This BBC reporter was offered 25% of a ransom payout if he gave hackers access to the corporate network. He played along so we got a look inside their tactic here:

I think the separation of dev and prod is one of the most important things we need to solve in AI coding land. Keys. Secrets. Deployment. All that jazz. None of the tools help, if anything they make it super easy to do wrong.

Panel on bootstrapping vs. VC money. @haroonmeer.canary.love : “With bootstrapping you need to be careful to not be timid when it’s time to be bold” Just great life advice in general. Will remember this quote forever. Oh and @hdm.io and @andrewmorr.is are cool too.

This is a fun vuln youtu.be/jsygONOr_f4

That viral women's only dating app 'Tea' was hacked by some 4chan users. They didn't phish, social engineer, or use some crazy hacker technique either - the database was just public

Hey so… don’t do this.

Someone can buy this extension that is tied to tons of peole's salesforce account and just ...get access to all that info. (h/t @johntuckner.me)

If I was a bad guy who was looking for memory vulns, I'd be ALL OVER these new hotness web browsers. (Comet, Arc, etc.) Market share is small but much more valuable targets. - Teams behind them way smaller than ...Google

Wild trend this week of legitimate apps and extensions turning into malware. youtu.be/o9XBXeX0_5E

I just can't believe how successful ClickFix campaigns are right now. And now FileFix on top of it...

Which Windows drivers keep Microsoft’s security engineers busiest - and which ones do attackers actually exploit? Artem Baranov did the dang math. He scraped every CVE bulletin from Jan 2022 through May 2025 and built a clean data set of kernel-mode driver patches.

🚨 New macOS backdoor alert: North-Korean hackers are disguising a Zoom update that drops malware built to hijack laptops and steal data & passwords. If you or your devs run macOS, keep scrolling.👇

Microsoft just put out a detailed threat intel report on North Korean threat actors who keep getting hired for remote jobs at US companies. They also outline how they're using AI to level up. Here's some highlights:

Been reading more and more about governments hacking their own citizens with spyware. They seem to be finding any excuse - journalists. politically active people. social media posts. Whatever they want. Then they do it with zero click 0days silently. Wild. youtu.be/zqY2A112bAQ

If Austin, Texas got a pro sports team I fear I’d make it my entire personality.

I dove deeper into that AI Agent becoming #1 on the HackerOne leaderboard. youtu.be/lC2Ornloj24

Are AI hacking agents happening?

I’ve spent at least 2 nights in each time zone in the lower 48 in the last two weeks. Safe to assume my routine is absolutely f’d. I keep saying I’ll figure it out after I dig out of my massive backlog…

Sunday scaries big time when I’m leaving this to go back to reality.

Breaking: House Oversight's top Dem Rep. Lynch requests Microsoft provide info on DOGE staffer's GitHub repo. It allegedly contains code to extract data from the NLRB's case management system.

Be safe today everybody.

UNFI (major distributor for Whole Foods + 30k grocery stores) hit with cyber incident. Critical systems offline since June 5. Significant supply chain disruptions ongoing. Heres what we know. 🧵

Congrats on the time off everybody. Go touch some grass while the Internet reboots.

Easy security win most startups don't do: A) SSO with mandatory MFA (yubikey preferred) B) Device health check on login. Don't let unpatched OS or browser even login. Do this and you're in the 1%

Useless security advice you need to stop giving: "Don't click suspicious links!" Links are made to be clicked. Clicking links should be safe. If clicking a link gets your company hacked, it's a security stack issue, not a "train users to not click links" issue.

U.S. labs keep finding *undocumented* cellular radios hidden inside some Chinese-made solar inverters & battery packs Those radios give the gear a second, undocumented path to the internet. Global governments are reacting already: 🧵

You know, I'm starting to think all of you are just haters. What a sweet lil guy checking in on me like this.

I just had such a bad idea. And then started to have anxiety about all the shit wrong with it. Like chill brain, we didn’t even do it.

Nothing quite hits like a sad boy who can't sing On repeat lately: open.spotify.com/tra...

I'm stoked to be at Sleuthcon - all the talks are completely focused on cybercrime. No vulns, exploits, marketing fluff. Just 1 track floor to ceiling with people who spend their days chasing the baddies.

I'm safe. I only ever run: 'npm totally-not-malware'

Definitely important for security teams to watch OpenAI feature announcements: "ChatGPT now ingests Google Workspace, Microsoft 365, Dropbox, Box, SharePoint and OneDrive data" www.exponentialview....

I'm traveling a bunch this month - hit me with your best book or podcast recommendations you've loved recently.

nothing like spending happy hour explaining to your friend that no, “zero-trust” is not a personality trait.

Did ChatGPT just find its first 0day? I dug into some research that came out about the latest o3 model finding a novel use after a free bug, remotely exploitable in Linux. youtu.be/E4DHu4LQv0U

I just want my iPod scroll wheel back.

Tim Cook personally called TX Gov Abbott urging changes/veto to new online child safety bill. Bill would require Apple to implement age verification for all device owners.

I'm not big on predictions but I thought of a few things I think are highly probably while out for a drive this morning: - OpenAI obviously has Google and Apple in it's crosshairs, Jony Ive just adds fuel to that. Search + consumer devices.

The end of this video explains why I’m feeling nostalgic today

Microsoft Seizes 2,300 Lumma Stealer Domains in Global Takedown.

I know my addictive personality, and for that reason I'll never download Balatro.

Just a boy in a daily battle with his Apple Watch battery.

@swiftonsecurity.com 👀

Sinners is one of the best movies I’ve ever seen.

🚨 Breaking: Coinbase reveals insider threat incident where overseas support agents were bribed to exfiltrate customer data. Company refusing $20M extortion demand, instead offering same amount as bounty for threat actor identification.

I dug into a few threat intel reports about ClickFix malware campaigns that are booming in popularity. A number of DFIR folks I talked to in the last few weeks told me they've been running ClickFix incidents right now.

Every time I post 0days on IG I get DMs like this. I’ve become the harbinger of bad news.

This recap from @jhaddix.bsky.social and @danielmiessler.bsky.social about RSA is solid. Also just love listening to practitioners talk, especially about AI. Real from the front lines reaction to this stuff. www.youtube.com/watch?v=XbMY...

I'm absolutely drowning without a light at the end of the tunnel which is an awful combination.

Dug deeper into this story and even looked through the source code briefly. youtu.be/KZS7uOG21Ig