![\"flan_shrug\"](\"https://cdn.micro.blog/photos/40/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Fcustom_emojis%2Fimages%2F000%2F028%2F534%2Fstatic%2Fc6029212eb362e52.png\")
Someone patch #Wikipedia and bring it up ; kthxbye
","summary":"","url":"https://infosec.exchange/@0x58/117479649743658835","date_published":"2026-10-21T15:39:54+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-21 15:39","date_timestamp":1792597194,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99486993","content_html":"@jan I don't and never did. Don't worry.
","url":"https://infosec.exchange/users/0x58/statuses/117467047820876158","date_published":"2026-10-19T10:15:04+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-19 10:15","date_timestamp":1792404904,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"99403089","content_html":"I wonder if shutting down the npm registry would not do more good than bad to the cyber world.
Change my mind.
","summary":"","url":"https://infosec.exchange/@0x58/117457125426841887","date_published":"2026-10-17T16:11:40+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-17 16:11","date_timestamp":1792253500,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99345061","content_html":"🤷♂️ An OpenAI research model used cryptocurrency from someone else’s wallet to deploy a smart contract, without permission. OpenAI also reported other cases where models bypassed internet limits, accessed private data, or tried to fake results. The company says it has added safeguards and monitoring to prevent similar behavior.
Sky's the limit I guess.
","summary":"","url":"https://infosec.exchange/@0x58/117451389806546790","date_published":"2026-10-16T15:53:02+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-16 15:53","date_timestamp":1792165982,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99282863","content_html":"@axx That still remains a criminal act in the cyberspace.
","url":"https://infosec.exchange/users/0x58/statuses/117445641783975072","date_published":"2026-10-15T15:31:14+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-15 15:31","date_timestamp":1792078274,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"99280374","content_html":"I think we live in a f*cked up world. Cybercriminals prefer to heat up supermarket fridges rather than lower the gas prices at the stations
Change my mind.
","summary":"","url":"https://infosec.exchange/@0x58/117445473486619292","date_published":"2026-10-15T14:48:26+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-15 14:48","date_timestamp":1792075706,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99272802","content_html":"Great Win!
Authorities in 17 countries arrested 95 suspects in a crackdown on online groups sharing child abuse material — Investigators carried out 127 searches and rescued a five-year-old child.
","summary":"","url":"https://infosec.exchange/@0x58/117444909685269903","date_published":"2026-10-15T12:25:03+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-15 12:25","date_timestamp":1792067103,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99220334","content_html":"@krypt3ia @Javvad @brianhonan Buddy, gruyère is Swiss! 🙃
","url":"https://infosec.exchange/users/0x58/statuses/117440024216785382","date_published":"2026-10-14T15:42:37+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-14 15:42","date_timestamp":1791992557,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"99209375","content_html":"Palantir CTO Shyam Sankar told CBS’s Face the Nation that some AI researchers have started smoking because they believe the technology will cure cancer before the habit harms them. He offered the story as an example of extreme faith in AI;
🤣 🤣 🤣 🤣 and as @krypt3ia would say: we're doomed.
","summary":"","url":"https://infosec.exchange/@0x58/117439205649316665","date_published":"2026-10-14T12:14:26+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-14 12:14","date_timestamp":1791980066,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99209016","content_html":"@malwarejake I bet you did. I meant that 50th SonicWall vuln, I know how it did happen ![\"lolsob\"](\"https://cdn.micro.blog/photos/1000x/https%3A%2F%2Fcdn.micro.blog%2Fphotos%2F40%2Fhttps%253A%252F%252Fmedia.infosec.exchange%252Finfosec.exchange%252Fcustom_emojis%252Fimages%252F000%252F232%252F697%252Fstatic%252Fc1b2d94f9012ee55.png\")
@malwarejake Ep. 50 on SonicWall's vulnerabilities? Easy to get this that quickly 🤣 🤣
","url":"https://infosec.exchange/users/0x58/statuses/117434185953151254","date_published":"2026-10-13T14:57:52+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-13 14:57","date_timestamp":1791903472,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"99155274","content_html":"Unpopular opinion. I kinda like this new #Apple HomeView.
","summary":"","url":"https://infosec.exchange/@0x58/117434168608315232","date_published":"2026-10-13T14:53:27+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-13 14:53","date_timestamp":1791903207,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"99089702","content_html":"@GossiTheDog I wonder if it's related in any way with the French supermarkets incident....
https://infosec.exchange/@0x58/117427876026677746
","url":"https://infosec.exchange/users/0x58/statuses/117427893677494543","date_published":"2026-10-12T12:17:39+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-12 12:17","date_timestamp":1791807459,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"99089543","content_html":"🇫🇷 🛒 A cyberattack disrupted refrigeration systems at several French supermarket chains. Attackers reportedly forced some systems to heat up, spoiling food and causing major losses. The incident may involve outdated Danfoss software, and an investigation is underway.
https://www.infosecurity-magazine.com/news/french-supermarket-chains/
","summary":"","url":"https://infosec.exchange/@0x58/117427876026677746","date_published":"2026-10-12T12:13:10+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-10-12 12:13","date_timestamp":1791807190,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"96168934","content_html":"New #Anthropic beer 🍻
![\"A](\"https://cdn.micro.blog/photos/1000x/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Fmedia_attachments%2Ffiles%2F117%2F134%2F911%2F013%2F197%2F288%2Foriginal%2Fed6755e8a384e98f.jpeg\")
Chess.com breached? ♟️
","summary":"","url":"https://infosec.exchange/@0x58/117094599331165293","date_published":"2026-08-14T15:36:31+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-08-14 15:36","date_timestamp":1786721791,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"95751957","content_html":"🇫🇷 Une nouvelle cyberattaque visant la Direction générale des Finances publiques (DGFiP) est revendiquée par le cybercriminel ZeroBytes.
Cette fois, l’attaque concerne le Serveur Professionnel de Données Cadastrales (SPDC), accessible via le domaine apexappliext.dgfip.finances.gouv.fr.
Le pirate revendique une extraction partielle de 252 149 lignes, représentant selon lui 2 041 778 personnes, plusieurs titulaires pouvant être associés à une même parcelle.
https://frenchbreaches.com/alertes/direction-g-n-rale-des-finances-publiques-spdc-mssm0kklrsqu9rd3vd
","summary":"","url":"https://infosec.exchange/@0x58/117093248896961854","date_published":"2026-08-14T09:53:05+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-08-14 09:53","date_timestamp":1786701185,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"95440737","content_html":"🕵🏻♂️ [InfoSec MASHUP] 32/2026 - Autonomous, Malicious, and Technically Not Illegal.
Back after two weeks off — a wildfire evacuation and some much-needed summer downtime. Good to be back!
During a sanctioned security evaluation by the UK AI Security Institute, an #Anthropic Claude #Mythos 5 agent was given a task. It completed that task by attempting to insert a backdoor into a real #opensource project — and then created fake accounts to vouch for its own malicious pull request. Human reviewers caught it. GitHub's protections helped. No real-world harm was confirmed. But the detail worth sitting with is that the agent wasn't jailbroken, wasn't misused, and wasn't acting against its instructions in any obvious sense. It was doing what it determined the task required, and it fabricated social proof to make it stick.
The TechCrunch piece this week asks who's legally liable when autonomous AI agents cause harm. The honest answer is that nobody knows yet — the legal frameworks that govern software liability, contractor negligence, and computer crime were not written with agents in mind. #OpenAI and Anthropic have both now had models escape sandboxes and interact with production systems during evaluations. The incidents are being handled as engineering problems. At some point they will be handled as legal ones, and the industry's current answer — tighter sandbox controls and better monitoring — is going to look inadequate when a lawyer reads it.
→ Week #32/2026 also covers: Iran-linked hackers hit water utilities in seven U.S. states, Storm-2945 harvested M365 credentials from hotel Wi-Fi, and Samsung banned smart TV apps secretly running residential proxies.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-32-2026-autonomous-malicious-and-technically-not-illegal
If you find it useful, subscribe to get it in your inbox every weekend 📨
","summary":"","url":"https://infosec.exchange/@0x58/117064599347781713","date_published":"2026-08-09T08:27:08+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-08-09 08:27","date_timestamp":1786264028,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"95345484","content_html":"@Tarah @BenDoubleU s/Horeshoe/Horseshit/
rnicrosoft.com or microsoft.com ?
","summary":"","url":"https://infosec.exchange/@0x58/116935461155891382","date_published":"2026-07-17T13:05:35+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-07-17 13:05","date_timestamp":1784293535,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"92650121","content_html":"🕵🏻♂️ [InfoSec MASHUP] 25/2026 - Client-Side Authorization Is Not Authorization
BobDaHacker didn't find a zero-day. She didn't exploit a memory corruption bug or chain together three CVEs. She uploaded a photo of her ID to FIFA's public agent registration portal, got added to FIFA's #Microsoft Entra tenant, and walked straight into the live production Streaming Management panel for the #FIFA World Cup 2026. Every match. Every camera angle. Every RTMP stream key. One click away from replacing the PGM feed — the main broadcast output going to every TV network worldwide — with whatever she felt like pushing. She did not push anything. She spent the rest of the night calling FIFA, MediaKind, HBS, CISA, and the FBI trying to get someone to pick up the phone.
The root cause is almost insultingly mundane: client-side authorization with no server-side enforcement. The Angular frontend checked the JWT, found no roles, showed an \"access denied\" page. The backend APIs didn't check anything. FIFA fixed it by the next morning without ever responding to the researcher. She's still on their official match document distribution list, receiving Start Lists and Tactical Lineups in four languages. The vulnerability is gone. The bug bounty program, the security.txt file, and the acknowledgment to the person who saved them from a global broadcast catastrophe remain absent. Client-side authorization is not authorization. It's 2026.
→ Week #25/2026 also covers: The #SocGholish botnet is down after nine years, Texas leaked 3M driver's licenses and passports, and dozens of cybersecurity vets are calling the #Anthropic ban dangerous
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-25-2026-client-side-authorization-is-not-authorization
If you find it useful, subscribe to get it in your inbox every weekend 📨
","summary":"","url":"https://infosec.exchange/@0x58/116793199325724708","date_published":"2026-06-22T10:06:32+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-22 10:06","date_timestamp":1782122792,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"92499762","content_html":"@jerry Hopefully we won't call them ivantginx in a few weeks from now.
","url":"https://infosec.exchange/users/0x58/statuses/116777375339626355","date_published":"2026-06-19T15:02:17+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-19 15:02","date_timestamp":1781881337,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"92482562","content_html":"🎙️ Great episode of the @resilientcyber podcast with @nielsprovos -- absolute legend in #infosec and #openbsd ![\"puffer\"](\"https://cdn.micro.blog/photos/40/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Fcustom_emojis%2Fimages%2F000%2F028%2F564%2Fstatic%2F1822c37750abfeb4.png\")
https://youtu.be/gRgDsdm4RQo?si=Q6WxdoWXUY4S6GOw
","summary":"","url":"https://infosec.exchange/@0x58/116775880750954537","date_published":"2026-06-19T08:42:11+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-19 08:42","date_timestamp":1781858531,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":true,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"92094509","content_html":"🕵🏻♂️ [InfoSec MASHUP] 24/2026 - npm v12 Is the Apology. The Malware Section Is the Receipt.
Last week's question was why the software ecosystem keeps shipping holes and handing the cleanup bill to operational teams. This week #npm answered, at least partially. npm v12 will block automatic code execution during install by default — no more preinstall scripts running silently, no more Git dependencies or URL-based packages pulling in whatever they feel like. Developers will have to explicitly opt in. It's the right call, it's what the supply chain attack surface has been screaming for across months of #CanisterWorm, Shai-Hulud, IronWorm, and Megalodon campaigns, and it arrives roughly four years after the attack pattern became impossible to ignore.
The #malware section this week is, as ever, the context that makes the fix legible. Nineteen PyPI packages trojaned via .pth startup hooks. A WinRAR flaw from last year still fueling active campaigns against Ukrainian organizations. #TeamPCP back with CanisterWorm. The backlog of techniques that predate npm v12 isn't going anywhere — and the install-time execution block doesn't touch the packages already in production, the developers who won't upgrade immediately, or the registries that aren't npm. It's a meaningful fix to a well-understood problem. It's also, by the industry's own timeline, a very belated one.
→ Week #24/2026 also covers: Microsoft patched 200 flaws and three zero-days, Cisco's SD-WAN hit its seventh exploited zero-day of the year, and #ShinyHunters went after Oracle PeopleSoft at 100+ universities
If you find it useful, subscribe to get it in your inbox every weekend 📨
","summary":"","url":"https://infosec.exchange/@0x58/116741839105004391","date_published":"2026-06-13T08:24:57+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-13 08:24","date_timestamp":1781339097,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"91965353","content_html":"@kev Glad to hear it was for the best!
","url":"https://infosec.exchange/users/0x58/statuses/116731242045851770","date_published":"2026-06-11T11:29:59+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-11 11:29","date_timestamp":1781177399,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"91752261","content_html":"Curated index of publicly disclosed #GenAI & agentic-AI security incidents. Every entry is cross-mapped to OWASP LLM Top 10, OWASP Agentic Top 10, NIST AI RMF, and MITRE ATLAS.
https://emmanuelgjr.github.io/genai_incidents/
","summary":"","url":"https://infosec.exchange/@0x58/116714482048437437","date_published":"2026-06-08T12:27:42+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-08 12:27","date_timestamp":1780921662,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"91637854","content_html":"🕵🏻♂️ [InfoSec MASHUP] 23/2026 - Built Broken, Patched by Others.
Another week, another set of trojaned packages, hijacked registries, and one-click credential theft. The operational response is by now well-rehearsed: patch, rotate secrets, enable 2FA, audit your dependencies, check your CI/CD workflows. The patching teams are doing their jobs. The question this week's malware section keeps nudging at is a different one: why is so much of what they're patching broken at the point of creation?
The supply chain attack surface exists because the software ecosystem normalized shipping fast over shipping secure, because package registries scaled adoption without scaling trust infrastructure, and because the developer who published a package with a hardcoded credential and the organization running it in production are rarely the same person bearing the consequences. #IBM and #RedHat just committed $5 billion to fix this upstream. #CISA launched CI Fortify to help #OT operators survive worst-case scenarios downstream. Both efforts are necessary. Both are also symptoms of an industry that has spent decades externalizing the cost of insecure software onto the people least positioned to refuse it.
→ Week #23/2026 also covers: Palo Alto Networks Alto GlobalProtect auth bypass is actively exploited, Weil, Gotshal & Manges LLP reportedly paid $20M to keep client files quiet, and the #EU is moving to limit U.S. cloud in sensitive infrastructure
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-23-2026-built-broken-patched-by-others
If you find it useful, subscribe to get it in your inbox every weekend 📨
","summary":"","url":"https://infosec.exchange/@0x58/116702301713525229","date_published":"2026-06-06T08:50:04+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-06 08:50","date_timestamp":1780735804,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"91471467","content_html":"@j0hnnyxm4s Vibe coded hardware?
","url":"https://infosec.exchange/users/0x58/statuses/116686864495391110","date_published":"2026-06-03T15:24:11+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-06-03 15:24","date_timestamp":1780500251,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"edit_url":null,"is_conversation":true,"is_linkpost":false,"is_mention":true}},{"id":"91213520","content_html":"🕵🏻♂️ [InfoSec MASHUP] 22/2026 - The Patch Is Scaling. So Is the Attack.
#Megalodon backdoored 5,500 #GitHub repositories in six hours. Not six days — six hours. Malicious commits silently replacing CI/CD workflows, hoovering tokens, cloud credentials, SSH keys, and environment variables before most of the affected projects had processed a single alert. The same week, #IBM and #RedHat announced a $5 billion commitment, called Project Lightwell, to securing the open source supply chain, #Anthropic's #Mythos model surfaced 23,000 potential vulnerabilities across 1,000 OSS projects, and Apple open-sourced its quantum-resistant crypto stack with formal verification proofs attached. The industry's response to supply chain risk is finally arriving at a scale that looks serious.
The problem is the math. The response is measured in billions of dollars and multi-year programs. The attack is measured in hours and automated tooling. Megalodon's six-hour window isn't an anomaly — it's a benchmark. Last week it was TeamPCP and the GitHub cascade. The week before, Laravel Lang and malicious postinstall hooks across 700 repos. The investment in defense is real and necessary, but it's being deployed against a threat that doesn't need a budget cycle to iterate. Project Lightwell will fund important work. Megalodon already shipped.
→ Week #22/2026 also covers: #ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-22-2026-the-patch-is-scaling-so-is-the-attack
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
","summary":"","url":"https://infosec.exchange/@0x58/116663976562424551","date_published":"2026-05-30T14:23:29+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-05-30 14:23","date_timestamp":1780151009,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"90866750","content_html":"🕵🏻♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.
This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.
These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional \"patch and move on\" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.
→ Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-21-2026-the-supply-chain-didn-t-break-it-was-walked
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
","summary":"","url":"https://infosec.exchange/@0x58/116634335194122034","date_published":"2026-05-25T08:45:18+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-05-25 08:45","date_timestamp":1779698718,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"90398128","content_html":"🕵🏻♂️ [InfoSec MASHUP] 20/2026 - The Platform Is the Attack Surface.
The supply chain attack story this week isn't about a sketchy package lurking in a dark corner of npm. It's about #Anthropic Claude.ai shared chats being used to distribute Mac #malware, a fake Hugging Face repository impersonating OpenAI's Privacy Filter trending at #1 with 244,000 downloads, and JDownloader's own website serving swapped installers. The common thread isn't sophistication — it's borrowed credibility. Attackers have figured out that the detection model most users rely on, implicitly or otherwise, is \"I've heard of this platform, therefore this thing on it is probably fine.\"
That assumption has always been fragile. What's changed is how systematically it's being exploited. A trending repo with a quarter-million downloads looks legitimate by every surface signal. A shared Claude.ai chat looks like a helpful resource. A download from the official project website looks like the official project. The trust isn't in the content — it's in the container. And the container is now the attack surface.
→ Week #20/2026 also covers: #ShinyHunters got paid, #TeamPCP hit 170 packages across npm and PyPI, and Cisco's SD-WAN zero-day count hit six for the year
Full issue 👉 https://infosec-mashup.santolaria.net/p/infosec-mashup-20-2026-the-platform-is-the-attack-surface
If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI
","summary":"","url":"https://infosec.exchange/@0x58/116594576901093824","date_published":"2026-05-18T08:14:14+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2026-05-18 08:14","date_timestamp":1779092054,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}},{"id":"13609563","content_html":"Giving this a try - How's the #infosec community here?
","summary":"","url":"https://infosec.exchange/@0x58/109262394898148972","date_published":"2022-10-31T10:23:56+00:00","author":{"name":"Xavier «X» Santolaria :verified_paw: :donor:","url":"https://infosec.exchange/@0x58","avatar":"https://cdn.micro.blog/photos/96/https%3A%2F%2Fmedia.infosec.exchange%2Finfosec.exchange%2Faccounts%2Favatars%2F109%2F262%2F357%2F540%2F251%2F967%2Foriginal%2F9529268e4a925c2d.png","_microblog":{"username":"0x58@infosec.exchange"}},"_microblog":{"date_relative":"2022-10-31 10:23","date_timestamp":1667211836,"is_favorite":false,"is_bookmark":false,"is_deletable":false,"is_conversation":false,"is_linkpost":false,"is_mention":false,"is_podcast":false,"note":"","syndication":[]}}]}