🚨 Wiz update >> stolen cloud secrets are being used within hours.
We tracked TeamPCP turning supply chain attacks into real cloud access - fast. From Trivy to LiteLLM, stolen creds, keys, and configs were validated and abused immediately.
Full breakdown 👇
wiz.io/blog/tracking-teampcp…
LinuxWelt retweeted
After U.S. forces turned China’s most advanced anti-stealth radar—the JY-27A—into little more than lawn art, Xi reportedly ordered the execution of its chief designer, Yang Wei. Engineering with Chinese characteristics…
Looks like the postInstall setup script grabbed a second stage from GitHub repos which have been taken down so the threat should be neutralized as it stands now.
We are working it, sharing what we know as of now - gist.github.com/joe-desimone…
LinuxWelt retweeted
Apple deceived users.
They once took the government to court over its refusal to build a backdoor to your private data.
But now Apple is happy to use laws to collect information on you. Even when it didn’t have to.
Two-faced.
Archinstall 4.0 introduces a modern textual UI, replacing the curses interface to enhance usability and accessibility in the Arch Linux installer.
linuxiac.com/archinstall-4-0…
#Linux #ArchLinux #OpenSource
LinuxWelt retweeted
It's our birthday! 🎉
We're feeling nostalgic, so to celebrate, here are a few things turning 5 alongside AlmaLinux. Ah, memories!
LinuxWelt retweeted
BREAKING: Marc Andreessen says AI is a “silver bullet excuse” for layoffs actually due to over-staffing during COVID.
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
LinuxWelt retweeted
📹 India Set to Ban Sale of Hikvision, TP-Link, CCTV Products From April
Source: cybersecuritynews.com/india-…
Starting April 1, 2026, the Indian government will effectively ban Chinese video surveillance giants, including Hikvision, Dahua, and TP-Link, from selling internet-connected CCTV cameras in the country.
This decisive market restriction stems from new mandatory certification rules driven by national security concerns regarding foreign hardware. The Ministry of Electronics and Information Technology (MeitY) has implemented strict Standardisation Testing and Quality Certification (STQC) requirements for all internet-connected surveillance equipment under the IS 13252-1 cybersecurity standard to mitigate foreign espionage risks.
#cybersecuritynews
LinuxWelt retweeted
Microsoft / GitHub injecting ads into CoPilot generated PRs: welcome to the future! notes.zachmanson.com/copilot…
(yes, this was a confirmed "feature" from someone on the CoPilot team; apparently they are disabling it after backlash)
LinuxWelt retweeted
🚨‼️ BREAKING: Databricks allegedly compromised in a TeamPCP supply chain attack.
Databricks is the leading cloud-based data analytics platform: used by organizations worldwide to manage massive datasets.
We notified them last week. They scaled up to investigate. We haven't heard back since.
LinuxWelt retweeted
🚨BREAKING: European Commission confirms its website was breached after a hacker said they stole more than 350GB of data. The hacker plans to publish it online.
This is a cool hack.
I had a misbehaving atomic clock. Was it broken or was it unable to catch the 60khz signal over the air?
I was about to start disassembling and getting out my radio gear. But then I found the “Clock Wave” app. It plays a signal over the speakers of a phone/tablet. The speakers obviously can’t hit 60khz, but it can play frequencies that have a 60khz harmonic! The speakers obviously aren’t producing radio waves… but the oscillating magnetic field of the speakers DOES create near-field effects that are picked up by the clock’s antenna.
Using a speaker to induce near field energy, and then leveraging harmonics to hit a frequency 3X higher than its capable of. There is ALWAYS a way :)
LinuxWelt retweeted
🚨 MASSIVE CYBERATTACK: The EU Commission, ENISA, and the DG for Digital Services have been compromised by threat actor ShinyHunters.
Leaked data includes:
▪️ Emails & attachments
▪️ Full SSO user directory
▪️ DKIM signing keys
▪️ AWS config snapshots
▪️ NextCloud/Athena data
▪️ Internal admin URLs
It's a mess!
🚨 RAM prices are plummeting after OpenAi failed to fulfill its commitment to purchase 40% of World supply and terminated its $71 billion SKHynix promise. $MU
DDR5 memory prices just took a noticeable dive for the first time in months, and Google’s TurboQuant might be behind it. wccftech.com/ddr5-prices-jus…
LinuxWelt retweeted
Delve: "We are not an auditor, just as tax preparation software is not an accountant. We have never signed an audit report."
Also Delve:
Customer websites display certifications that says "Secured by Delve."
You simply cannot have it both ways, and now this bites back.
Over the past week, you may have seen an anonymous post about Delve. While we responded to it in a day, we want to provide more details about what’s true, what's not, and some changes we’ve made.
There’s one question behind everything: did Delve fabricate compliance evidence or issue fraudulent audit reports?
No. We did not.
→ Delve is an AI compliance platform that connects customers with independent auditors. We are not an auditor, just as tax preparation software is not an accountant. We have never signed an audit report.
→ Using default templates for our customers, just like any other compliance platform, is not “faking evidence.” These are meant to serve as a starting point for customers.
→ Delve does have automation in the platform, with 600+ automated integration tests, an AI Copilot to guide customers through compliance, AI code scanning, and more.
--
We built Delve to accelerate innovation by bringing AI to compliance.
In doing that, we pushed hard on automation. However, we now realize we didn’t provide enough clarity about what is automated, what is customer-provided, and what is independently audited.
We have been working relentlessly to make improvements over the last week.
--
On our auditor network:
Delve connects customers with independent auditors. Some customers choose their own auditors, but many use firms in our network. Questions have been raised about some of those firms, including ones used by other platforms.
Going forward we will set a higher bar in how our auditor relationships are structured and how the process is experienced by customers.
Delve is rebuilding our auditor network, removing firms that don’t meet our standards, and offering complimentary re-audits and penetration tests to every customer.
On platform templates for our customers:
Delve provides default templates, just like many other platforms, for policies, board meetings, risk assessments, and more.
These are designed to be starting points only. We should have been more explicit about how they are meant to be reviewed and customized by customers.
We are making that indisputably clearer within the platform.
On draft audit reports:
Third-party auditors are responsible for independently reviewing all evidence and issuing final reports.
We built automation that interacts closely with independent audit workflows to help expedite the process on behalf of our customers. However, this contributed to confusion about where automation ends and independent judgment begins.
From now on, Delve will no longer automate these parts of the process. Furthermore, customers have a direct line of communication with their auditor to enhance transparency in any audit communications.
--
We started Delve because we went through compliance ourselves and saw how slow, expensive, and manual it was.
To anyone that wants to sit down and discuss our product philosophy and improvements, please reach out and let’s chat about it.
Linux 7.0-rc6 Bringing A Lot Of Audio Quirks / Fixes
Quirks, quirks, and more quirks.
phoronix.com/news/Linux-7.0-…
KDE's KWin Compositor Lands First Step Toward @VulkanAPI Support
phoronix.com/news/KDE-KWin-V…

































