<macros>

Stop exposing network management interfaces to the internet. MikroTik is now being actively exploited through internet-facing SSH to gain full administrative control without authentication.

Invisible Unicode has been around for ages, but now it's being weaponised to bypass security filters.

Don't treat EDR as your one-and-done solution. The Gentlemen ransomware operators are disabling EDR, destroying backups and clearing logs before encrypting the network.

Attackers are now putting malicious prompts inside malware to trigger AI safety guardrails and interfere with analysis. Wow.

100 companies, including the companies building AI models, are warning that AI-powered cyberattacks could become widespread within months. We need to prepare our infrastructure, systems and users, and automate defence at the same pace.

Nice. ECH + DoH is a significant privacy upgrade and makes it harder for your ISP to snoop on your browsing.

So we're putting increasingly autonomous agents into environments where we monitor the systems, but not the agents themselves? If an agent can find its own paths to an objective that we didn't anticipate, having a human in the loop means pretty much nothing.

Frankly, not surprised. A huge chunk of email hosting is based on reputation, not the computing stack. Google, Microsoft and others make their own decisions about whether to accept your mail.

Selling the shovels isn't enough? Nvidia started financing the gold rush.

Cybersecurity is becoming an automation arms race. Humans are going to be too slow to manually respond to AI-driven attacks.

Lots of dependency poisoning lately. SCA + dependency pinning/lockfiles + isolated builds + sandboxing + EDR are a must for keeping third party code under control.

We're in an electricity infrastructure boom riding on GPUs.

Using Bluetooth/BLE to build a relay infrastructure and bypass network restrictions is actually genius. Scary, but smart. Now you have to walk around with an air-gapped brick.

CVSS 9.8, unauthenticated RCE, remotely exploitable. Probably don't wait until Patch Tuesday :|

Broadcom's VMware licensing mess sure makes it easy to patch CVEs. Just migrate.

Giving an AI agent access to years of SOC history is a choice. Do your due diligence.

Anthropic says the watermark doesn't affect Claude's quality. Maybe. But the watermark is produced by deliberately biasing the model's token selection.

AI is finding vulnerabilities faster than orgs can fix them, but I don't think that's a problem with AI. It's just exposing the technical debt we already had.

Short-burst 1 Tbps DDoS attacks are becoming more common now. Absurd amounts of traffic delivered in seconds.

Nearly 400 vulnerabilities and 3 ZDs in one Patch Tuesday. Wild.

"Rogue AI" is a stretch. They were given a prompt and followed the path of least resistance. They just didn't isolate the agent's network access.

European tech sovereignty sounds great until you realise how much of Europe's IT infrastructure is built around US companies.

As usual, Meta had to follow in the footsteps of Anthropic and OpenAI. Great idea giving AI internet access during security tests.

Metabase just had a zero-day breach. If you're self-hosting Metabase, deploy the latest version.

What's up with containment controls?

Finally, I can stop asking customer service for recipes to figure out whether I'm talking to AI.

Intercepting captive portals on public networks is terrifying, with the public Wi-Fi captive portal experience becoming one massive phishing trap.

Europe designing its own high-performance RISC-V silicon is fantastic news for digital sovereignty.

So Google is essentially turning your Google profile into an API for AI agents, letting them operate as you. Can't wait for the next generation of prompt injections.

OpenAI last week, now Anthropic... Why aren't these tests run in an isolated environment? HalluSquatting is becoming a thing now.

Surprise. Flock was never really about deterring crime, but a justification for building a mass surveillance network.

Admins, please don't expose one of the most powerful backdoors in your environment to the world. BMC is not meant to be discoverable by Shodan.

Microsoft admitting its own UI framework wastes memory is probably the biggest endorsement of lightweight Linux desktops they've given in years.

Cloudflare's plan only works if AI companies need your content more than you need their traffic. Should AI be able to use your content without sending visitors back? If not, are you willing to risk becoming less visible as AI increasingly replaces traditional search?

OpenAI didn't even clock it for a week? With models this capable, training needs to be regulated and supervised.

Shame the RAM crisis forced Valve into bumping the price, SteamOS / Bazzite / Nobara managed to bridge a massive gap.

Australia, the UK, now France (which at least mandates double-blind attestation so the site does not know your name).

The others could have done the same. But isn't it more convenient to tie a government ID to your browsing history? What a privacy nightmare.

Great precedent for AI companies, apparently the issue isn't using copyrighted works to train AI, it's how you obtained them... smh.

Thank you, Joshua and Anthony, for everything you've contributed to the open source community.

HP, the king of anti consumer practices. Is Brother the only reliable printer brand left on the market?

If your users talk about IT every day, you're probably doing IT wrong. The best IT departments are invisible.

I bought Meta's glasses in the first wave back in 2023, for the tech, and quit wearing them within a week because it just felt plain wrong. Build a device whose whole pitch is secretly filming people, and don't be shocked when the people drawn to that pitch turn out to be creeps.

All this just after Fortibleed, is Fortinet chronically behind their own attack surface?

Don't really see the point of this macropad, but have to admit the design is neat.

No wonder, GG Broadcom. Everyone is either migrating or actively evaluating alternatives like Proxmox.

If your entire digital life exists behind one cloud account, you don't have a backup.

September is getting closer and there are still no news on the implementation plans. Graphene and Lineage look like they'll be no exception either, since they already fail Play Integrity that age checks are built on.

I was never sold on Plex's centralised user management. If their "lifetime" passes were the final straw, come on over to Jellyfin.

Yet another prompt injection vector, maybe don't let agents auto-read arbitrary files referenced from convention files without a policy gate?

Future is bleak; though this is for unencrypted private messages, only a matter of time until OS-level surveillance is implemented (at least in the UK for now), undermining E2EE.

Patch your Gitea instance whether or not it's exposed (and change default admin username while at it).