Eggplant.place

141d

⚠️ Github CLI now has telemetry spyware built in:

https://cli.github.com/telemetry

They're shifting the burden onto users by requiring YOU to opt out, instead of making it opt in.

Run `gh config set telemetry disabled` to disable it.

#privacy #foss #github #cybersecurity #surveillance

164d

I'd guess FreeBSD's infrastructure is under attack. mailing list manager is super slow, forums have been defaced, what else is going on?

also, no official channel has acknowledged this yet?

tagging @FreeBSDFoundation for lack of a better profile

#freebsd #ddos #cybersecurity #hacking

Edited 164d ago

1 0 0 View Post & Replies See Original

113d

Every single blueteamer in information security at the moment...

#infosec #cybersecurity #security

tis picture shows the "this is fine meme", a comic dog sitting in a room on fire saying "this is fine"

ALT

0 0 0 View Post & Replies See Original

163d

500+ Organizations Now Participating as CVE Numbering Authorities (CNAs)!

As of March 31, 2026, there are 502 CNAs (499 CNAs and 3 CNA-LRs) from 42 countries participating in the CVE Program

Learn more:
https://www.cve.org/Media/News/item/blog/2026/03/31/502-Organizations-Participating-as-CNAs

#cve #cna #vulnerability #vulnerabilitymanagement #informationsecurity #infosec #cybersecurity

500+ Organizations Now Participating as CVE Numbering Authorities (CNAs)!

ALT

0 0 0 View Post & Replies See Original

155d

attention anybody with substantial experience with Rust and networking: my team is hiring!!

one of few rust jobs I'm aware of that is not web 3.0 horseplop.

fully remote (US timezones), good culture, good trans-inclusive healthcare, good work/life balance, and a nice defensive cybersecurity mission i can get behind.

feel free to reach out for more details and the job posting.

#fedihired #rust #infosec #cybersecurity #ot #ics

0 0 2 View Post & Replies See Original

84d

🚨 First the social media ban, now the UK government wants to restrict VPNs 🚨

VPNs are a vital cybersecurity tool for businesses, politicians, journalists and families to protect data and communications.

Banning or requiring digital ID checks before buying VPNs would increase cybercrime risks and expose IP addresses to predators.

https://www.express.co.uk/news/uk/2217934/vpn-ban-table-july-labour

#vpn #socialmediaban #ageverification #ukpolitics #cybersecurity #onlinesafety #ukpol #vpns #ProtectVPNs #privacy #onlinesafetyact

Edited 84d ago

1 0 1 View Post & Replies See Original

181d

Hello, Mastodon! 👋 We help people take back control of their personal data online, and we're here to connect with others who care about digital privacy.

Help us out: What feeds or accounts should we be following?

#privacy #cybersecurity #infosec #dataprivacy #dataprotection

Edited 176d ago

0 0 0 View Post & Replies See Original

112d

Your browser could already be part of a botnet thanks to this dangerous Chrome flaw

Your browser may never act suspicious enough to raise concern.

https://www.androidauthority.com/chromium-browser-vulnerability-3669581/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #AndroidAuthority [Android Authority]

1 0 0 View Post & Replies See Original

149d

(aikido.dev) CVE-2026-40175: Axios Critical Vulnerability Claim vs. Real-World Exploitability in Node.js Environments

Critical CVE-2026-40175 in Axios (CVSS 10) involves a multi-stage exploit chain: prototype pollution → CRLF injection → request smuggling → SSRF → AWS IMDSv2 credential theft. However, real-world exploitability in Node.js/Bun/Deno is blocked by runtime-level CRLF header rejection (ERR_INVALID_CHAR).

In brief - CVE-2026-40175 is a critical-rated Axios flaw with a complex exploit chain targeting cloud credentials, but standard Node.js environments mitigate it at runtime. Patch to Axios ≥1.15.0 to address the library-level vulnerability.

Technically - The exploit leverages prototype pollution to inject CRLF sequences into HTTP headers, aiming for request smuggling/SSRF against AWS IMDSv2. Node.js’s http.request() blocks CRLF characters, breaking the chain. Axios failed to sanitize headers independently, requiring a patch. Edge-case exploitation possible only with non-standard adapters bypassing Node’s HTTP client.

Source: https://www.aikido.dev/blog/axios-cve-2026-40175-a-critical-bug-thats-not-exploitable

#Cybersecurity #ThreatIntel

1 0 0 View Post & Replies See Original

149d

[#TRADESHOW] #Intersec #Shanghai 2026 – #Security #Equipment and #Technology #Expo will be held from May 7 to 9, 2026, at the National #Exhibition and #Convention #Center (#NECC), Shanghai. #Exhibition connects #international #suppliers with #China’s rapidly #expanding security, #fire #protection, and #safety #technology #markets. #Event integrates #global expertise with #market depth to promote #innovation in #AI, #IoT, #cybersecurity, and #emergency response #systems. https://cnbusinessforum.com/event/intersec-shanghai-2026-security-equipment-and-technology-expo/

1 0 0 View Post & Replies See Original

132d

New book, released under a Creative Commons BY-NC-ND license: "Don't Get Hacked! Protecting Yourself at Home": https://www.cs.columbia.edu/~smb/homesec/index.html

Retoot for reach!

#cybersecurity #homeCybersecurity #dontGetHacked

Edited 132d ago

0 0 1 View Post & Replies See Original

113d

Check it: Sen. Maggie Hassan (D-NH) is demanding answers from CISA and DHS over my reporting this week that a CISA contractor had published on GitHub a number of CISA AWS GovCloud keys and a ton of plaintext passwords, SSH keys, etc. for internal CISA resources.

ICYMI:

https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/

https://www.hassan.senate.gov/news/press-releases/senator-hassan-presses-for-answers-on-major-reported-data-leak-at-leading-cybersecurity-agency

#cisa #cybersecurity #databreach

MAGGIE HASSAN ABOUT SERVICES NEWS CONTACT Q ( Newsierres
UNITED STATES SENATOR FOR NEW HAMPSHIRE J——
05.19.2026
Answers on Major Reported Data
Leak at Leading Cybersecurity
Hassan: “This reported incident raises serious questions about how such a security lapse could occur at the very
agency charged with helping to prevent cyber breaches”
WASHINGTON - U.S. Senator Maggie Hassan (D-NH), a senior member of the Senate Homeland Security
Committee, is pressing for answers following public reporting that a contractor for the Cybersecurity and
Infrastructure Security Agency (CISA) maintained lists of agency accounts and passwords on a public
database. Senator Hassan issued a request for an urgent classified briefing from the agency, which is part of
the Department of Homeland Security.
“This reported incident raises serious questions about how such a security lapse could occur at the very
agency charged with helping to prevent cyber breaches,” wrote Senator Hassan in her request. “This
reporting raises serious concerns regarding CISA’s internal policies and procedures at a time of significant
cybersecurity threats against U.S. critical infrastructure... The alleged data leak has also occurred against the
backdrop of major disruptions internally at CISA.”

ALT

A PDF of a letter frm Sen. Hassan to Nick Andersen, the acting director of CISA:

I write to request an urgent classified briefing regarding public reporting that a contractor for the Cybersecurity and Infrastructure Security Agency (CISA) maintained lists of agency accounts and passwords on a public database.1 This reported incident raises serious questions about how such a security lapse could occur at the very agency charged with helping to prevent cyber breaches. According to a recent report from Krebs on Security, this leak included files that
detailed how CISA builds, tests, and deploys software internally in a folder called “PrivateCISA.”2 Exposed files reportedly included a file named “importantAWStokens,” with the administrative credentials to three Amazon Web Services (AWS) servers, and one named “AWS-Workspace-Firefox-Passwords.csv,” with plaintext usernames and passwords for multiple
internal systems.3 Security experts cited in recent reporting have described this security lapse as “one of the most egregious government data leaks in recent history.”4

This reporting raises serious concerns regarding CISA’s internal policies and procedures at a time of significant cybersecurity threats against U.S. critical infrastructure.

1 Brian Krebs, CISA Admin Leaked AWS GovCloud Keys on Github, Krebs on Security
(blog) (May 18, 2026) (krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-ongithub/).

ALT

Edited 113d ago

0 0 1 View Post & Replies See Original

124d

Alright I better announce this actually. At 8UTC Sunday 10th May ("tomorrow, Sunday morning in Europe") I am speaking to

@bagder of #curl https://curl.se/ https://en.wikipedia.org/wiki/Curl_(software)

about becoming targetted by trillions of dollars of #AI companies #cybersecurity scanning, especially after he rejected their ai-content merge requests. And having to close bug bounties due to #llm spam.

...And what it means for #indie #programming today. #commonLisp #ecl 's 2010 example is curl, and and and.

LISPY
GOPHER
CLIMATE
w/ screwlisp
SPECIAL GUEST DANIEL STENBERG
10 May
8AM UTC
The lisp alien draped in a bloodied US flag and grizzled gopher in a green trenchcoat stand behind a bagder in a suit beside a "://" old computer screen.

ALT

Edited 124d ago

2 0 1 View Post & Replies See Original

121d

This dumb password rule is from Getin Bank.

The new password should contain at least 10 and a maximum of 20 characters.
The password must contain at least one upper case letter, one lower case
letter and one number. The password cannot contain non-ASCII Polish alphabet
characters, special characters `&<'"` or spaces.

https://dumbpasswordrules.com/sites/getin-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

1 0 0 View Post & Replies See Original

117d

Xbox is now XBOX

Xbox just allcapsmaxxed: meet XBOX. This isn't a joke, Microsoft appears to be actually rebranding Xbox to XBOX. Asha Sharma, Xbox CEO, ran a poll on X earlier this week, asking fans whether Microsoft should use Xbox or…

https://www.theverge.com/news/931918/microsoft-xbox-rebrand-caps

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TheVerge [The Verge]

0 0 1 View Post & Replies See Original

80d

#Signal’s Meredith Whittaker wants you to remember that #AI chatbots ‘are not your friends’

https://techcrunch.com/2026/06/20/signals-meredith-whittaker-wants-you-to-remember-that-ai-chatbots-are-not-your-friends/

#privacy #cybersecurity #AgenticAI #AIAgent

0 0 1 View Post & Replies See Original

86d

New by me:

Scoop: FulcrumSec Leaks Novo Nordisk Data After $25M Demand Goes Unpaid

https://databreaches.net/2026/06/15/scoop-fulcrumsec-leaks-novo-nordisk-data-after-25m-demand-goes-unpaid/

#novonordisk #FulcrumSec #hackandleak #infosec #cybersecurity #databreach #intellectualproperty

@campuscodi @dangoodin @zackwhittaker @euroinfosec @amvinfe @briankrebs @lawrenceabrams

0 0 0 View Post & Replies See Original

86d

NEW by me:

One threat actor demanded $50 million from Novo Nordisk. Another one demanded $25 million. Neither got paid.

Two different groups tried to extort Novo Nordisk at around the same time. Novo Nordisk strung them both along, and then went dark.

Data leaks followed.

https://databreaches.net/2026/06/16/one-threat-actor-demanded-50-million-from-novo-nordisk-another-one-demanded-25-million-neither-got-paid/

#NovoNordisk #FulcrumSec #TheUSERS007 #hackandleak #extortion #AI #databreach #infosec #cybersecurity

@campuscodi @euroinfosec @jgreig @lorenzofb @ajvicens @amvinfe

Edited 86d ago

0 0 0 View Post & Replies See Original

61d

Japanese chipmaker Rapidus to offer lower wafer pricing than TSMC — 2nm class silicon to be priced around $20,000 on 2027 launch

Japanese chipmaker Rapidus discloses one more aspect of its strategy: to offer lower quotes than TSMC.

https://www.tomshardware.com/tech-industry/semiconductors/japanese-chipmaker-rapidus-to-offer-lower-wafer-pricing-than-tsmc-2nm-class-silicon-to-be-priced-around-usd20-000-on-2027-launch

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

1 0 0 View Post & Replies See Original

104d

You can now use your #Gmail account in #Proton Mail

https://proton.me/blog/proton-mail-connect-gmail

#Google #email #privacy #cybersecurity

1 0 0 View Post & Replies See Original

103d

Mystery company accidentally blew $500 million on Claude AI in a single month — failed to put usage limit on licenses for employees

A new report cites an AI consultant claiming a client accidentally spent $500,000,000 on Claude in a single month.

https://www.tomshardware.com/tech-industry/artificial-intelligence/mystery-company-accidentally-blew-usd500-million-on-claude-in-a-single-month-failed-to-put-usage-limit-on-licenses-for-employees

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #TomsHardware [Tom's Hardware]

1 0 0 View Post & Replies See Original

102d

The Great American State Fair cancellations are getting framed as a culture war story. Stop there. The real signal worth tracking is what happens to event infrastructure when organizers face coordinated pressure campaigns online.

Large public gatherings tied to...

Security #Cybersecurity #ThreatIntel #InfoSec

1 0 0 View Post & Replies See Original

102d

Rivian says AI makes debate over CarPlay ‘completely obsolete’

Rivian’s chief software officer, Wassym Bensaid, joined Nilay Patel in the latest Decoder interview. And his comments on CarPlay show Rivian continuing to double down on its refusal to support Apple’s platform. more…

https://9to5mac.com/2026/05/28/rivian-says-ai-makes-debate-over-carplay-completely-obsolete/

#Tech #Technology #TechNews #AI #Gadgets #Software #Cybersecurity #Apple #Google #Microsoft #Startup #OpenSource #9to5Mac [9to5Mac]

1 0 0 View Post & Replies See Original

34d

Raspberry Pi now publishes a Software Bill Of Materials (SBOM) with each PiOS download

and a torrent
and a link to the release notes
and a link to the release archive
and the release date
and a checksum
and the download and install storage sizes
and the architecture, kernel, and upstream release versions
and a list of all compatible hardware
in the same place.

https://www.raspberrypi.com/software/operating-systems/

How is your Enterprise software vendor doing?

#RaspberryPi #PiOS #SBOM #SoftwareBillOfMaterials #InfoSec #InformationSecurity #CyberSecurity