‼️ BREAKING: Rank Math shipped malware in its paid WordPress SEO plugin.
Some PRO 3.0.123 copies downloaded on 15 and 16 October carried a backdoor.
Rank Math says sites that activated one should treat passwords and API keys as exposed.
‼️ BREAKING: Hackers copied data on every California public-school student from the past three school years, testing firm ETS says.
The files hold birth dates, addresses and disability details. POLITICO says millions of students are exposed.
The Everest gang claims 139.85GB.
‼️ In one tenant, a second ConnectWise app gave itself Global Admin and added new secrets to two other apps, including that customer's Huntress security tool.
Huntress has not tied this to the hackers behind the 162 sign-ins.
🚨 BREAKING: Hackers used ConnectWise's own backup app to sign into 162 Microsoft 365 tenants, Huntress says.
The app can read their mail, files and Teams data. Huntress has not confirmed that any data was taken.
ConnectWise has shut off Cloud Backup until further notice.
‼️BREAKING: Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11.
Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times.
Boot ROM code is burned into the chip. No update can fix it.
‼️ Japan is facing a storm of data breaches, and it keeps getting worse.
Delivery giant Yamato Transport now says hackers took 5.31 million records, from names and addresses to what people bought.
Cosmetics firms Fancl and Attenir say 834,947 more may have leaked.
Ransomware gang Qilin claims it hit rail operator Keio and posted what it says are Keio files.
In the past month, JR East, travel site Skyticket and software firm Sourcenext have each disclosed possible leaks of millions of records.
Japan's National Police Agency says it is not yet clear whether the attacks are linked.
‼️ iRhythm, maker of the Zio wearable heart monitor, told Oregon's attorney general its June hack hit 8.2 million people.
Hackers stole their data and demanded payment. iRhythm has not said if it paid.
The company says it has served 8 million+ patients in the US and Europe.
‼️ UPDATE: Calif showed one-tap attacks on Signal and iMessage on iOS, which make it possible to run code on an iPhone with a booby-trapped PDF.
On iOS 26.5, opening one in iMessage sent the phone's messages to a server.
Calif says everything will be released "in due time."
‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris.
Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.
‼️ A CVSS 10 flaw lets attackers run code on Magento and Adobe Commerce servers without a login.
Sansec reproduced 4 exploit routes within a day of Adobe's Oct 13 patch.
Adobe still gave stores 30 days. Last month's sister bug was mass-exploited in 3.
❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen.
The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram.
The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free," they said.
‼️ Claude cracked the decades-old mystery of where the NSA got the seeds for NIST's P-256 and other curves.
They came from a basic C random generator seeded with 1997-98 timestamps, not a hashed phrase.
The bounty's organiser says that leaves too little room for a backdoor.
410 Followers 537 FollowingPrivacy Sandbox @googlechrome. Made OSS security & privacy software, autonomous robots, and many mobile apps. This is a personal account.
712K Followers 6K Followingprofessional it/that and lil/shid @wassie
NOT AFFILIATED WITH ANY TOKEN
NOT A FROK D:
mite be a multiagency fed (unproven)
check out https://t.co/kq0S9R3nRZ
90K Followers 18 FollowingTrendAI Zero Day Initiative™ (ZDI) is a program designed to reward security researchers for responsibly disclosing vulnerabilities.
21K Followers 604 FollowingThe only messaging network without any user identifiers.
Get the app: https://t.co/h416sFMxuz
Own a part of SimpleX Network: https://t.co/BH23vbGDvN
890 Followers 2K FollowingResearcher at Recorded Time LTD. Curator of @Forbes U30 lists. Russian troll hunter.
"Clever Boy" -- Tom Verlaine
"Boorish and offensive" -- Yevgeny Prigozhin
4K Followers 10 FollowingWrite using AI, get human written results. API, Agents, & MCP’s available. Removes AI Detection risk and AI Watermarks from your text.
2.5M Followers 2K FollowingOpen Source Intelligence Monitor focused on Europe and Conflicts across the World. RT ≠ Endorsement. Want to Support my Work? https://t.co/PcUbewwuEZ
212K Followers 14 FollowingFollow what the CEOs and other executives from tech companies do on X. DMs open for feedback and requests. Powered by @Kalshi
21K Followers 535 FollowingWe're two #iOS developers and occasional #security researchers on two continents. #CyberSecurity 📝https://t.co/69k7WAphKl 🇨🇦🇩🇪
Current Project: @psylo_app
4K Followers 438 FollowingSecurity Researcher @AikidoSecurity. Previously @SecCodeWarrior, co-founder at Adversaryio & Principal Security Engineer/Partner @thesyndis. Opinions all my own
45K Followers 2K FollowingLeveraging technologies to execute visions | OSS, Local AI | Current https://t.co/cwEgduZcvy @neutralityorg | Former @RTFKT @Nike @Google @sbreakintl | Opinions are my own
253K Followers 7K FollowingOG GenAI Skeptic; spoke at US Senate. Warned about hallucinations in 2001. Advocating world models & neurosymbolic AI ever since. Author, Marcus on AI & 6 books
333K Followers 2K FollowingIndependent investigative journalist. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter. Mastodon: https://t.co/fTKNavlMwp
1.3M Followers 2K FollowingI am a technology enthusiast, writer, and modder. Founder of @ModRetro, @Oculus VR, and @Anduriltech. Keeping American superheroes safe with autonomous systems.
9K Followers 889 FollowingBad guy chaser, writer/author, espionage & ransomware SME. Sometimes I harass my dog. He is the brains behind these projects and opinions are his.