We've just published the 2nd episode of our documentary series "How the World Got Owned". This one looks at the 1990s and features interviews with Kevin Poulsen, @weld.bsky.social, @thedarktangent.bsky.social and Alpeh One (Elias Levy). Subscribe to the stories feed now! risky.biz/HTWGO2-stori...

Phrack call for papers is out! Check out the cool demoscene graphics at phrack.org

I’m excited to let you know that the talks from [un]prompted—the AI Security Practitioner Conference—are now live on YouTube. No fluff, no hype—just real-world AI security from people actually doing the work. www.youtube.com/playlist?lis...

RCE vulnerability in the Yamaha PSR-E433 synthesizer, discovered by Anna Antonenko, allows exploitation through crafted MIDI files that trigger a hidden firmware backdoor with hardcoded password "#0000". it4sec.substack.com/p/remote-cod...

Doesn't everyone watch Akira on LaserDisc with their figurines?

Security debt is becoming a governance issue for CISOs 📖 Read more: www.helpnetsecurity.com/2026/03/02/c... #cybersecurity #cybersecuritynews #CISO #riskmanagement @weld.bsky.social

We wished we had more time to find the right words, and it is with deep regret that we have to tell you that our founder Felix “FX” Lindner passed away on 2026-03-01. blog.recurity-labs.com/2026-03-02/F...

RIP FX - You are a legend

Another NAFO legend has left us...💔 Jason Snitker @jasonsnitker (on Twitter) AKA Parmaster "Par" has passed away!🕯️ He was one of the first hackers, a legend in the hacking scene and a huge supporter of Ukraine and #NAFOfella. >> SIGNAL LOST: PARMASTER >> STATUS: GONE BUT NOT FORGOTTEN

🕯️There will be a online memorial for Par 🕯️ Jason Snitker "Parmaster" Memorial Service Feb 28, 2026 04:00 PM Confirmed Speakers: Par's Aunt Deb Wysopal Mudge John Lee Tom Sloan (former Secret Service) Registration Link: us02web.zoom.us/meeting/regi...

Jason Snitker Rebel. Legend. Friend. Rest in Peace, ParMaster

My wife @debdebdeb.bsky.social and I are heartbroken to share the sad news that our old friend @jasonsnitker.bsky.social AKA Parmaster, has passed away.

New $10k FULU bug bounty for Ring video doorbells just announced. bounties.fulu.org/bounties/rin...

This is a new one for me. I'm #8 and #31 on this top 100 list. Do you want Chris the the CTO of Veracode or Chris the security pioneer. 😂 www.futuristsspeakers.com/top-100-cybe...

Can we all forget about the email disclaimers now? The information contained in this communication is confidential, may be attorney-client privileged, may constitute inside information, and is intended only for the use of the addressee. It is the property of JEE

In order to collect a bug bounty, a researcher was required to sign an NDA to not discuss the vulnerability. zuernerd.github.io/blog/2026/01...

Vulnerability disclosure norms are a control system for incentives. They made vulnerability handling predictable enough to industrialize. We get more finding, more fixing, and more secure software.

This looks interesting. Teenage hackers. I was one. I didn’t do this type of thing though. www.amazon.com/dp/133500193X

ATM jackpotting is still very much alive in 2025. Two attackers physically opened ATMs, connected a laptop, installed malware, and forced the machines to dump all their cash. DOJ convictions, prison time, restitution, deportation.

This FDA announcement says over 700 people were harmed and 7 people died due to a bug in the Abbot FreeStyle Libre device. www.fda.gov/medical-devi...

Massachusetts lawmakers introduced bipartisan bills (HD 5563 / SD 3606) to curb abandoned consumer electronics by requiring vendors to disclose software support lifetimes, warn users before end-of-life, and explain lost features and security risks.

New from Anthropic. red.anthropic.com/2026/cyber-t...

Microsoft released NTLMv2 in 1998, no doubt because tools like L0phtCrack were able crack NTLMv1 passwords with the measly computing power then. NTLMv1 is still in use today! Mandiant has now released rainbow tables for NTLMv1 that can crack any pw in 12hrs on a $600 computer.

UK NCSC: pro-Russian hacktivists are still hammering critical infra & local gov w/DDoS attacks. Low-tech, high impact, disrupting services & costing serious recovery time/money. Shouldn't critical infra & local gov be able to mitigate these attacks? What do they use? Cloudflare? Akamai? ISPs?

Tell your older relatives to turn personalized ads off everywhere. Scammers target this demographic.

“Prompt injection” is the wrong mental model. LLM attacks increasingly look like malware campaigns, not single exploits. This paper frames them as promptware and maps a 5-stage kill chain: initial access → priv esc → persistence → lateral movement → actions on objective. arxiv.org/html/2601.09...

BIG NEWS! Rachael Morrison’s JOYBUBBLES will have its #WORLDPREMIERE at the 2026 #SundanceFilmFestival (@sundance.org) on JAN 26 at 6 PM! Executive produced by @cameowood.com & Charming Stranger Films, the film will screen in person JAN 26—JAN 31 & online screenings begin JAN 29: loom.ly/xnAbh1w

"A draft amendment to the BND Act, circulating by German media, would transform the agency’s reach by authorizing it to break into foreign digital systems, collect and store large portions of internet traffic, and analyze those communications retroactively." reclaimthenet.org/germany-bnd-...

iPhones now have "delete and report spam" for unknown messages and callers. If everyone was to choose "delete and report spam" for every spam message and call would they stop? If not, what is the point?

Before the word hacker meant anything at all there was a blind kid who whistled 2600 Hz and bent Ma Bell to his will. Joybubbles tells the story of Joe Engressi, the original phone phreak and a reminder that hacking started as curiosity, play, and defiance. festival.sundance.org/program/film...

CES Worst in Show is a reminder that “innovation” now means: more attack surface, less ownership, permanent surveillance, and DRM on objects you physically bought. Congratulations to the ad-powered fridge for completing the arc. www.youtube.com/watch?v=cxZg...

“The Conscience of a Hacker” by The Mentor is 40 years old today.

Manufacturing cyber compromises are expensive. An attack in 2025 forced Jaguar Land Rover to suspend production at its factories in the UK, Slovakia, Brazil and India through September and pushed it into a quarterly loss of almost £500m. www.theguardian.com/business/202...

Outlook emailing me that someone “reacted” to my email feels very Dilbert, like the Pointy-Haired Boss getting his emails printed.

[un]prompted is a new practitioner-led AI security con taking place Mar 3–4 at Salesforce Tower in SF. If you’re working hands-on w/AI systems, I strongly encourage you to submit a talk. Take a look at the CFP & review boards guidance on the kinds of submissions we’re hoping to see unpromptedcon.org

In life, as in music, all time scales coexist. The ‘now’ is not a fleeting instant but a field that extends forward and backward through memory and anticipation. Perception and context shape how we experience this layered present.

🚨 Critical React + Next.js RCE Alert 🚨 New flaws in the React Server Components “Flight” protocol (CVE-2025-55182 & CVE-2025-66478) allow unauthenticated remote code execution on default installations. Attackers only need one malicious HTTP request to take over a server.

New policy paper out: An Achilles Heel of Today’s Armed Forces: Managing Software Supply Chain Risk in the Military Sector Armed forces should pay more attention to their software supply chains. These are complex networks of software components, vendors, service providers, and other companies. /1

Veracode Research finds that OpenAI GPT-5 writes more secure code than other models. www.forbes.com/sites/the-wi...

I'm heartbroken to share that my friend of 30 yrs, Arthur Phillip Delchi, @delchi.bsky.social, DJ Delchi, has left us. A founding force behind DEF CON’s Hackers with Disabilities, a member of cDc Ninja Strike Force, a L0pht regular who DJed our wildest parties (two of those moments captured below)

Kociemba has launched the No Longer Evil project, an open-source initiative aimed at breathing new life into decommissioned first- and second-generation Nest thermostats. www.techspot.com/news/110186-...

Secure by design is shifting from vision to standard. Progress: >50% of apps now pass OWASP Top 10 checks (up from <33% in 2020), exploitable flaws dropped from 3.6% to 2.6%. But 70% of apps still have major flaws. Success means making security part of every build. www.forbes.com/councils/for...

Veracode found a malicious npm package “@acitons/artifact” impersonating @actions/artifact (206K+ DLs). It targeted GitHub repos to steal build tokens & publish malware. 6 versions used a post-install hook to fetch undetected malware. Veracode blocked & notified npm www.veracode.com/blog/malicio...

Some encouraging #righttorepair news out of DC... No, really!

The @consumerreports.org cybersecurity testing lab has helped improve security for several connected products. We showcase a few examples of what they have found and how they work with companies to improve product security. Also, if you're building a connected device, encrypt your traffic.

I'm struggling to understand why the attackers are classified as hacktivists and not nation-state attackers as when Salt Typhoon made similar compromises. www.bleepingcomputer.com/news/securit...

Well doesn’t this @axios cybersecurity news item just sum up the state of consumer internet privacy