I can now die a satisfied man. I've been quoted in the NYTimes before, but never in The Register (my absolute favorite IT tabloid). Today I was quoted in The Reg. Thank you @jessicalyons.bsky.social for letting me contribute to your article - www.theregister.com/2026/01/08/c...

BREAKING: ESA confirmed yet another massive security breach, and told me via @theregister.com that the data thieves responsible will be subject to a criminal investigation.

This story illustrates the importance of transparency and clear communication when it comes to bug bounties. If we want ethical hackers to report vulns so they can be fixed before the criminals find and exploit them, bug bounties need to keep their end of the bargain.

A cybercrook claims to have breached Pickett and Associates, a Florida-based engineering firm whose clients include major US utilities, and is selling what they claim to be about 139 GB of engineering data about Tampa Electric Company, Duke Energy Florida, and American Electric Power.

I sat down (virtually) with Remedio CEO Tal Kollender to discuss her former life hacking video games and how that led her to start a security company that uses AI to defend against AI.

"In my past life, it would take us 360 days to develop an amazing zero day," Zafran Security CEO Sanaz Yashar told me via @theregister.com. I had a great conversation with the former "hacking architect" whose startup uses AI to map and manage companies' threat exposure - you can read it all here:

"I view this as a canary in the coal mine," Tea co-founder Tim Lewis told me via @theregister.com

Shiny Hunters claims to be behind the breach, while Mixpanel tells us a Pornhub parent company employee - not the analytics provider - last accessed the stolen data: "If this data is in the hands of an unauthorized party, we do not believe that is the result of a security incident at Mixpanel."

At least five more Chinese spy crews, Iran-linked goons, and financially motivated criminals are now attacking React2Shell, according to Google's threat intel team.

If you're running React Server Components, you just can't catch a break. In addition to already-reported flaws, newly discovered bugs allow attackers to hang vulnerable servers and potentially leak Server Function source code, so anyone using RSC or frameworks that support it should patch quickly.

Attackers are actively exploiting a zero-day bug in Gogs, a popular self-hosted Git service, and the open source project doesn't yet have a fix.

A Ukrainian woman accused of hacking US public drinking water systems and a meat processing facility on behalf of Kremlin-backed cyber groups was extradited to the US earlier this year and will stand trial in early 2026.

Imagine botnets in physical form and you've got a pretty good idea of what could go wrong with the influx of AI-infused humanoid robots expected to integrate into society over the next few decades. I spoke with Insikt Group risk guru Joseph Rooke about this (slightly horrifying) future.

"We believe dozens of organizations in the US have been impacted by Brickstorm, not including downstream victims," Google Threat Intelligence Group principal analyst Austin Larsen told me via @theregister.com

Vetting staff who handle sensitive government systems is wise, and so is cutting off their access the moment they're fired. A federal contractor learned this the hard way when twins previously convicted of hacking-related offenses allegedly used lingering access to delete 96 government databases.

Afraid of connecting to public Wi-Fi? Terrified to turn your Bluetooth on? You may be falling for "hacklore." Dozens of CISOs and ex-CISA officials have launched an effort to dispel these myths and show you how not to get hacked for real.

A series of "trivial-to-exploit" vulnerabilities in Fluent Bit, an open source log collection tool that runs in every major cloud and AI lab, was left open for years, giving attackers an exploit chain to completely disrupt cloud services and alter data.

EXCLUSIVE: ShinyHunters claimed responsibility for the Gainsight breach that allowed the data thieves to snarf data from hundreds more Salesforce customers: "We've had access to Gainsight for nearly 3 months."

“This activity is likely related to UNC6240 (aka ShinyHunters),” Google Threat Intelligence Group’s principal analyst Austin Larsen told me via @theregister.com, adding that the threat hunters are “aware of more than 200 potentially affected Salesforce instances.”

There's a "new operational model that's neither traditional cyber attack nor conventional warfare," @Amazon Chief Security Officer Steve Schmidt told me via @theregister.com. "The targeting data collected through cyber means flows directly into kinetic decision making."

"The attackers have reached every Ray server we manually inspected, and their activity has been ongoing for weeks," Oligo researcher Avi Lumelsky told me via @theregister.com

"For four months, I had concrete evidence that attackers possessed detailed Coinbase customer data," security researcher Jonathan Clark said.

Yet another supply chain attack has hit the npm registry in what @awscloud.bsky.social describes as "one of the largest package flooding incidents in open source registry history." But instead of injecting credential-stealing code or ransomware, this one is a token farming campaign.

Instead of paying a ransom demand after getting hit by extortionists last week, payment services provider Checkout.com donated the demanded amount to fund cybercrime research.

Digital rights activist Esra'a Al Shafei found FinFisher spyware on her device more than a decade ago. Now she's made it her mission to surveil the companies providing surveillanceware, their customers, and their funders.

too much time on their hands during the shutdown?

A ransomware negotiator and an incident response manager at two separate cybersecurity firms have been indicted for allegedly carrying out ransomware attacks of their own against multiple US companies.

Hacking makes the holidays so much more enjoyable, and nothing says trick or treat quite like pwning LED Halloween masks belonging to every neighborhood kid during candy-collection hours.

EXCLUSIVE: A critical, currently unpatched bug in Chromium's Blink rendering engine can be abused to crash many Chromium-based browsers within seconds, causing a denial-of-service condition – and, in some tests, freezing the host system.

A new Android malware strain, Herodotus, steals credentials, logs keystrokes, streams victims' screens, and hijacks input - but with a twist: it mimics human typing by adding random delays between keystrokes to evade behavioral fraud detection systems.

Researcher Adam Logue discovered the data-stealing exploit, which abuses M365 Copilot's built-in support for Mermaid diagrams and tricks the AI assistant into stealing sensitive tenant data – like emails – via indirect prompt injection. www.theregister.com/2025/10/24/m...

ATTN: Reporters looking for work who are willing to bite the hand that feeds IT - come work with me at The Reg!

"They didn't wake up and decide to become hackers," Joe Sullivan told me. "A lot of it is that they are coming out of the gaming culture, and it doesn't celebrate winning by the rules. It celebrates winning, period."

China accused the American spy agency of deploying a "cyber warfare platform" and activating "42 specialized cyberattack weapons to launch a high-intensity cyberattack against multiple internal NTSC network systems" between August 2023 and June 2024.

Dark day indeed. Democracy requires a free press.

An unidentified nation-state hacking crew targeting vulnerable F5 products to break into US government networks poses an "imminent risk" to federal agencies, American cyber officials warned on Wednesday – while also blaming Democrats for the ongoing government shutdownl.

Security shop F5 today said "highly sophisticated nation-state" hackers broke into its network and stole BIG-IP source code, undisclosed vulnerability details, and customer configuration data belonging to a "small percentage" of its users.

EXCLUSIVE: I spoke with @spycloudlabs.bsky.social researcher Aurora Johnson and @urlscan-bot.bsky.social researcher Jake Sloane about DIY phishing kit YYlaiyu that impersonates 97 different brands across 2,158 domains: " They're hitting globally, so almost no one is safe."

London cops on Tuesday arrested two teenagers on suspicion of computer misuse and blackmail following a ransomware attack on a chain of London preschools.

Despite multiple arrests and talk of retirement, a crew now calling itself Scattered LAPSUS$ Hunters has reemerged with a data-leak site listing about 40 companies’ Salesforce environments, and is demanding $989.45 to prevent what it claims is about 1B stolen records.

Cybersecurity training, beards, and body fat have something in common, according to the Pentagon. They're not helping the US military fight and win wars.

SCOOP: The US Air Force confirmed it's investigating a "privacy-related issue" amid reports of a Microsoft SharePoint-related breach and subsequent service-wide shutdown, rendering mission files and other critical tools potentially unavailable to service members.

"As more companies scan their systems, we anticipate we'll be hearing about this campaign for the next one to two years," @mandiant.com CTO Charles Carmakal told me via @theregister.com.

Las Vegas police arrested an unnamed teen accused of breaking into multiple Las Vegas casino networks in 2023, as part of a series of hacks attributed to Scattered Spider.

SolarWinds on Tuesday released a hotfix - again - for a critical, 9.8-severity flaw in its Web Help Desk IT ticketing software that could allow a remote, unauthenticated attacker to run commands on a host machine.

Perhaps the most incriminating: Somebody took cryptocurrency from a wallet on a server that also held ransom funds and bought gaming gift cards tied to an account in Jubair's name, as well as food-delivery gift cards, which were then used to order takeout to the apartment complex where he lived.

Spiders don't change their stripes. Despite gang members' recent retirement claims, Scattered Spider hasn't exited the cybercrime business and instead has shifted focus to the financial sector, with a recent digital intrusion at a US bank.

A new ransomware strain dubbed HybridPetya was able to exploit a patched vulnerability to bypass UEFI Secure Boot on Windows systems, making it the fourth publicly known bootkit capable of punching through the feature and hijacking a PC before the operating system loads.

"We have observed high-confidence account takeovers in multiple entities," as new phishing service makes it really easy for criminals to hijack Google and Microsoft accounts.

"Like Cobalt Strike, it can be used for legitimate purposes but it is also ready to be used maliciously without expertise needed since it is fully automated," Dan Regalado, principal AI security researcher at Straiker, told me via @theregister.com