"So I think we’re living in the last fleeting moments where there’s any uncertainty that AI agents will supplant most human vulnerability research. Enjoy it, if that’s your thing, while you can. It’s not going to last." sockpuppet.org/blog/2026/03...

Apple's first-ever "background security improvement" fixes a vulnerability in its Safari browser running its latest software.

"The federal government may exclude ChatGPT and other AI chatbots from its upcoming online harms bill and instead rely on cabinet to regulate the technology at a later date. " thelogic.co/news/exclusi...

Let's Encrypt rolls out DNS-PERSIST-01, a new domain ACME-like validation challenge, that is “particularly suited for environments where traditional challenge methods are impractical, such as IoT deployments, multi-tenant platforms" letsencrypt.org/2026/02/18/d...

Une carte réalisée par Proton sur la dépendance des États européens aux technologies américaines 👉 proton.me/fr/busines...

⏰ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝗖𝗙𝗣 𝟮𝟬𝟮𝟲: 𝗗𝗲𝗿𝗻𝗶è𝗿𝗲 𝗰𝗵𝗮𝗻𝗰𝗲 𝗱'𝗲𝗻𝘃𝗼𝘆𝗲𝗿 𝘂𝗻𝗲 𝗽𝗿𝗼𝗽𝗼𝘀𝗶𝘁𝗶𝗼𝗻 • 𝗟𝗮𝘀𝘁 𝗖𝗵𝗮𝗻𝗰𝗲 𝘁𝗼 𝗦𝘂𝗯𝗺𝗶𝘁 𝗮 𝗣𝗿𝗼𝗽𝗼𝘀𝗮𝗹 (𝗖𝗼𝗻𝗳𝗲𝗿𝗲𝗻𝗰𝗲𝘀/𝗪𝗼𝗿𝗸𝘀𝗵𝗼𝗽𝘀/𝗩𝗶𝗹𝗹𝗮𝗴𝗲𝘀) 👉 Submit your proposal at nsec.io/cfp before February 2nd, 2026! #NorthSec #cybersecurity #infosec #cfp

If you are a resident of California, the state now has a portal where you can demand deletion of your personal data from 500+ registered data brokers with a single request form, for free. consumer.drop.privacy.ca.gov

Anyone who’s tried to capture FaceID and the scanning that happens on your iPhone, will resonate with this video Great to see Associated Press do this piece on capturing surveillance tech youtu.be/D1tyEUq2u-E?...

Voici un atlas du Bluesky francophone. Avec plus de 300 000 comptes répertoriés, et 2000+ volontaires visibles. Tout visible, avec zoom et recherche, ici : ago-carto.fr/main.html?gr... PS: Il y aura une maj en janvier. Si vous n'êtes pas dedans, postez une réponse sur ce post pour être volontaire.

Dura lex, sed lex. In the EU, a large platform can't: - pretend an account is authentic just because it paid for a verified badge - spread harmful content - prevent public data access for researchers

BlueSky carte de presse, on te demande d'écrire sur l'indignation dans le monde numérique 🇫🇷 rapport à une juridiction 🇨🇦 ordonnant à un acteur 🇫🇷, ici #OVH, de filer des infos ? Avant de pomper le papier bien putaclic heise.de/en/news/Cana..., éléments de réponse 🧵

New report by 🇫🇷France's National Cyber Security Agency (@anssi-fr.bsky.social) on the threat landscape for mobile phones since 2015. 👇 www.cert.ssi.gouv.fr/uploads/CERT...

Flare "found that 41.47% of people in a study [on infostealers] were infected through a gaming-related file (such as fake Roblox, etc)" flare.io/learn/resour...

Keys are hard. www.nytimes.com/2025/11/21/w...

The recent Louvre breach illustrated the critical need for strong security in the world’s cultural institutions. To support cultural institutions around the world, we’re offering them 2 yrs of Proton Pass Professional for free 👇 https://proton.me/blog/free-password-manager-cultural-institutions

While AI companies are allowed to slurp everything they want, Quad9 warns that legal fees are drowning DNS resolvers, which are now being targeted by copyright owners to enforce blocks on piracy sites quad9.net/news/blog/wh...

Je ne sais pas quoi faire de cette infographie donc la voici

My analysis of the leaked #GDPR overhaul proposal. Some changes are great. Some risk decreasing privacy protections. The changes are very far‑reaching. Tread carefully! Also, some of the proposed amendments may in fact be ... not so legit. techletters.substack.com/p/techletter...

I have been doing trainings to journalists on digital investigations with @gijn.org since 2023, and they just published a article on several investigations that used skills journalists learned in these sessions gijn.org/stories/inve...

#VIGINUM et Advens lancent Cyber for Good Media, un programme dédié aux journalistes pour renforcer leurs compétences en cybersécurité et en lutte contre la menace informationnelle. 🗞️ Intéressé ? Les inscriptions sont ouvertes jusqu'au 5 décembre (15 places disponibles) ➡️ cyberforgood.org/fr/media/

Scoop: We obtained vast amounts of European mobile phone location data from data brokers. It was allegedly collected for advertising purposes only, but can be used to spy on high-ranking EU officials & NATO staff in Brussels. The Commission is 'concerned' & issued new security guidance to its staff.

Für den neusten Teil der #DatabrokerFiles haben @roofjoke.netzpolitik.org & ich 278 Millionen Handy-Standortdaten aus Belgien ausgewertet – erhoben nur für Werbezwecke 🤡 Wieder fanden wir Bewegungsprofile bis zur Privatadresse, u.a. von EU-Spitzenpersonal. 1/x netzpolitik.org/2025/databro...

🛡️ ENISA Threat Landscape 2025 is out Based on nearly 4,900 incidents across Europe, #ENISA maps a fast-evolving #cyberenvironment: ▶️ #ransomware decentralisation ▶️ #AI-driven #phishing ▶️ state-aligned espionage ▶️ industrialised #cybercrime. Full report: www.enisa.europa.eu/publications...

Along with numerous orgs and individuals, I have signed on to an Open Letter to the 🇨🇦 Minister of AI raising serious concerns about the government's approach to AI strategy. Details are here 👇 bccla.org/policy-submi...

"OpenAI has announced the launch of an "agentic security researcher" that's powered by its GPT-5 large language model (LLM) and is programmed to emulate a human expert capable of scanning, understanding, and patching code." thehackernews.com/2025/10/open...

Everyone is talking about AI. It's obviously having a transformative impact across all sectors of society. So how should the Canadian government approach it? My interview with Yvonne Lau for the @financialpost.com financialpost.com/technology/c...

"A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them." arstechnica.com/security/202...

In case you haven't had enough cyber for one day... I'm re-upping my deep-dive blog on why ad-blockers are critical for your online security and privacy, and what threats they can help defend against. Plus, I run through some of the best ad blockers out there, for your browser and beyond.

Nvidia dit maintenant vouloir construire des centres de données pour l'IA dans l'espace, avec des panneaux solaires de 4km par 4km. J'espère que les médias ne couvriront pas ceci avec crédulité, c'est absolument une farce. Ce n'est pas sérieux!

Google Cloud Platform was vulnerable to a HTTP desync attack leading to "responses being misrouted between recipients for certain third-party models". Aka your LLM response goes to someone else. The Expect header strikes again! Context: http1mustdie.com cloud.google.com/support/bull...

🧵 Signal introduit une avancée majeure pour son protocole de chiffrement : le Sparse Post Quantum Ratchet (SPQR), Ce mécanisme renforce le Signal Protocol face aux futures attaques quantiques, tout en conservant ses garanties existantes de secret antérieur (FS) et sécurité post-compromission (PCS).

NOW: US court permanently bans Pegasus spyware maker from hacking WhatsApp. NSO Group can't help their customers hack WhatsApp etc. ether. Must delete exploits & R&D. Bad news for NSO. Huge competitive disadvantage for the notorious company. Big additional win for WhatsApp 1 /

@reconmtl.bsky.social has uploaded the majority of the 2025 talks, including my talk on LSA. You can check it out at the below link if you'd like. Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back! youtu.be/G2CfMWXLU1U?...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities" Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS). Full preprint paper: download.vusec.net/papers/rain_...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities" Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS). Full preprint paper: download.vusec.net/papers/rain_...

NEW: turns out the EU helped finance a bunch of spyware companies with..public money. Extremely bad look. Group of MEPs calls for action.👇 apache.be/2025/10/01/e...

I have often stated that well-implemented memory tagging will be a game changer for memory corruptions. And it seems that with the next iPhone it's finally here: security.apple.com/blog/memory-...

BREAK: Dutch chips company ASML buys an 11 percent stake in French AI company Mistral - in the biggest tech sovereignty deal in a while. www.asml.com/en/news/pres...

📸 𝗟𝗲𝘀 𝗽𝗵𝗼𝘁𝗼𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗲𝗹𝗹𝗲𝘀 𝗱𝗲 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝘀𝗼𝗻𝘁 𝗱𝗶𝘀𝗽𝗼𝗻𝗶𝗯𝗹𝗲𝘀! • 𝗢𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝗣𝗵𝗼𝘁𝗼𝘀 𝗔𝗿𝗲 𝗢𝘂𝘁! Revivez les meilleurs moments de NorthSec avec notre album photo officiel! ⚓️ photos.app.goo.gl/bMCHe366jdP1...

Denmark invests 80M DKK in digital sovereignty. Minister of Digital Affairs @carolinestage.bsky.social will lead initiatives to reduce dependency of big tech. Money will be spent on developing and testing alternatives. www.digmin.dk/digitaliseri...

More testing of LLMs for journalism, this time on identifying image location, date, and source. By @aisvarya17.bsky.social and @klaudia.bsky.social with some of my own commentary. www.cjr.org/tow_center/w... @columjournreview.bsky.social

The US House of Judiciary Committee has invited former EU Commissioner, Thierry Breton, to testify at a hearing next week that's set to attack the European digital rulebook as a threat to US free speech and innovation www.euractiv.com/section/tech...

Email addresses are very simple, and you will score highly in this quiz. e-mail.wtf

🔧 Nous publions notre outil CLI interne pour gérer nos défis CTF as-code. Si vous organisez un CTF, jetez-y un coup d'oeil! We're open-sourcing our internal CLI tool to manage CTF challenges as-code. If you're a CTF organizer, check it out! 
github.com/nsec/ctf-scr...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF). techcrunch.com/2025/07/30/g...

Let's Encrypt discontinued yesterday the service that supported the criticized Online Certificate Status Protocol (OCSP). From now on, only Certificate Revocation Lists (CRLs) will be used. letsencrypt.org/2025/08/06/o...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF). techcrunch.com/2025/07/30/g...

📚 A good book to add to your summer reading list: "From Day Zero to Zero Day" by Eugene Lim. Released last month, it dives into vulnerability research! (1/5) 🧵 nostarch.com/zero-day #vulnerability #research

🏴‍☠️ French police 🇫🇷, Ukrainian authorities 🇺🇦 & Europol 🇪🇺 arrested this week in Kyiv the admin of XSS[.]is, the oldest Russian-speaking cybercrime forums with 50,000+ users.(1/7) 🧵 techcrunch.com/2025/07/23/e...