Steve Puluka
@spuluka.bsky.social
đ€ 228
đ„ 147
đ 880
Network & Security Engineer / Cantor & Religious Education Instructor
http://puluka.com/home
That time again to review the 3 new security advisories from Palo Alto Networks and get patching the affected gear.
security.paloaltonetworks.com
loading . . .
Palo Alto Networks Security Advisories
Palo Alto Networks Security Advisories - Latest information and remediations available for vulnerabilities concerning Palo Alto Networks products and services.
https://security.paloaltonetworks.com/
1 day ago
2
0
0
That time again to review the 18 new security advisories released by Juniper and get patching the affected gear.
supportportal.juniper.net/s/global-sea...
loading . . .
CEC Juniper Community
https://supportportal.juniper.net/s/global-search/%40uri#t=KnowledgeArticles&sort=relevancy&f:ctype=[Security%20Advisories]
2 days ago
0
0
0
Chinese authorities continue to take the running of cyber scam centers in Myanmar seriously. Convictions of Chinese nationals resulted in death sentences for members of the Ming crime family.
www.spp.gov.cn/spp/zdgz/202...
loading . . .
https://www.spp.gov.cn/spp/zdgz/202509/t20250929_707820.shtml
3 days ago
0
0
0
Cool story of how a Ransomware crew tried to bribe a reporter for help hacking into their employer but just became the top story instead.
www.bbc.com/news/article...
loading . . .
'You'll never need to work again': Criminals offer reporter money to hack BBC
Reporter Joe Tidy was offered money if he would help cyber criminals access BBC systems.
https://www.bbc.com/news/articles/c3w5n903447o
4 days ago
0
0
0
Good news that Interpol has worked with authorities across Africa to arrest 260 scam suspects across the continent.
www.interpol.int/News-and-Eve...
loading . . .
260 suspected scammers arrested in pan-African cybercrime operation
Operation targeted romance scams and sextortion in 14 African countries
https://www.interpol.int/News-and-Events/News/2025/260-suspected-scammers-arrested-in-pan-African-cybercrime-operation
5 days ago
0
0
0
The second draft the revised NIST document âFoundational Activities for IoT Product Manufacturersâ is open for comment for certain sections as noted.
www.nist.gov/blogs/cybers...
loading . . .
Sharpening the Focus on Product Requirements and Cybersecurity Risks: Updating Foundational Activities for IoT Product Manufacturers
Over the past few months, NIST has been revising and updating Foundational Act
https://www.nist.gov/blogs/cybersecurity-insights/sharpening-focus-product-requirements-and-cybersecurity-risks-updating
6 days ago
0
2
0
Interesting analysis by Nviso on the recent VMware privilege escalation vulnerability now patched but being exploited in the wild.
blog.nviso.eu/2025/09/29/y...
loading . . .
You name it, VMware elevates it (CVE-2025-41244)
NVISO has identified zero-day exploitation of CVE-2025-41244, a local privilege escalation vulnerability impacting VMware's guest service discovery features.
https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/
7 days ago
0
0
0
French security firm Sekoia has found that a threat actor has been using industrial router SMS API to send smishing messages since 2022.
blog.sekoia.io/silent-smish...
loading . . .
Silent Smishing : The Hidden Abuse of Cellular Router APIs
How attackers abuse Milesight cellular router APIs to run smishing at scale via unauthenticated SMS endpointsâtargeting Belgium (CSAM/eBox).
https://blog.sekoia.io/silent-smishing-the-hidden-abuse-of-cellular-router-apis/
8 days ago
0
0
0
The UK government is introducing a full Digital ID system for employment related benefits.
www.gov.uk/government/n...
loading . . .
New digital ID scheme to be rolled out across UK
A new digital ID scheme will help combat illegal working while making it easier for the vast majority of people to use vital government services. Digital ID will be mandatory for Right to Work checks ...
https://www.gov.uk/government/news/new-digital-id-scheme-to-be-rolled-out-across-uk
10 days ago
0
0
0
New guide with lessons learned during cyber incident response published by CISA from an unnamed civilian agency hacked via the GeoServer exploit.
www.cisa.gov/news-events/...
loading . . .
CISA Shares Lessons Learned from an Incident Response Engagement | CISA
https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266a
11 days ago
0
1
0
Looks like there may not be any extension of the 2015 Cybersecurity Information Sharing Act allowing companies to share details without legal consequences, meaning we will know less and be more exposed to cyber issues.
cyberscoop.com/cyber-threat...
loading . . .
Cyber threat information law hurtles toward expiration, with poor prospects for renewal
Pessimism is mounting about the chances that Congress will reauthorize a cyber threat information-sharing law before itâs set to expire at the end of this month.
https://cyberscoop.com/cyber-threat-information-law-hurtles-toward-expiration-with-poor-prospects-for-renewal/
12 days ago
0
0
0
Why we canât have good things, the first malicious MCP server found in the wild by Koi Security.
www.koi.security/blog/postmar...
loading . . .
First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails | Koi Blog
https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft
13 days ago
0
1
0
UK authorities have use
#AI
tools to detect and stop ÂŁ480M of fraud over the last year. The tools also recovered ÂŁ186M of pandemic loan fraud.
www.gov.uk/government/n...
loading . . .
Record fraud crackdown saves half a billion for public services
Government stops over ÂŁ480 million ending up in the pockets of fraudsters over twelve months since April 2024 - more money than ever before.
https://www.gov.uk/government/news/record-fraud-crackdown-saves-half-a-billion-for-public-services
14 days ago
0
0
0
Nice to see GitHub responding to recent supply chain attacks in open source by targeted increases in security procedures.
github.blog/security/sup...
loading . . .
Our plan for a more secure npm supply chain
GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.
https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/
15 days ago
0
1
0
Good news that French police have seized and taken down a criminal marketplace selling drugs, hacking tools and other criminal services. Two suspects are also arrested.
www.tribunal-de-paris.justice.fr/75/communiqu...
loading . . .
Communiqués de presse
https://www.tribunal-de-paris.justice.fr/75/communiques-de-presse-1
16 days ago
0
0
0
The Dutch Army plans to deploy hackers with frontline units during military conflicts to take control of drones, cameras and other devices that might provide intelligence or disrupt enemy forces.
nltimes.nl/2025/09/13/d...
loading . . .
Dutch army to deploy hackers to front lines to gain battlefield advantage
The Royal Netherlands Army is deploying hackers to the front lines as part of the newly formed 101 CEMA Battalion, officials said Thursday. According to De Telegraaf, the unit, officially established ...
https://nltimes.nl/2025/09/13/dutch-army-deploy-hackers-front-lines-gain-battlefield-advantage
17 days ago
0
0
0
An official MCP registry is launched sponsored by the MCP steering committee members including Anthropic and Microsoft.
blog.modelcontextprotocol.io/posts/2025-0...
loading . . .
Introducing the MCP Registry
Today, weâre launching the Model Context Protocol (MCP) Registryâan open catalog and API for publicly available MCP servers to improve discoverability and implementation. By standardizing how servers ...
https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/
18 days ago
0
0
0
The CVE program may be rescued from slow death yet. CISA has a proposal for how to handle the system but no funding yet for this vision.
www.cisa.gov/news-events/...
loading . . .
CISA Presents Vision for the Common Vulnerabilities and Exposures (CVE) Program | CISA
https://www.cisa.gov/news-events/news/cisa-presents-vision-common-vulnerabilities-and-exposures-cve-program
19 days ago
0
0
0
Good news that UK police have arrested two members of the Scattered Spider hacking group. They are charged for both UK and US based crimes.
www.nationalcrimeagency.gov.uk/news/two-cha...
loading . . .
Two charged for TfL cyber attack
Two men have been charged as part of the National Crime Agency investigation into a cyber attack on Transport for London (TfL).
https://www.nationalcrimeagency.gov.uk/news/two-charged-for-tfl-cyber-attack
20 days ago
0
0
0
Final Guidelines for Implementing âHandshakeâ Algorithms Known as Key-Encapsulation Mechanisms published by NIST.
csrc.nist.gov/pubs/sp/800/...
loading . . .
NIST Special Publication (SP) 800-227, Recommendations for Key-Encapsulation Mechanisms
A key-encapsulation mechanism (KEM) is a set of algorithms that can be used by two parties under certain conditions to securely establish a shared secret key over a public channel. A shared secret key...
https://csrc.nist.gov/pubs/sp/800/227/final
21 days ago
0
1
0
Russia may be flooding
#AI
chatbot models with false information to get their narratives distributed as fact more broadly.
www.americansunlight.org/updates/new-...
loading . . .
NEW REPORT: Russian propaganda may be flooding AI models â The American Sunlight Project
Click here to read the report. Click here to read the press release. Click here to access the database. It may be tempting to consider Russian influence campaigns in the United States and ...
https://www.americansunlight.org/updates/new-report-russian-propaganda-may-be-flooding-ai-models
22 days ago
0
1
0
The top 10
#AI
chatbots are getting worse. False information rates have increased from 18% to 35% since August 2024. Possible cause is always answer now instead of refusing when not sure.
www.newsguardtech.com/ai-monitor/a...
loading . . .
August 2025 â AI False Claim Monitor
https://www.newsguardtech.com/ai-monitor/august-2025-ai-false-claim-monitor/
23 days ago
0
0
0
MFA required for Azure administrators is coming in October as Microsoft moves to phase two of their rollout.
azure.microsoft.com/en-us/blog/a...
loading . . .
Azure mandatory multifactor authentication: Phase 2 starting in October 2025 | Microsoft Azure Blog
Microsoft Azure is announcing the start of Phase 2 multifactor authentication enforcement (MFA) starting October 1, 2025. Learn more.
https://azure.microsoft.com/en-us/blog/azure-mandatory-multifactor-authentication-phase-2-starting-in-october-2025/
24 days ago
0
0
0
An interesting part of the recent SalesLoft breech is the ability to reach beyond to data in other service providers like Sales Force. Our integration of services is both a strength and a weakness.
www.cybersecuritydive.com/news/hackers...
loading . . .
Hackers steal data from Salesforce instances in widespread campaign
Google researchers say the hackers abused a third-party tool in an attack spree designed to harvest credentials.
https://www.cybersecuritydive.com/news/hackers-steal-data-salesforce-instances/758676/
25 days ago
0
0
0
Interesting report on a new vulnerability in 9 WAF platforms allowing threat actors to bypass the firewall published by ETHIACK.
blog.ethiack.com/blog/bypassi...
loading . . .
Bypassing WAFs for Fun and JS Injection with Parameter Pollution
Technical deep dive into bypassing a strict Web Application Firewall using HTTP Parameter Pollution, leveraging multi-parameter payload splitting to achieve JavaScript injection and evade detection.
https://blog.ethiack.com/blog/bypassing-wafs-for-fun-and-js-injection-with-parameter-pollution
26 days ago
0
0
0
US investors are betting that our dystopian future is coming. Triple the investment is flowing to spyware and surveillance technologies in 2024 verses 2023 and triple the number of companies mostly in Israel & US.
www.atlanticcouncil.org/in-depth-res...
loading . . .
Mythical Beasts: Diving into the depths of the global spyware market
The second edition of the Mythical Beasts project assess how the global spyware market has developed and changed over the past year.
https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/mythical-beasts-diving-into-the-depths-of-the-global-spyware-market/
27 days ago
0
0
0
Individual Developers can now on board apps to the windows store for free in 200 markets.
blogs.windows.com/windowsdevel...
loading . . .
Free developer registration for individual developers on Microsoft Store
Weâre excited to share that individual developers can now publish apps to the Microsoft Store without paying any onboarding fees â and this new experience is now globally available in nearly 200 marke...
https://blogs.windows.com/windowsdeveloper/2025/09/10/free-developer-registration-for-individual-developers-on-microsoft-store/
28 days ago
0
0
0
No surprise that academic research found that security Phishing training just does not work.
www.computer.org/csdl/proceed...
loading . . .
CSDL | IEEE Computer Society
https://www.computer.org/csdl/proceedings-article/sp/2025/223600a076/21B7RjYyG9q
29 days ago
0
0
0
That time again to review the three new security advisories from Palo Alto Networks and get patching your affected gear.
security.paloaltonetworks.com
loading . . .
Palo Alto Networks Security Advisories
Palo Alto Networks Security Advisories - Latest information and remediations available for vulnerabilities concerning Palo Alto Networks products and services.
https://security.paloaltonetworks.com/
about 1 month ago
0
0
0
Free access to Microsoft Office 365 for all US college students includes Word, Excel, PowerPoint, OneNote, and Outlook with Copilot
#AI
assistant. Just register with a valid academic email account.
blogs.microsoft.com/on-the-issue...
loading . . .
New White House commitmentsâŻempower teachers, students, and job seekers through AI skilling and learning
Microsoft unveils new commitments that support theâŻPresidential AI ChallengeâŻand theâŻAI Education ExecutiveâŻOrder to empower teachers and students, build AI skills, and create economic opportunity.
https://blogs.microsoft.com/on-the-issues/2025/09/04/new-white-house-commitments/
about 1 month ago
0
0
0
Looking forward to being a delegate for Tech Field Day
#NFD39
coming Nov 5-6 with livestreams coming from Nokia & graphiant so far. Always interesting topics at the TFD events.
techfieldday.com/event/nfd39/
loading . . .
Networking Field Day 39 - Tech Field Day
https://techfieldday.com/event/nfd39/
about 1 month ago
1
2
0
A further step into
#AI
dystopia as researchers find how using small LLM models on commodity hardware power propaganda farms dispensing dis information.
techletters.substack.com/p/techletter...
loading . . .
TechLetters Insights. AI propaganda factories: from State actors to bedroom microâactors
AI will transform propaganda and information influence.
https://techletters.substack.com/p/techletters-insights-ai-propaganda
about 1 month ago
0
0
0
No surprise that Tesla âlostâ data proving they were at fault in an auto pilot related accident. But fortunately a white hat hacker managed to find the missing data.
www.washingtonpost.com/technology/2...
loading . . .
Tesla said it didnât have key data in a fatal crash. Then a hacker found it.
The key evidence was presented last month to a jury, which found the company partially liable for the 2019 crash in Key Largo, Florida.
https://www.washingtonpost.com/technology/2025/08/29/tesla-autopilot-crashes-evidence-testimony-wrongful-death/
about 1 month ago
0
1
0
In another nod to tech history, Microsoft has released the source code for BASIC for 6502 for the world to use and modify.
github.com/microsoft/BA...
loading . . .
GitHub - microsoft/BASIC-M6502: Microsoft BASIC for 6502 Microprocessor - Version 1.1
Microsoft BASIC for 6502 Microprocessor - Version 1.1 - microsoft/BASIC-M6502
https://github.com/microsoft/BASIC-M6502
about 1 month ago
0
0
0
Good news in this report on the recent take downs of the ransomware gangs are causing disruption and splintering of the larger players into smaller less effective groups.
therecord.media/ransomware-g...
loading . . .
Ransomware gang takedowns causing explosion of new, smaller groups
The ransomware ecosystem continues to splinter, with new gangs proliferating in the wake of law enforcement takedowns that have scattered affiliates and prompted criminal rebrands.
https://therecord.media/ransomware-gang-takedown-proliferation
about 1 month ago
0
0
0
Australia, New Zealand and the US have teamed up to create a prototype mobile cyber defense unit. The Joint Cyber Hunt Kit operated by a 9 member team will deploy by the end of the year.
www.defence.gov.au/news-events/...
loading . . .
https://www.defence.gov.au/news-events/news/2025-09-01/cyber-kits-keep-allies-hunt
about 1 month ago
0
0
0
The US Justice department arrested 25 of the 28 suspects they were able to identify from YouTube videos of scammers posted from call centers in India.
www.justice.gov/usao-sdca/pr...
loading . . .
YouTube Scambaiters Help Dismantle $65 Million Multinational Fraud Ring Targeting Thousands of Seniors
SAN DIEGO â Twenty-eight alleged members of a Chinese organized crime ring are charged in four federal grand jury indictments with participating in a massive $65 million fraud scheme targeting thousan...
https://www.justice.gov/usao-sdca/pr/youtube-scambaiters-help-dismantle-65-million-multinational-fraud-ring-targeting
about 1 month ago
0
0
0
Outline preview of a new Google Cyber disruption unit that will engage in offensive activities. Exploring ways the unit might operate. The US government has suggested these will be permitted.
cyberscoop.com/google-cyber...
loading . . .
Google previews cyber âdisruption unitâ as U.S. government, industry weigh going heavier on offense
Google says it is starting a cyber âdisruption unit,â a development that arrives in a potentially shifting U.S. landscape toward more offensive-oriented approaches in cyberspace.
https://cyberscoop.com/google-cybersecurity-disruption-unit-active-defense-hack-back/
about 1 month ago
0
0
0
More action by the US Treasury Department with sanctions against a front company helping to launder money earned by the North Korean IT workers in the USA.
home.treasury.gov/news/press-r...
loading . . .
Treasury Sanctions Fraud Network Funding DPRK Weapons Programs
Networkâs Scheme Harms American BusinessesWASHINGTONÂ â Today, the U.S. Department of the Treasuryâs Office of Foreign Assets Control (OFAC) sanctioned Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenya...
https://home.treasury.gov/news/press-releases/sb0230
about 1 month ago
1
2
0
Good overview on how Qualcomm is using
#AI
processes to manage WiFi to Cellular and Cellular to WiFi roaming experiences at the application layer.
www.qualcomm.com/news/onq/202...
loading . . .
The AI evolution: Transforming how we connect through 5G and Wi-Fi | Qualcomm
Discover how Qualcomm X85 5G Modem-RF and FastConnect 7900 enhance online gaming and video calls with AI-powered connectivity.
https://www.qualcomm.com/news/onq/2025/08/the-ai-evolution-transforming-how-we-connect-through-5g-and-wi-fi
about 1 month ago
0
0
0
Open for public comment is the CISA document outlining minimum requirements for implementation of SBOM - Software Bill of Materials.
www.cisa.gov/news-events/...
loading . . .
CISA Requests Public Comment for Updated Guidance on Software Bill of Materials | CISA
https://www.cisa.gov/news-events/alerts/2025/08/22/cisa-requests-public-comment-updated-guidance-software-bill-materials
about 1 month ago
0
0
0
Interesting caveat from Microsoft on the launch of
#AI
copilot for Excel. Donât use for a task needing accuracy or reproducibility.
www.pcgamer.com/software/ai/...
loading . . .
Microsoft launches Copilot AI function in Excel, but warns not to use it in 'any task requiring accuracy or reproducibility'
You can have Copilot generate your formulas in Excel now, but it doesn't sound ready for prime time.
https://www.pcgamer.com/software/ai/microsoft-launches-copilot-ai-function-in-excel-but-warns-not-to-use-it-in-any-task-requiring-accuracy-or-reproducibility/
about 2 months ago
1
2
0
So much for privacy, report from KOI Security the FreeVPN on Google Play store is snapping a screen shot of every site visited by the users. Hopefully this will be taken down and users notified soon.
www.koi.security/blog/spyvpn-...
loading . . .
SpyVPN: The Google-Featured VPN That Secretly Captures Your Screen | Koi Blog
FreeVPN.One, a Chrome-verified extension with over 100K installs, claimed to offer privacy but instead captured usersâ screens. Our research exposes how it operated.
https://www.koi.security/blog/spyvpn-the-vpn-that-secretly-captures-your-screen
about 2 months ago
0
0
0
Good news that the US Justice Department has arrested and charged the creator and operator of the DDoS botnet RapperBot. The bot was taken offline by the FBI earlier this month.
www.justice.gov/usao-ak/pr/o...
loading . . .
Oregon man charged with administering âRapper Botâ DDoS-for-hire Botnet
ANCHORAGE, Alaska â An Oregon man was charged by a federal criminal complaint today in the District of Alaska on charges related to his alleged development and administration of the âRapper Botâ DDoS-...
https://www.justice.gov/usao-ak/pr/oregon-man-charged-administering-rapper-bot-ddos-hire-botnet
about 2 months ago
0
0
0
Outline of the Microsoft Quantum safe encryption rollout for all devices. The process will be complete in 2029.
www.microsoft.com/en-us/securi...
loading . . .
Quantum-safe security: Progress towards next-generation cryptography | Microsoft Security Blog
Microsoft is proactively leading the transition to quantum-safe security by advancing post-quantum cryptography, collaborating with global standards bodies, and helping organizations prepare for the c...
https://www.microsoft.com/en-us/security/blog/2025/08/20/quantum-safe-security-progress-towards-next-generation-cryptography/
about 2 months ago
0
1
0
New security features are rolling out by PyPI to prevent take overs of accounts to distribute malicious code in libraries. Domain resurrection attacks re-launch expired domains used to own old libraries.
blog.pypi.org/posts/2025-0...
loading . . .
Preventing Domain Resurrection Attacks - The Python Package Index Blog
PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over PyPI accounts through password r...
https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/
about 2 months ago
0
0
0
New browser developer program created by CloudFlare will give preview versions of new features allowing testing to insure there are no issues. They continue to try to detect bot traffic and verify human activity for feeds.
blog.cloudflare.com/announcing-t...
loading . . .
Announcing the Cloudflare Browser Developer Program
Announcing the Browser Developer Program: Cloudflareâs new collaborative program to help shape Cloudflare challenges that work seamlessly with your browser. Get a direct communication channel, best pr...
https://blog.cloudflare.com/announcing-the-cloudflare-browser-developer-program/
about 2 months ago
0
0
0
Good news the US Department of Justice has seized the assets from a ransomware attack and identified and indicted Ianis Aleksandrovich Antropenko.
www.justice.gov/opa/pr/justi...
loading . . .
Justice Department Announces Seizure of Over $2.8 Million in Cryptocurrency, Cash, and other Assets
The Department of Justice unsealed six warrants yesterday in the U.S. District Courts for the Eastern District of Virginia, the Central District of California, and the Northern District of Texas autho...
https://www.justice.gov/opa/pr/justice-department-announces-seizure-over-28-million-cryptocurrency-cash-and-other-assets
about 2 months ago
0
0
0
The Google Jules
#AI
coding agent is vulnerable to prompt injection via hidden text in GitHub issues.
embracethered.com/blog/posts/2...
loading . . .
Google Jules is Vulnerable To Invisible Prompt Injection · Embrace The Red
Jules is vulnerable to Prompt Injection from invisible instructions in untrusted data, which can end up running arbitrary operating system commands via the run_in_bash_session tool
https://embracethered.com/blog/posts/2025/google-jules-invisible-prompt-injection/
about 2 months ago
0
0
1
Not so private VPN apps in Google Play store ship with a hard coded password allowing the apps Chinese owners to decrypt and view the user traffic, report from Citizen Lab.
citizenlab.ca/2025/08/hidd...
loading . . .
Hidden Links: Analyzing Secret Families of VPN Apps - The Citizen Lab
In this paper co-authored by the Citizen Lab's Jeffrey Knockel, researchers investigate the secret relationships between VPN operators and the vulnerabilities
https://citizenlab.ca/2025/08/hidden-links-analyzing-secret-families-of-vpn-apps/
about 2 months ago
0
0
0
Load more
feeds!
log in
