← Feed

Posts

• View post

  this week in security — october 25 2026 edition This newsletter is sponsored by Origin. Can an AI agent go rogue without an attacker? In a live webinar on November 17, Security researcher Tyler Holmwood shows how agents go off course and how existing controls can limit the damage. ~ ~ THIS WEEK, TL;DR Global websites pulled down as PHP bugs threaten to set the internet on fire The PHP Foundation: Well… you know it's going to be a rough one when PHP makes mainstream news and the...

• View post

  How a phone call allowed a hacker to steal millions of people's personal data Earlier this year, Dutch telco Odido was breached by a hacker who stole the personal information of more than six million people in one of the largest thefts of data in the country's history. The breach relied on a phone call to a customer support agent and the use of a phishing page to capture their credentials, Dutch authorities have confirmed. In a rare public disclosure since then, law enforcement have re...

• View post

  The U.S. government and a bunch of large internet providers, phone companies, and cable network operators are freaking out about a rising threat that they know is there but can't really see all that well. We're talking about residential proxy networks — also known as "resproxies," or "huge pain in my ass," depending on who you talk to at these companies. Residential proxy networks allow other people to rent access to your home or office internet connection. These pro...

• View post

  From the reader mailbag: "Recently there has been talk about privilege in a legal context when people and their lawyers use an LLM. What gets discussed with an LLM could form part of the disclosures required. ...I wonder how much of this data could be required to be divulged in a legal context in future court proceedings." It's a really interesting thought, with a complicated answer. The answer is, "it depends." More industries than ever are relying on AI chatbots and LL...

• View post

  This newsletter is sponsored by Blue Team Con, the only InfoSec conference created by — and for — defenders. Join us Sept. 10-13 and earn 32+ CPEs. Tickets on sale now! ~ ~ THIS WEEK, TL;DR OpenAI says its AI models escaped a sandbox during a test and hacked Hugging Face Reuters ($): The fallout from last week's hack of Hugging Face got a bit more complicated because OpenAI has since admitted that its GPT-5.6 Sol model and another unreleased AI model autonomously carried out the...

• View post

  Smart glasses are the latest "luxury surveillance" wearable gadgets on the market, and they're already drawing a ton of heat over privacy concerns. These internet-connected eyeglasses are equipped with cameras and microphones, and some have AI built-in. This allows the glasses to capture and process audio and video of anyone nearby, but with no way for them to automatically opt out. When someone holds a phone camera to your face, at least you know it's happening. With smart gl...

• View post

  ~ ~ THIS WEEK, TL;DR Supreme Court says search warrants are needed for accessing a person's location data SCOTUSblog: It's good to be back online after a long-weekend away with some actual good news (quelle surprise!) from the U.S. top court: Geofence warrants are search warrants, and must be treated as such, per Chatrie v. U.S [PDF]. The ruling means Americans' geolocation data is legally protected, despite the controversial way that geofence warrants are used to reverse-engi...

• View post

  ~ ~ THIS WEEK, TL;DR Instructure paid and 'reached an agreement' with hackers who breached it twice; ShinyHunters says it won't extort victims BBC News ($): Canvas school system maker Instructure paid the hackers that breached the company (twice) and stole gobs of student data. Instructure CEO Steve Daly said the company "reached an agreement" with the hackers (heavy wink, of course) to not release the data, without saying how many millions it paid the hackers or est...