cause:

Starting at 14:44 UTC on 23 July, 2026, we began investigating a networking issue affecting connectivity to Azure services in the West US region. Impacted customers may be experiencing intermittent connectivity failures, increased latency, or difficulty accessing Azure services. Customers with traffic traversing the West US region may also experience downstream impact.

Microsoft 365 aka Microsoft Copilot aka Office 365 has jumped off ...

2026-07-23T15:46:49Z

Microsoft 365 aka Microsoft Copilot aka Office 365 has jumped off a cliff.

RE: https://infosec.exchange/@wdormann/116965837513850094 This ...

2026-07-22T22:54:34Z

RE: https://infosec.exchange/@wdormann/116965837513850094

This vuln (CVE-2026-50522) will see mass exploitation. It's out of the box unauth RCE in SharePoint, a mass exposed internet technology.

quoting
note1ndp…6256

Looks like somebody [posted an exploit for CVE-2026-50522] (patched in July)(https://gist.githubusercontent.com/testanull/0868e02d81d57d6c59a91261969f7f81/raw/4d16304047e525057d732401f718e20fa830eb0a/SharePoint%2520SE%2520p2o%2520PoC.ps1)

While I can reproduce it on SharePoint Subscription Edition, I didn't get it to work on SharePoint 2016 or 2019. But I could also attribute that to me having **no clue** how to properly install SharePoint.

Here it is tweaked to run calc.exe as the SharePoint user (sp_farm in my case), as that's a touch more noticeable than it making a web request.

And remember, kids, just installing SharePoint update bits does **not** update SharePoint. You have to run SharePoint Products Configuration Wizard after installing the updates, which luckily every SharePoint admin knows.

RE: https://techhub.social/@Techmeme/116963665803240703 circular ...

2026-07-22T12:39:25Z

RE: https://techhub.social/@Techmeme/116963665803240703

circular funding and circular press releases continue!

quoting
note1lh3…k0sl

AMD and Anthropic sign an AI server deal worth tens of billions; Anthropic will buy 2GW of Instinct MI450 chips in H1 2027, and AMD will invest $5B in Anthropic (Wall Street Journal)

https://www.wsj.com/tech/ai/amd-and-anthropic-sign-major-chips-and-investment-deal-4adfdc45?st=oGnmYV&reflink=desktopwebshare_permalink
http://www.techmeme.com/260722/p12#a260722p12

RE: https://infosec.exchange/@briankrebs/116959137948884825 Since ...

2026-07-21T23:19:46Z

RE: https://infosec.exchange/@briankrebs/116959137948884825

Since Truth Social is based on Mastodon, I'm curious about how "Truth API" is implemented.

quoting
note15hh…4lpw

Banks can now get access to insider trading information, straight from the POTUS's mouth. For a fee, of course. Axios reports Trump Media has already signed several customers ahead of the Aug. 1 launch, including financial news organizations and high-frequency trading firms.

https://www.axios.com/2026/07/16/truth-social-license-data-wall-street

A letter from Sen. Mark Warner (D-Va) to the financial services industry urges banks to reject Truth Social's new service that would offer advance access to the president's posts on the platform.

"In a letter to the presidents of Bank Policy Institute, Securities Industry and Financial Markets Association, Managed Funds Association, Financial Services Forum, Principal Traders Group, and American Bankers Association, Sen. Warner wrote, “I write regarding Trump Media & Technology Group’s (TMTG) announcement that it will begin offering financial institutions and other users the option of paying TMTG for prioritized delivery of posts from President Trump (and other Truth Social accounts as determined by TMTG). This arrangement presents a serious risk to market integrity, creates a clear and unacceptable pathway for corruption, and undermines public confidence in the fair dissemination of market-moving government information – a crucial factor in maintaining stable and trustworthy financial markets.”

"Sen. Warner explained that, according to TMTG, the Truth API will provide select paying customers with advance access to posts from top Truth Social accounts, a list that includes the president’s, faster than regular users receive push notifications or can manually monitor Truth Social. Trump Media has said the service is specifically designed for organizations “most impacted by the cost of a delay in information,” including algorithmic trading firms, and customers have already signed up for the service, which it has reportedly offered for $100,000 per month."

https://www.warner.senate.gov/wp-content/uploads/2026/07/260721.Warner_Finance_Truth_API_letter.pdf

most of .gov is

2026-07-21T16:57:50Z

In reply to nevent1q…27dl
_________________________

most of .gov is

Has anybody looked at the structure of Cloud Security Alliance? ...

2026-07-20T20:24:16Z

Has anybody looked at the structure of Cloud Security Alliance? It feels like it has been hijacked by GenAI corporate interests.

depends on the tool but 'yes*'. Problems = log volume ...

2026-07-13T10:28:03Z

In reply to nevent1q…8jrg
_________________________

depends on the tool but 'yes*'. Problems = log volume (it's very large) and who has time, responsibility, budget and knowledge in business to sit and review hundreds of thousands a prompts each week in a large org to police how people use tools and understand what they're doing?

In an era where companies need to become more efficient and ...

2026-07-12T18:08:33Z

In reply to nevent1q…x6qj
_________________________

In an era where companies need to become more efficient and diverse they’ve basically picked the least efficient way to do it, with the biggest risks and highest costs - because everybody else is doing it.

I know somebody at one of the big 4 who has written something in Claude that prompts Claude each twenty minutes for a question, then feeds Claude’s question back into Claude to use their tokens - because token usage is factored into employee evaluations. What are we even doing.

This isn’t, btw, a Kevin Doesn’t Use AI rant. I use GenAI ...

2026-07-12T18:02:57Z

In reply to nevent1q…fz2y
_________________________

This isn’t, btw, a Kevin Doesn’t Use AI rant. I use GenAI extensively for various testing things. I had access to Mythos before almost everybody. I pay for Copilot Pro+. I pay for Gemini. I AI generate terrible songs. I vibecode security scanners. My personal spend exceeds £500 this month to date.

Do I think you should make every employee depend on these third party GenAI tools for their job? No. Its ridiculous. You’re also *locked in* to costs you can’t afford which *will rise*. It’s a cliff.

it’s happening worldwide in every sector. It’s just ...

2026-07-12T17:53:46Z

In reply to nevent1q…xtzv
_________________________

it’s happening worldwide in every sector. It’s just incredible, and very, very funny.

I’m really serious about this one btw. Companies have no ...

2026-07-12T17:47:28Z

In reply to nevent1q…5pe6
_________________________

I’m really serious about this one btw. Companies have no measurable way of knowing what employees are doing with GenAI. They’re giving Claude Code out like it’s candy and just presuming everybody is an IT power user. They aren’t. They’re converting PDFs and vibe coding garden planning tools.

Copilot M365 has a fake dashboard showing how productive people are.. it has no actual data. It just shows people use it. It’s CIO porn for the CEO. Orgs are pissing money up a wall worldwide.

RE: https://mastodon.social/@404mediaco/116908074107231828 ...

2026-07-12T17:44:07Z

RE: https://mastodon.social/@404mediaco/116908074107231828

Anybody who has worked in IT support in the trenches in enterprise IT will tell you there are some Excel power users who basically run the company, are macros wizards and actual ninjas.. about 0.1% of the workforce. About 99% of people can’t align a table in Word.

Giving the 99% of people tools which cost $$$ per user a month and letting them do anything is like giving a child a car, and being surprised when they ram the car into a wall three days later and cost $10k after achieving nothing.

quoting
note1qwv…lwrf

“Crazy, we go from no more [AI] leaderboard to actual usage limits in two weeks,” one Amazon employee said in a reply on Slack.

https://www.404media.co/companies-are-throttling-employees-ai-use-because-its-too-expensive/

The study found that women who submit resumes created with AI ...

2026-07-05T17:44:59Z

The study found that women who submit resumes created with AI assistance are evaluated as less competent and less trustworthy than men who submit identical AI-assisted resumes. To the evaluators, women’s AI use signaled inability, while men’s AI use signaled initiative. https://www.forbes.com/sites/michelletravis/2026/06/25/women-who-use-ai-seen-as-incompetent-men-who-use-ai-seen-as-pragmatic/

here's a website where you can type your name and see how ...

2026-07-02T13:21:24Z

here's a website where you can type your name and see how much stuff AI has stolen from you while being trained https://intheweights.com

I did 13 years securing ICS manufacturing at Crabbers, as the ...

2026-06-30T23:47:33Z

In reply to nevent1q…w627
_________________________

I did 13 years securing ICS manufacturing at Crabbers, as the only security person. All I can say is.. Manufacturing IT is *fun*.

And by fun I mean vendors who insist you run no antivirus software, firewalls, and that their software runs as domain admin. It's wild, that is how manufacturing IT runs for critical infrastructure in the real world.

RE: https://infosec.exchange/@briankrebs/116841587803676396 ...

2026-06-30T23:34:35Z

RE: https://infosec.exchange/@briankrebs/116841587803676396

Boeing are dealing with a multiday "IT systems outage" impacting 3 manufacturing locations.

I understand it's not cybersecurity related, but a failure of Siemens ICS equipment.

quoting
note1ncf…nzvw

Looks like Boeing may be dealing with a rapid disassembly of their company-wide IT network. The company has published a notice on its employee emergency page that says they're canceling shifts at various plants and sending home people whose job depends on IT stuff to work.

I sincerely hope this isn't the beginning of another Jaguar Land Rover type incident where production is halted for extended periods.

https://www.boeing.com/emergency

#boeing

mum: what impact did you have on the cybersecurity industry? me: ...

2026-06-30T21:20:37Z

mum: what impact did you have on the cybersecurity industry?

me: LOGOS

if you have SAML IDP enabled on Netscaler, you want to patch CVE-2026-8451 https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451

This is already being exploited in the wild, one of my honeypots got MFA bypassed with it.

GenAI update I'm sure y'all will be very surprised about ...

2026-06-25T13:42:35Z

GenAI update I'm sure y'all will be very surprised about

/s

Turns out giving every staff member hundreds of dollars a day = staff piss money up a wall trying to do simple things instead of working for a living.

https://www.404media.co/the-tokenpocalypse-is-here-companies-are-scrambling-to-stop-spending-so-much-on-ai/

Snap glasses update I'm sure y'all will be very surprised ...

2026-06-25T13:38:42Z

Snap glasses update I'm sure y'all will be very surprised about

/s

https://www.404media.co/snaps-ai-ar-specs-lol/

Very funny screw up by Meta. They installed a keylogger on ...

2026-06-22T22:34:30Z

Very funny screw up by Meta. They installed a keylogger on employees PCs, so they could train their AI. However they exposed the collected data online, so anybody could see what anybody who works there has been typing.

https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/

VMware customers abandoning sinking ship ...

2026-06-21T10:24:39Z

VMware customers abandoning sinking ship https://www.theregister.com/virtualization/2026/06/17/tesco-is-sprinting-to-quit-vmware-and-broadcom-despite-rapid-migration-risks/5256133

RE: https://infosec.exchange/@briankrebs/116780029181293028 ...

2026-06-20T12:18:26Z

In reply to nevent1q…vhlv
_________________________

RE: https://infosec.exchange/@briankrebs/116780029181293028

Gizmodo also serving ClickFix malware to Windows users

quoting
note1p43…xwt6

Don't look now, but it seems Gizmodo's homepage is now serving up a Clickfix attack.

Basics of the Click-Fix exploit, which causes a pasted URL to fetch malware via Windows Powershell.

https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/

#clickfix #gizmodo

Gizmodo's serving ClickFix malware to Mac users ...

2026-06-20T11:10:03Z

Gizmodo's serving ClickFix malware to Mac users [@Gizmodo](https://flipboard.com/@Gizmodo ) https://bsky.app/profile/juliametraux.bsky.social/post/3moomipmam22i

Update on FortiBleed by me New IOCs doing config dumps (including ...

2026-06-19T19:04:04Z

In reply to nevent1q…ru9y
_________________________

Update on FortiBleed by me

New IOCs doing config dumps (including an IP addressed owned by Fortigate), details on movement inside networks etc.

https://doublepulsar.com/an-update-on-fortibleed-whats-happening-with-victim-orgs-c0671a50e7f4

CloudSEK look at the open directory that had all the #FortiBleed ...

2026-06-19T17:18:31Z

In reply to nevent1q…ettk
_________________________

CloudSEK look at the open directory that had all the #FortiBleed tooling and data in it. It's a good report, although I disagree with their conclusion - it's still an absolutely truck load of creds, even if that particular opendir only had internal network details for a few thousand orgs. https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind

Canadian Centre for Cyber Security on #FortiBleed ...

2026-06-19T16:07:37Z

In reply to nevent1q…4se3
_________________________

Canadian Centre for Cyber Security on #FortiBleed

https://www.cyber.gc.ca/en/alerts-advisories/al26-014-fortibleed-leak-thousands-compromised-credentials-impacting-fortinet-devices

Some kind #FortiBleed victims got me to look at their situations. ...

2026-06-19T16:02:04Z

In reply to nevent1q…rshc
_________________________

Some kind #FortiBleed victims got me to look at their situations. Some IOCs performing remote config dumps:

193.8.186.7
80.75.212.113
213.21.239.65

Look for inbound TCP traffic to Fortigate devices. If seen log into the devices and look for config dump events from those IPs.

Config dumps (including crackable password hashes) have been going on for around a month.

If you have IPsec site to site VPN tunnels on the impacted Fortinets you need to rebuild the tunnels with new keys both ends.

To be transparent about this, a threat actor has been claiming ...

2026-06-18T20:33:31Z

In reply to nevent1q…y63w
_________________________

To be transparent about this, a threat actor has been claiming they have an exploit to get FortiOS device password hashes remotely from config for the past month. It’s currently unclear how. They claim it’s an exploit of an unpatched vuln. Their claims predate the discovery of this dump.

If I end up having to set up another FortiGate firewall honeypot to figure out what’s going on.. I’ll British tut and get on with it.

NCSC UK advice on Fortibleed: ...

2026-06-18T20:20:38Z

In reply to nevent1q…uvhz
_________________________

NCSC UK advice on Fortibleed: https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways

Fortinet appear to be telling press the #Fortibleed breach is ...

2026-06-18T20:10:07Z

In reply to nevent1q…asqd
_________________________

Fortinet appear to be telling press the #Fortibleed breach is made up of prior breaches and brute forcing.. but I’ve seen the breach data and it includes many passwords not in prior dumps, and I’ve worked with impacted orgs and they report no brute forcing of impacted accounts.

I think there may be some confusion about this one - the brute forcing is the cracking of the passwords by the threat actor, which is done locally.

Watch this space on this one anyhoo.

"previous flops" $2000 glasses which do almost nothing ...

2026-06-18T18:42:33Z

"previous flops"

$2000 glasses

which do almost nothing

yep, no way this one will flop!

#GAYINT list of impacted #FortiBleed IPs. Not all as I ...

2026-06-18T10:42:22Z

In reply to nevent1q…5f2l
_________________________

#GAYINT list of impacted #FortiBleed IPs. Not all as I couldn't write the parser properly. http://owned.lab6.com/~gossi/research/public/fortibleed/some-fortibleed-ips.txt

#GAYINT list of impacted domains (this is basically email ...

2026-06-18T10:27:08Z

In reply to nevent1q…ty39
_________________________

#GAYINT list of impacted domains (this is basically email addresses of admin accounts on the device btw) https://blog.gayint.org/intel/fortibleed.txt

Lol, the #FortiBleed data was found in an opendir on a webserver ...

2026-06-17T15:43:12Z

In reply to nevent1q…m9sd
_________________________

Lol, the #FortiBleed data was found in an opendir on a webserver 🤣 truly GenAI is going to take over 😜

"They accidentally left an open directory with artefacts, connection strings, tooling, scripts and data online. Analytics obtained via their cron jobs, bash histories, logs etc,"

https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/

The US government has intervened in a lawsuit on the side of X, ...

2026-06-16T12:50:03Z

The US government has intervened in a lawsuit on the side of X, saying Grok is "critical for national security" https://www.wired.com/story/doj-lawyers-argue-xai-vital-national-security-naacp-lawsuit/

Was just talking to a friend at a US technology company, ...

2026-06-15T22:23:17Z

Was just talking to a friend at a US technology company, they’ve had their budget reduced by 50% as the company says it wants to announce “the largest layoffs in US corporate history” to prove GenAI can replace jobs.

There’s no plan to actually replace the jobs with GenAI.. they just have to decimate their area.

Not naming company as the staff don’t know they’re about to fed to the line going up.

I'm on year 3 of trying to convince the UK gov to use ...

2026-06-13T18:32:43Z

I'm on year 3 of trying to convince the UK gov to use Mastodon.. instead ministers are busy tweeting about Elon on Elon's platform.

https://www.lemonde.fr/en/international/article/2026/06/13/musk-s-role-was-instrumental-in-the-belfast-riots-according-to-researchers_6754420_4.html

Worth noting that report was out for 9 months before anybody ...

2026-06-12T16:22:48Z

In reply to nevent1q…hp85
_________________________

Worth noting that report was out for 9 months before anybody actually challenged it.

Similar with the 80% of ransomware groups use GenAI report from MIT (which I ended up getting removed).. is anybody actually bothering to check the GenAI thing is real? KPMG and EY aren't, they aren't even reading their own reports as they're busy cashing the cheque like MIT.

KPMG issued a report citing all the transformational ways GenAi ...

2026-06-12T09:45:54Z

KPMG issued a report citing all the transformational ways GenAi has transformed industry, it’s been widely cited.

One minor problem: it turns they used AI to write the report, and it made up all of the evidence. https://www.ft.com/content/b3828e92-4961-4b39-84f0-c42f33be3c3f

I have an internet scanning thing which records firmware patching ...

2026-06-11T23:01:52Z

In reply to nevent1q…dlgm
_________________________

I have an internet scanning thing which records firmware patching times. Generally speaking most orgs aren’t meeting CISA directives to patch, including federal government - they’re often weeks or months late.

RE: https://buttplug.zone/@buttplugio/116711889648322798 I opened ...

2026-06-08T06:47:06Z

RE: https://buttplug.zone/@buttplugio/116711889648322798

I opened Mastodon for the first time today and the first post I see is a furry drawing something in Microsoft Paint using a sex toy.

Mom, I’m home.

quoting
note12xa…sye2

BUTTDRAW.

WINDOWS.
ANY PAINT PROGRAM.
ANY TABLET (I’ve only tested it on a shitty one but this is hooking win32 ui access).
ANY SEX TOY THAT WORKS WITH buttplug.io 🍑🔌 (npub1c0p…at59)

COMING SOON.

RE: https://infosec.exchange/@cirriustech/116698961191700971 ...

2026-06-05T21:39:27Z

In reply to nevent1q…0dge
_________________________

RE: https://infosec.exchange/@cirriustech/116698961191700971

Companion thread.

quoting
note1keh…pv3p

So a mate had 8 repos disabled by GitHub that aren't offensive tooling or exploits but are forks of Azure Functions stuff.

The ones I know of aren’t offensive tooling or exploits - they are all related to azure functions…

I wondered if is related to the durabletask stuff being compromised as part of the GitHub breach the other week.

DurableTask is largely used by azure functions.

3 versions of it were pushed with malware in.

So I wondered if this is an incident response action.

Scanning the Azure org using gh CLI for disabled repos.

The timestamps are unnaturally clustered
Every single repo shows:

updated_at ≈ 2026-06-05 16:00 UTC
pushed_at ≈ 2026-06-05 02:00-07:00 UTC

That’s not organic project activity.

That looks like a bulk operation touching all repos in the set at roughly the same time.

This is clearly not just DurableTask
The blast radius includes:

Core Functions runtimeAll language workersAll durable extensionsCore ToolsWebJobs SDKDocker imagesGitHub ActionsExtension bundlesOpenAI extensionMCP extensionConnector SDKsAgent runtime
This is basically:

“everything related to Azure Functions as a platform”

The stars matter
Some of these are not obscure repos:

Repo Stars
azure-functions-host 2010
durabletask 1718
azure-functions-core-tools 1450
azure-webjobs-sdk 752
durable-extension 764

You don’t casually disable the flagship repos of a major cloud service.

The newer additions are fascinating
These jumped out:

azure-functions-openai-extension
azure-functions-mcp-extension
azure-functions-agents-runtime

Those are AI-era additions.

Which suggests the disablement logic wasn’t:

“disable the historically compromised repo”

It looks more like:

“disable the entire Functions ecosystem”

The Connectors repos are weird
These:

Connectors-NET-SDK
Connectors-NET-LSP
Connectors-NodeJS-SDK
connectors-python-sdk

have:

stars = 0

and are still disabled.

That argues against popularity, malware reports, forks, or stars being the trigger.

They’re simply part of the same family.

It looks like Microsoft's DevOps libraries for Azure ...

2026-06-05T21:38:45Z

It looks like Microsoft's DevOps libraries for Azure Functions might have been compromised. No statement yet but Github is nuking Microsoft's own repos.

https://opensourcemalware.com/blog/miasma-reaches-azure

If you're wondering why Anthropic et all are publicly making ...

2026-06-05T16:33:25Z

If you're wondering why Anthropic et all are publicly making stupid claims ('our AI that writes itself!') and begging world governments to regulate them - while directing setting up the regulation - it's pretty simple: they're locking out competitors.

If you read through this draft of "The Greeat American AI Act" it's pretty clear that nobody but the current big players will be able to comply. It's "regulate me, daddy" = "make sure nobody else can compete".
https://trahan.house.gov/uploadedfiles/the_great_american_ai_act_discussion_draft.pdf

Also the original toots are available on the Internet Archive ...

2026-06-04T22:51:03Z

In reply to nevent1q…9epl
_________________________

Also the original toots are available on the Internet Archive here: https://web.archive.org/web/20221223190415/https://cyberplace.social/@shakal/109528246434459657

To answer a few questions - the latest removal request is citing ...

2026-06-04T22:46:15Z

In reply to nevent1q…zk4m
_________________________

To answer a few questions - the latest removal request is citing this thread, in particular the Companies House screenshot (this page - https://find-and-update.company-information.service.gov.uk/company/12008373/officers )

The person who posted the original toot deleted their whole Mastodon account.

The complainant describes himself as "Felix Juhl is a senior expert on open source intelligence, lawful communication interception, cyber security, counter-espionage, and fighting organized crime."

https://internationalcybercenter.org/fjuhl/

Incogni are back chasing their removal request about publishing ...

2026-06-04T22:19:57Z

In reply to nevent1q…vvqw
_________________________

Incogni are back chasing their removal request about publishing another removal request. https://github.com/GossiTheDog/Cyberplace/blob/main/LegalThreats/Re%3A%20Data%20removal%20request%20-%20Felix%20Juhl%20%5BID-EDG1A8611%5D