Basecamp #InfoSec & #DataPrivacy Briefing for Monday, June 22nd: ✈️ Which airline's API may be leaking info? 📰 Which news organization is being impersonated? ⚛️ Which #cybersecurity tool came from Oak Ridge? Learn the answers to these questions and more! sherpaintelligence.substack.com/p/basecamp-b...

152 Chrome wallpaper extensions were quietly clicking ads and tracking you. The audacity of hiding a business model inside something meant to make your desktop prettier. https://hackread.com/chrome-live-wallpaper-extensions-ad-track-fake-search-clicks/

Norway banned AI from primary schools. The rest of us are still trying to figure out if it's actually harmful. That's the difference between waiting for proof and acting on pattern recogn... https://www.heise.de/news/Zurueck-zu-Buch-und-Stift-Norwegen-verbannt-KI-aus-Grundschulen-11339393.html

GhostWriter's now fishing in Gmail's personal account pond. When they miss their mark, unrelated people with similar names get the phishing email instead. It's espionage with a typo problem. https://therecord.media/ghostwriter-targets-personal-gmail-accounts-in-poland

Your SOC analysts are drowning in alerts that mean absolutely nothing without context. The problem isn't volume. It's relevance. And it's burning them out faster than the business can replace them. https://www.securityweek.com/alert-fatigue-is-becoming-a-security-threat-of-its-own/

Deezer's found a way to spot AI music in your playlists. Everyone else just shrugged and added a tag. https://techcrunch.com/2026/06/11/deezers-new-tool-can-identify-ai-music-from-spotify-apple-music-and-others/

Fortinet's story doesn't match the logs. 75k firewalls were systematically looted over a month—configs exported, passwords cracked on rented GPUs, credentials now for sale. If your Fortigate shows... https://doublepulsar.com/an-update-on-fortibleed-whats-happening-with-victim-orgs-c0671a50e7f4

But remember, birth rates are down because of iPhones.

Software developers want speed. TeamPCP wants access. Guess who's winning when you skip the security checks between committing code and deploying it to a thousand systems. https://cyberscoop.com/teampcp-breaks-open-source-software-trust-model/

They've just repackaged the MLM playbook for Gen-Z. Same desperation, same false promise, same people getting hurt. The product changed from tupperware to AI. The suckers didn't. https://www.whatwelo.st/p/generative-ai-is-having-its-herbalife

Vulnerability scanners promised to find everything. They found everything. Now CISOs are quietly moving money elsewhere because finding vulnerabilities you can't actually e... https://cybersec.picussecurity.com/s/ai-broke-vulnerability-management-that-s-why-cisos-are-moving-budget-to-bas-28083

An Amazonian spider now disguises itself as a parasitic fungus. Researchers initially mistook it for a mushroom. Nature's essentially running the same con we do, just better. https://www.sciencedaily.com/releases/2026/06/260617032201.htm

Someone retired and decided to make one piece of software genuinely excellent instead of chasing venture capital. NetNewsWire still works better than anything funded by thirty rounds. That's the move. https://simonwillison.net/2026/Jun/17/netnewswire-status/

Twenty-seven years, one line of code, zero credentials needed. A PPP authentication bypass lived in OpenBSD since 1999 because someone forgot to check if the password length was actually greater than zero. The CHAP hand... https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html

Government decided Claude's guardrails are breakable. Anthropic says they're not. Amazon rang the bell. Everyone's now in a room arguing about whether a problem exists. Meanwhile, the model's of... https://www.wired.com/story/anthropic-is-still-at-odds-with-the-white-house-over-claude-fable-5/

Thousands of whales died in one spot millions of years ago. Their bodies became an entire economy. Ten million carcasses feeding creatures we've never seen. The ocean floor works like a perfectly efficient supply chai... https://www.cbsnews.com/news/whale-graveyard-discovered-sub-bottom-ocean/

Russia's using Africa as a staging ground: disinformation campaigns, manipulated migration routes, destabilised governments. Same networks then exploit the resulting chaos as a we... https://euperspectives.eu/2026/06/from-the-sahara-to-the-ballot-box-how-russian-networks-reach-european-voters/

A CEO stored all 2,000 employee passwords in a desktop Excel file so he could delete their emails himself. When told MFA would block him, he refused it for four months. The com... https://www.theregister.com/security/2026/06/11/every-employees-password-was-stored-in-a-single-excel-file/5253784

Amongst other things, it was easier to cut down on disposable income luxuries - buy a few less books and CDs and games in a tough month - than it is to economise short term when everything is a subscription. Which supply do you not mind having cut off totally? That’s different.

Japan - your AI agents need identity controls as strict as your humans. The hybrid workforce has no perimeter. https://blog.knowbe4.com/the-new-frontier-securing-japans-hybrid-digital-workforce-2026-beyond

After decimating white abalone populations for decades, we found one in the wild. Now hope they can breed before poachers find them again. https://www.sfgate.com/bayarea/article/white-abalone-22293372.php

A man spent a month in jail five miles away from a crime scene, according to Flock data police had but chose not to read. The system worked exactly as designed. https://arstechnica.com/tech-policy/2026/06/man-jailed-for-a-month-despite-flock-showing-he-was-5-miles-from-crime-scene/

Chrome silently downloads 4GB of AI weights to your machine with no consent prompt, won't let you delete it permanently, and the visible "AI Mode" button doesn't even use it... https://www.journaldugeek.com/2026/06/08/mais-pourquoi-google-chrome-installe-4-go-de-fichiers-impossible-a-supprimer

Meta got caught embedding facial recognition into millions of phones, deleted it in 48 hours, then refused to say if they'd bring it back. This is why we need laws with te... https://www.eff.org/deeplinks/2026/06/victory-meta-strips-facial-recognition-code-smart-glasses-app-after-public-outcry

They hacked a security scanner. Stole npm credentials. Turned 60+ packages into a self-spreading worm in 24 hours. And left taunting comments for the researcher watching them do it https://cybersec.picussecurity.com/s/canisterworm-how-teampcp-turned-the-npm-ecosystem-into-a-weapon-27892

Your DSPM vendor's architecture is a security decision. Where keys live, how credentials are handled, whether data leaves your environment – these aren't footnotes. They're... https://api.cyfluencer.com/s/byok-least-privilege-and-why-your-dspm-vendor-s-architecture-is-a-security-decision-27891

Everyone wants SPIFFE until they realize it's a three-year infrastructure project masquerading as a standard. The idea is elegant. The reality is considerably less so. https://go.aembit.io/s/everyone-wants-spiffe-almost-no-one-can-afford-to-build-it-right-27890

Two years of technical debt made manifest. Toshiba, Muji, and Samsung all got bitten by polyfill io code. The domain expired, someone else bought it, and suddenly legitimate web... https://www.bleepingcomputer.com/news/security/suspicious-polyfill-login-prompts-pop-up-on-toshiba-muji-websites/

Someone leaked the personal details of Spanish police, prosecutors, and cyber officials across multiple platforms. Arrested in Granada last week. The irony of doxxing the people tasked... https://therecord.media/spain-arrests-suspected-hacker-for-publishing-data-on-sensitive-government-workers

The only way to fix vulnerabilities at AI scale is to use AI. Funny how the tool that finds ten thousand bugs also sells you the tool to fix them. The poor just get poorer. https://www.defendersinitiative.com/p/the-unintended-consequences-of-vulnmaxxing

Secretive Chinese network tries to lure fired federal workers, research shows. https://www.reuters.com/world/china/secretive-chinese-network-tries-lure-fired-federal-workers-research-shows-2025-03-25/

Even ransomware gangs have an employee handbook. Nova just had to fire someone for breaking rule one: don't infect Russia or the CIS. The apology was free. The gulag would no... https://www.theregister.com/cyber-crime/2026/06/02/dumbass-criminal-breaks-the-first-rule-of-ransomware-club/5250380

The European Parliament just swapped Google for Qwant. A genuine privacy-first search engine is lovely. Whether it survives contact with actual institutional governance is another matter entirely. https://www.politico.eu/article/european-parliament-ditches-google-for-french-search-engine/

One click on a GitHub link and an attacker gets a token with full read-write access to all your repos, including private ones. The browser version of VSCode has a webview bug that makes token theft trivial. https://blog.ammaraskar.com/github-token-stealing/#why-full-disclosure

The harness is the agent's hands, and you've probably never secured them. Meanwhile your model is getting all the attention. https://cybersec.pillar.security/s/your-agent-harness-has-more-privilege-than-your-agent-27726

Anthropic ships Workload Identity Federation for Claude. It's solid work. https://go.aembit.io/s/anthropic-workload-identity-federation-what-it-gets-right-and-what-it-still-doesn-t-solve-27725

They stuck a Raspberry Pi inside a bank's network switch. Not to steal data. To replay PIN verifications and drain ATMs. The perimeter was never the problem. https://cybersec.picussecurity.com/s/unc2891-bank-heist-explained-caketap-rootkit-and-raspberry-pi-attack-27676

The FBI visited a journalist's home about his reporting, then refused to say why. He's suing to find out. Turns out transparency works both ways. https://www.rcfp.org/litigation/whittaker-v-doj/

A developer built a hidden trap to delete code touched by AI. Now he's getting threats. The real problem isn't his position on AI—it's that he tried to wage war through someone else's code... https://gizmodo.com/dev-says-hes-getting-threats-after-leaving-a-booby-trap-for-vibe-coders-2000765231

Someone got humiliated by Microsoft and now promises to shatter their bones on July 14th. The vendor's response was to call the cops. This is what happ... https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085

Finding vulns used to pay. HackerOne just cut critical bug bounties by 75%. The economics of vulnerability reporting are changing faster than anyone expected. https://www.theregister.com/security/2026/05/21/hackerone-takes-an-axe-to-its-bug-bounty-rewards/5244458

Everyone thought they knew what grew in New Jersey's Pine Barrens. Turns out they'd been misidentifying a flower for decades. Naming it properly might actually save it. https://www.goodnewsnetwork.org/scientist-discovers-new-species-of-wildflower-that-only-grows-in-nj/

Iraq arrested 201 cybercriminals across a five-month operation. Impressive scale. Now watch how many of them were actually running the infrastructure versus how many were just holding the phone. https://shafaq.com/en/Security/Iraq-arrests-200-suspects-in-largest-regional-cyber-crackdown

Two hosting providers in the Netherlands arrested for running sanctioned infrastructure. They just renamed the company after the EU caught them. Sanctions theatre, basically. https://nltimes.nl/2026/05/22/two-arrested-facilitating-pro-russia-cyberattacks-violating-eu-sanctions

Type "disregard" into the new Google AI search and you'll start considering Bing to be a useful search engine by comparison. https://techcrunch.com/2026/05/22/you-can-no-longer-google-the-word-disregard/

AI promises to automate your incident reports. What you get instead is a polished hallucination that changes every time you run it. Same prompt, different conclusions, different sources, dif... https://blogs.cisco.com/security/ai-generated-reporting-lessons-learned-from-talos-incident-response

AI's making vulnerability finding easier. That just means your triage queue is now a landfill where humans spend tokens dismissing speculation instead of fixing real bugs. https://cyberscoop.com/ai-vulnerability-reporting-bug-bounty-noise/

When your learning management system becomes the nervous system of 9,000 schools, a support ticket vulnerability stops being a support ticket vulnerability. It becomes instit... https://go.aembit.io/s/the-canvas-breach-shows-what-happens-when-saas-platforms-become-identity-infrastructure-27483

Automated pentest tools are just real attackers on fast-forward. They start inside, map everything, steal credentials, hop machines, and hunt for domain admin. When they hit a wall, they don'... https://cybersec.picussecurity.com/s/what-are-the-key-stages-of-automated-penetration-testing-27484

Your experts aren't spell-checking AI output. They're drowning in it. Leadership rewards velocity. The gears clog. No one notices until they do. https://justingarrison.com/blog/2026-05-19-your-slop-my-sludge/