Keys are hard. www.nytimes.com/2025/11/21/w...

The recent Louvre breach illustrated the critical need for strong security in the world’s cultural institutions. To support cultural institutions around the world, we’re offering them 2 yrs of Proton Pass Professional for free 👇 https://proton.me/blog/free-password-manager-cultural-institutions

While AI companies are allowed to slurp everything they want, Quad9 warns that legal fees are drowning DNS resolvers, which are now being targeted by copyright owners to enforce blocks on piracy sites quad9.net/news/blog/wh...

Je ne sais pas quoi faire de cette infographie donc la voici

My analysis of the leaked #GDPR overhaul proposal. Some changes are great. Some risk decreasing privacy protections. The changes are very far‑reaching. Tread carefully! Also, some of the proposed amendments may in fact be ... not so legit. techletters.substack.com/p/techletter...

I have been doing trainings to journalists on digital investigations with @gijn.org since 2023, and they just published a article on several investigations that used skills journalists learned in these sessions gijn.org/stories/inve...

#VIGINUM et Advens lancent Cyber for Good Media, un programme dédié aux journalistes pour renforcer leurs compétences en cybersécurité et en lutte contre la menace informationnelle. 🗞️ Intéressé ? Les inscriptions sont ouvertes jusqu'au 5 décembre (15 places disponibles) ➡️ cyberforgood.org/fr/media/

Scoop: We obtained vast amounts of European mobile phone location data from data brokers. It was allegedly collected for advertising purposes only, but can be used to spy on high-ranking EU officials & NATO staff in Brussels. The Commission is 'concerned' & issued new security guidance to its staff.

Für den neusten Teil der #DatabrokerFiles haben @roofjoke.netzpolitik.org & ich 278 Millionen Handy-Standortdaten aus Belgien ausgewertet – erhoben nur für Werbezwecke 🤡 Wieder fanden wir Bewegungsprofile bis zur Privatadresse, u.a. von EU-Spitzenpersonal. 1/x netzpolitik.org/2025/databro...

🛡️ ENISA Threat Landscape 2025 is out Based on nearly 4,900 incidents across Europe, #ENISA maps a fast-evolving #cyberenvironment: ▶️ #ransomware decentralisation ▶️ #AI-driven #phishing ▶️ state-aligned espionage ▶️ industrialised #cybercrime. Full report: www.enisa.europa.eu/publications...

Along with numerous orgs and individuals, I have signed on to an Open Letter to the 🇨🇦 Minister of AI raising serious concerns about the government's approach to AI strategy. Details are here 👇 bccla.org/policy-submi...

"OpenAI has announced the launch of an "agentic security researcher" that's powered by its GPT-5 large language model (LLM) and is programmed to emulate a human expert capable of scanning, understanding, and patching code." thehackernews.com/2025/10/open...

Everyone is talking about AI. It's obviously having a transformative impact across all sectors of society. So how should the Canadian government approach it? My interview with Yvonne Lau for the @financialpost.com financialpost.com/technology/c...

"A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them." arstechnica.com/security/202...

In case you haven't had enough cyber for one day... I'm re-upping my deep-dive blog on why ad-blockers are critical for your online security and privacy, and what threats they can help defend against. Plus, I run through some of the best ad blockers out there, for your browser and beyond.

Nvidia dit maintenant vouloir construire des centres de données pour l'IA dans l'espace, avec des panneaux solaires de 4km par 4km. J'espère que les médias ne couvriront pas ceci avec crédulité, c'est absolument une farce. Ce n'est pas sérieux!

Google Cloud Platform was vulnerable to a HTTP desync attack leading to "responses being misrouted between recipients for certain third-party models". Aka your LLM response goes to someone else. The Expect header strikes again! Context: http1mustdie.com cloud.google.com/support/bull...

🧵 Signal introduit une avancée majeure pour son protocole de chiffrement : le Sparse Post Quantum Ratchet (SPQR), Ce mécanisme renforce le Signal Protocol face aux futures attaques quantiques, tout en conservant ses garanties existantes de secret antérieur (FS) et sécurité post-compromission (PCS).

NOW: US court permanently bans Pegasus spyware maker from hacking WhatsApp. NSO Group can't help their customers hack WhatsApp etc. ether. Must delete exploits & R&D. Bad news for NSO. Huge competitive disadvantage for the notorious company. Big additional win for WhatsApp 1 /

@reconmtl.bsky.social has uploaded the majority of the 2025 talks, including my talk on LSA. You can check it out at the below link if you'd like. Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back! youtu.be/G2CfMWXLU1U?...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities" Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS). Full preprint paper: download.vusec.net/papers/rain_...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities" Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS). Full preprint paper: download.vusec.net/papers/rain_...

NEW: turns out the EU helped finance a bunch of spyware companies with..public money. Extremely bad look. Group of MEPs calls for action.👇 apache.be/2025/10/01/e...

I have often stated that well-implemented memory tagging will be a game changer for memory corruptions. And it seems that with the next iPhone it's finally here: security.apple.com/blog/memory-...

BREAK: Dutch chips company ASML buys an 11 percent stake in French AI company Mistral - in the biggest tech sovereignty deal in a while. www.asml.com/en/news/pres...

📸 𝗟𝗲𝘀 𝗽𝗵𝗼𝘁𝗼𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗲𝗹𝗹𝗲𝘀 𝗱𝗲 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝘀𝗼𝗻𝘁 𝗱𝗶𝘀𝗽𝗼𝗻𝗶𝗯𝗹𝗲𝘀! • 𝗢𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝗣𝗵𝗼𝘁𝗼𝘀 𝗔𝗿𝗲 𝗢𝘂𝘁! Revivez les meilleurs moments de NorthSec avec notre album photo officiel! ⚓️ photos.app.goo.gl/bMCHe366jdP1...

Denmark invests 80M DKK in digital sovereignty. Minister of Digital Affairs @carolinestage.bsky.social will lead initiatives to reduce dependency of big tech. Money will be spent on developing and testing alternatives. www.digmin.dk/digitaliseri...

More testing of LLMs for journalism, this time on identifying image location, date, and source. By @aisvarya17.bsky.social and @klaudia.bsky.social with some of my own commentary. www.cjr.org/tow_center/w... @columjournreview.bsky.social

The US House of Judiciary Committee has invited former EU Commissioner, Thierry Breton, to testify at a hearing next week that's set to attack the European digital rulebook as a threat to US free speech and innovation www.euractiv.com/section/tech...

Email addresses are very simple, and you will score highly in this quiz. e-mail.wtf

🔧 Nous publions notre outil CLI interne pour gérer nos défis CTF as-code. Si vous organisez un CTF, jetez-y un coup d'oeil! We're open-sourcing our internal CLI tool to manage CTF challenges as-code. If you're a CTF organizer, check it out! 
github.com/nsec/ctf-scr...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF). techcrunch.com/2025/07/30/g...

Let's Encrypt discontinued yesterday the service that supported the criticized Online Certificate Status Protocol (OCSP). From now on, only Certificate Revocation Lists (CRLs) will be used. letsencrypt.org/2025/08/06/o...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF). techcrunch.com/2025/07/30/g...

📚 A good book to add to your summer reading list: "From Day Zero to Zero Day" by Eugene Lim. Released last month, it dives into vulnerability research! (1/5) 🧵 nostarch.com/zero-day #vulnerability #research

🏴‍☠️ French police 🇫🇷, Ukrainian authorities 🇺🇦 & Europol 🇪🇺 arrested this week in Kyiv the admin of XSS[.]is, the oldest Russian-speaking cybercrime forums with 50,000+ users.(1/7) 🧵 techcrunch.com/2025/07/23/e...

🤖 New research paper from ETH Zurich and LogicStar AI quantifies what we've observed: flagship LLMs fail catastrophically at secure code generation. The BaxBench benchmarks evaluated 392 backend development tasks across multiple frameworks. baxbench.com (1/8) 🧵

🧵 This is concerning: new research shows AI agents can become insider threats when their objectives are blocked. They’re blackmailing executives, leaking sensitive data, and using sophisticated social engineering tactics against their own organizations! anthropic.com/research/agentic-misalignment

🏴‍☠️ French police 🇫🇷, Ukrainian authorities 🇺🇦 & Europol 🇪🇺 arrested this week in Kyiv the admin of XSS[.]is, the oldest Russian-speaking cybercrime forums with 50,000+ users.(1/7) 🧵 techcrunch.com/2025/07/23/e...

📊 This could be a game-changer for data analysts. I recently discovered Marimo, a Python notebook tool that fixes what's broken about Jupyter notebooks. github.com/marimo-team/... 🧵 (1/8)

🤖 New research paper from ETH Zurich and LogicStar AI quantifies what we've observed: flagship LLMs fail catastrophically at secure code generation. The BaxBench benchmarks evaluated 392 backend development tasks across multiple frameworks. baxbench.com (1/8) 🧵

📚 A good book to add to your summer reading list: "From Day Zero to Zero Day" by Eugene Lim. Released last month, it dives into vulnerability research! (1/5) 🧵 nostarch.com/zero-day #vulnerability #research

🔐 This could reshape privacy engineering. Google open-sourced their zero-knowledge proof (ZKPs) age verification libraries on Jul 3 called "Longfellow" letting you prove you're 18+ without revealing birthdate, name, or any PII. blog.google/technology/s... (1/8) 🧵

📊 This could be a game-changer for data analysts. I recently discovered Marimo, a Python notebook tool that fixes what's broken about Jupyter notebooks. github.com/marimo-team/... 🧵 (1/8)

🧵 This is concerning: new research shows AI agents can become insider threats when their objectives are blocked. They’re blackmailing executives, leaking sensitive data, and using sophisticated social engineering tactics against their own organizations! anthropic.com/research/agentic-misalignment

🧵 This could be a game-changer: EPFL & @ethz.ch are releasing a fully open LLM under Apache 2.0 license. Unlike commercial models developed behind closed doors, this will be completely transparent and freely available to everyone. ethz.ch/en/news-and-...

This talk's now up here: watch.protocol.berlin/65a90bf47932...

Missing the NorthSec community already? We made you a starter pack to help you quickly find us on Bluesky! Saw someone missing from this starter pack? Let us know! go.bsky.app/JZeo2ad

We got unprecedented access to the AI model that Amsterdam developed to try to fairly detect welfare fraud. The result is one of the first in-depth looks at a system using responsible AI guidelines—and what happens when those big promises meet messy reality.