MG retweeted
The man is a hero! If you can afford too, sponsor him. He saved a lot of the internet today!
github.com/sponsors/oerdnj
MG retweeted
Contra todo pronóstico y sin aviso previo, Ondřej Surý ha aplicado los parches CVE-2026-109618 y CVE-2026-109619 tanto para PHP 5.6 como para PHP 7.4. En el log aparece: "Backported from 8.2.35". Nos ha salvado el culo a los que tenemos servidores Debian/Ubuntu.
MG retweeted
Garante privacy, provvedimento n. 604 del 6 agosto 2026 garanteprivacy.it/home/docwe…
MG retweeted
⏰ Ci siamo quasi! Il Meeting VSIX 2026 sta per iniziare.
📍 Padova, Padova Congress
🗓 Martedì 27 ottobre dalle ore 09:00
👉 Registrati e prenota il tuo meeting One-to-One: meet26.vsix.it/join/
#MessageNetWholesale #MessageNetOnTheRoad
MG retweeted
CHAT CONTROL 2.0 BLOCKED AGAIN, THANKS TO YOU!
What happened yesterday: the @Europarl_EN blocked the deal pushed by the @EUCouncil.
The Council wanted:
(1) "voluntary" scanning of all private chats under "search plans" approved automatically unless an authority vetoes;
(2) administrative authorities, not courts, ordering providers to scan private messages, not limited to suspects, using AI with massive false positive rates;
(3) making the failed Chat Control 1.0 mass scanning regime permanent, while admitting it is not effective, as we discussed in my previous posts.
Your voice to parliamentarians made a huge difference again: the Parliament refused scanning of private communications, stating it must remain limited to persons linked to child sexual abuse, not everyone by default or under a blanket licence, as Council proposed.
The Parliament also closed the back door where "risk mitigation" rules could force providers into scanning under threat of fines.
What did pass: a preliminary agreement on scanning publicly accessible content for known child abuse material. This was proposed by the Parliament as the effective, targeted alternative.
We still wait for the text to see what this means and will inform you in the coming weeks.
This defense proves again: our voice matters when it is vocal, with your support!
And we will need it again in November, so please follow the updates.
Now, it is important to call or write to your MEP and your government to say thank you to those who stand on the side of privacy.
They need to see you are watching their move. Please repost.
MG retweeted
STOP CHAT CONTROL 2.0. - What you should know:
Tomorrow, 29 September, behind closed doors at the Council, the most draconian version of Chat Control 2.0 goes on the table. It is no longer only an intermediary reading all your private messages and cloud storage. It is a licence to search them for months, without suspicion against any individual.
The leaked Presidency note to delegations (11956/26, 10 September) proposes "authorisation of search plans for a period of time rather than on a case-by-case basis" for private chats and emails.
In plain terms: your messages, contacts, photos and cloud will be scanned under a state-issued licence for months, with no suspicion against you.
The same note admits that under this regime "a high volume of reports generated do not lead to any operational outcome." The Council's Legal Service already warned this is general and indiscriminate surveillance, illegal under EU law. The @Europarl_EN mandate says the opposite: judicial authorisation, targeted to specific persons, no scanning licences.
Tomorrow the pressure is on Parliament to fold. You remember the tricks used to push Chat Control 1.0 through and how @EPPGroup with @RobertaMetsola helped to push for it.
So fasten your seat belt for what is coming tomorrow, and call or write to your MEP and your government now to reject Chat Control 2.0. as a whole!
Remind them what this does to the privacy of every one of us.
Under a search plan, every chat, photo or contact the scanner flags is stored by the provider and sent to a new EU agency, the EU Centre, which keeps it and passes it to police. Any state authority can then demand it, with a deadline and a fine for delay, and nobody has to check who is really behind the request, in case it is hacked or weaponised.
That is exactly what happened at Revolut, and what keeps happening through abusive requests from authoritarian states, as we have reported for 13 years.
In the Revolut case the hackers got access to a real state mailbox. Their requests came from an authentic certified email (PEC) account of an Italian Prefecture on the Interior Ministry's domain, with Postal Police protocol numbers, as European Investigation Orders in the name of the Milan prosecutor, for about five months.
About 680 customers lost passports, selfies, home addresses, IBANs and full transaction histories. The files are being sold; hundreds of victims now fear kidnapping. No remedies exist as of now to protect against such attacks.
Let's stop it before it is too late. Please repost.
MG retweeted
L’AI può essere rivoluzionaria nel mondo dei dati pubblici, soprattutto quando si parla dei nostri soldi: di come vengono impiegati, dove finiscono e con quali obiettivi.
Può offrire ai cittadini un livello di trasparenza senza precedenti, rendendo dati complessi più accessibili, comprensibili e interrogabili.
Ed è proprio per questo che continueremo a portare avanti lo sviluppo di @DoveVannoINostriSoldi.
MG retweeted
The threat actor #IAmNotAVillain published a new section on their claim site last night!
The section, entitled "The Italy Files", contains Italian documents (not just identity documents).
And he states: "We have shown samples that are embarrassingly unprofessional on Italy’s.."
The Threat Actor #ImNotAVillain has started a countdown!
#Revolut has 24 hours to pay a $3 million ransom in #XMR.
If the ransom is not paid, the stolen data will allegedly be put up for sale.
MG retweeted
Abbiamo usato l’AI per analizzare la spesa pubblica italiana.
Ci siamo concentrati su tre casi:
1. prezzi dei farmaci
2. costi dei ritardi giudiziari
3. contributi edilizi concessi anche per lavori che sarebbero partiti comunque.
FARMACI: RIVEDERE I CONTRATTI DI ACQUISTO
AIFA stima tra 87,3 e 446,4 milioni di euro di risparmio in quattro scenari alternativi, applicati ai consumi del 2025.
Bisogna partire dai contratti: quanto paga ogni amministrazione, per quali dosi e quantità, con quali costi di somministrazione. Quando una terapia appropriata e comparabile costa meno, quel divario è una voce da verificare prima di rinnovare l’acquisto.
Nel report mostriamo anche il conto: ottenere metà del margine dello scenario da 348,4 milioni, spendendone 10 per attuare gli interventi, lascerebbe 164,2 milioni netti su dodici mesi. È un esempio con ipotesi dichiarate. Il risparmio effettivo va verificato sui contratti.
GIUSTIZIA: RIDURRE I RITARDI CHE GENERANO INDENNIZZI
Nel 2025 lo Stato ha pagato 207,4 milioni per l’irragionevole durata dei processi.
La cifra comprende debiti accumulati negli anni: non significa che possiamo tagliare 207 milioni dal bilancio di ogni anno.
Per ridurre questa spesa bisogna risalire dai nuovi indennizzi ai procedimenti che li hanno generati. Dove si fermano i fascicoli? Quali rinvii si ripetono? Quali attività restano arretrate?
Il personale e gli interventi organizzativi vanno assegnati in base a queste risposte. Gli indennizzi già riconosciuti vanno pagati puntualmente: un altro ritardo può aggiungere interessi e spese legali.
BONUS EDILIZI: FINANZIARE I LAVORI CHE HANNO BISOGNO DELL’AIUTO
Il 27% degli investimenti agevolati da Superbonus e Bonus facciate nel 2021-2023 sarebbe stato realizzato anche senza incentivi: oltre 45 miliardi di euro.
Sono investimenti storici, non soldi oggi recuperabili. Ma il dato indica un problema preciso: parte dell’aiuto ha finanziato decisioni che sarebbero state prese comunque.
Nei nuovi programmi proponiamo contributi graduati per capacità economica e beneficio pubblico, limiti ai costi ammessi e un budget fissato prima di assumere gli impegni.
Escludere un contributo inefficace produce un taglio solo se quella somma non viene spesa altrove.
----
Nel PDF trovate le fonti, i grafici e, per ogni caso, la spesa da rivedere, l’intervento proposto e il modo di misurarne il risultato. ⬇️
drive.google.com/file/d/1ebK…
MG retweeted
?? La legge prevede dal 2000 che una amministrazione non debba chiedere una informazione già in suo possesso.
2000, 26 anni. Siamo nel 2026.
MG retweeted
Databreach @Revolut
Sembra che la e-mail di phishing che impersonava una Agenzia governativa sia stata inviata tramite una casella di posta certificata italiana 🇮🇹
🔗 xitter.cf/KuptoKosmos/status/209…
La situation a changé ce dimanche 13 septembre... Ceux qui tiennent les dossiers ont commencé à les montrer
> Ils publient sur Telegram, avec le filigrane t .me/IA
> Ils parlent d’exemples, un par un
> Ils disent qu’ils continueront chaque jour tant que Revolut ne paie pas
> Ils promettent aussi des messages internes et des détails sur la façon dont l’équipe travaille
> Ils accusent la société d’avoir laissé partir des informations hors de sa juridiction.
Le premier nom clairement collé à un dossier, c’est Felix Römer. Fondateur de Gamdom, casino crypto et de Skinscom
Les attaquants ont sorti ce qu’ils appellent son KYC complet : photo de vérification Revolut et papiers d’identité, avec un document allemand visible sur les captures... Vers 18h31, il a répondu publiquement : "Ah wtf @Revolut"
Le deuxième nom mis en avant est Alexander Shevchenko, joueur ATP
D’autres clients avaient déjà dit avoir reçu le mail officiel de Revolut :
Marc Zeller
Nikhil Foster
Mark Karpelès
C’est @MagicalTux qui donne le détail le plus précis de la soirée...
Il n’est pas un commentateur extérieur. Ancien patron de Mt.Gox, il fait partie des clients touchés. C’est en partie grâce à lui que le public a vu noir sur blanc ce que la société admettait avoir envoyé :
> nom
> date de naissance
> métier
> adresse
> téléphone
> passeport ou permis
> selfie
> relevés
> IBAN
> date d’ouverture
> référence de wallet
> retraits
> historique complet y compris Bitcoin
Ensuite, il ne s’est pas arrêté au communiqué. Il a poussé Revolut. Il a regardé le droit applicable
Son constat : l’adresse utilisée n’était pas une adresse déjà connue de l’équipe. Les règles, sur le papier, auraient dû imposer plus de vérifications avant d’envoyer ce type de dossier. Ce n’était pas, selon lui, un simple oubli technique. C’était une demande qui n’aurait pas dû passer comme ça
Dimanche soir, en voyant les publications des attaquants, il écrit que ça empirait. Puis il pointe ce qu’il a trouvé dans leurs posts :
> un fichier msg.eml de 59,95 Mo
Un fichier .eml, c’est un e-mail brut. En-têtes, corps, pièces jointes, le message entier tel qu’il a voyagé. Presque 60 mégaoctets, ce n’est pas une lettre. C’est une valise !
Ce fichier, d’après Karpelès, est passé par la PEC italienne, la Posta Elettronica Certificata
En Italie, ce n’est pas un mail ordinaire. C’est le canal certifié, l’équivalent numérique du recommandé, celui qu’utilisent administrations, tribunaux, entreprises quand un envoi doit avoir une valeur juridique
Le fichier était protégé
Le mot de passe n’était pas dedans
Il arrivait dans le mail suivant
Ça recadre toute l’affaire. On n’est plus seulement face à un e-mail qui avait l’air officiel
On est face à un envoi qui emprunte le rituel italien de l’acte certifié, assez lourd pour contenir une liasse de documents, assez formel pour que le service conformité croie avoir affaire à une vraie réquisition
Le reste...
> Les dossiers commencent à circuler au-delà du premier salon
> ZachXBT, qui a rendu l’incident public, s’est fait bloquer par les deux comptes officiels Revolut !
> La société n’a toujours pas nommé l’agence, ni le nombre de victimes, ni répondu clairement aux publications de ce dimanche
> Aucun montant de rançon n’a filtré
> Seulement l’exigence : que Revolut paie, sinon d’autres noms demain
Voilà où on en est
Les fonds sont restés dans les comptes... Les personnes, elles, sont sorties du classeur
Merci #Revolut, merci les #KYC pour la "sécurité" 💢
MG retweeted
🔓 Revolut è stata bucata?
Non proprio. Ed è forse ancora più grave.
👉 youtube.com/watch?v=JpZJtthe…
Il data breach confermato dall’azienda, che secondo la stampa coinvolgerebbe anche clienti italiani, non racconta il classico attacco dell’hacker che “buca la banca”. Racconta piuttosto l’abuso di un canale considerato affidabile: richieste di dati partite da una PEC istituzionale e presentate come comunicazioni della Polizia Postale.
Con il metodo “spray and pray”, bastano identificativi di transazioni crypto pubblici e controlli procedurali insufficienti per arrivare a dati estremamente sensibili: documenti, selfie di verifica, saldi, movimenti, IBAN.
La domanda, allora, non è solo cosa debba fare Revolut. È: chi controlla i controllori?
Quante altre richieste sono partite da quelle PEC? Quante aziende hanno consegnato dati? E quanto è davvero sicura la catena di fiducia tra autorità e piattaforme?
Ne parliamo nel video di oggi, su Ciao, Internet.
#Revolut #PEC #eEvidence #TechPolicy #databreach
MG retweeted
New evidence shows: (1) @Revolut did apply the one refusal ground the law gives it. (2) the attackers targeted in their malicious request high-value clients using blockchain transactions.
Documents show that on 24 July 2026, on a request covering 198 hashes, Revolut refused direct disclosure for 169 tied to Revolut Ltd (UK) and 29 tied to a Swiss entity, redirecting the requester to UK mutual legal assistance.
Only accounts held at Revolut Bank UAB in Lithuania were treated as covered by the EIO. The refusal ground available to Revolut was jurisdictional. They APPLIED it.
EU AML law imposes no verification duty on the bank and provides no meaningful mechanism to check who is really behind an authenticated state request. Refusal to answer carries fines in the millions. In practice, verification is impossible.
Now, how the attackers targeted high-value clients? Per Duel's verified .eml files, they used public blockchain data as query keys.
Hundreds of crypto transaction IDs and deposit wallet addresses tied to suspected high-value Revolut users were submitted under the forged EIO cover. Revolut returned encrypted zip files with folders of ten customers each, ID pictures, verification selfies, account data, unredacted transaction data, with the password sent in a follow-up PEC.
Anyone whose wallet address appears on-chain can be turned into a target this way. Self-custody does not close this door: the moment your KYC data sits with a regulated intermediary, the same channel opens.
Very important that @Corriere covers this issue. Two points missing from the reporting so far:
(1) @Revolut did apply the one refusal ground the law gives it. Documents show that on 24 July 2026, on a request covering 198 hashes, Revolut refused direct disclosure for 169 tied to Revolut Ltd (UK) and 29 tied to a Swiss entity, redirecting the requester to UK mutual legal assistance.
Only accounts held at Revolut Bank UAB in Lithuania were treated as covered by the EIO. The refusal ground available was jurisdictional, not verification.
EU AML law imposes no verification duty on the bank as to who is really behind an authenticated state request, and refusal to answer carries fines in the millions.
(2) How the attackers targeted high-value clients: per Duel's verified .eml files, they used public blockchain data as query keys. Hundreds of crypto transaction IDs and deposit wallet addresses tied to suspected high-value Revolut users were submitted under the forged EIO cover.
Revolut returned encrypted zip files with folders of ten customers each, ID pictures, verification selfies, account data, unredacted transaction data, with the password sent in a follow-up PEC.
Anyone whose wallet address appears on-chain can be turned into a target this way. Self-custody does not close this door: the moment your KYC data sits with a regulated intermediary, the same channel opens.
MG retweeted
Important updates on @Revolut and what you can do:
1. According to the group now extorting Revolut, and to the Duel team in contact with them, the attackers took over Italian government and law enforcement mailboxes with an infostealer, sent Revolut Bank UAB in Lithuania a forged European Investigation Order (to attention of @Eurojust @Europol ) in the name of the Italian authorities, and kept sending requests for five months.
2. Revolut answered every one, as @FATFNews and EU AML laws require. Now scale this abuse a thousand times, in the hands of authoritarian states and their proxies, who do not seek attention like these hackers and quietly collect data on citizens and entities of the EU and other Western countries.
3. The attackers claim to hold 147 GB from the Italian side, including internal documents and officer chat logs, and say most of the Revolut data concerns customers in Switzerland, France and Hungary, with other countries affected. Passports and KYC selfies of named individuals are now being published daily until Revolut pays.
We are collecting witness statements to push for remedies. If you are a legal or security expert and want to support our team, DM me.
What you as an EU citizen can do today to limit these attacks in the future:
1. Contact your MEP on @EP_Economics, @EP_Legal or @EP_Justice and ask for an urgent joint hearing on the weaponisation of mass data collection and a reassessment of the whole approach, before the next leak names someone who does not have the means to move house.
2. Use this argument: every bank, exchange and payment provider in every jurisdiction that follows FATF rules, and the AML, financial and national security laws built on them, is exposed the same way, because the rules oblige them to answer state requests and nobody is required to check whether the state behind the request is who it claims to be.
That is what human rights groups, victims and experts with support of @ODFoundation described to the European Parliament three years ago, proposing specific remedies. The @EU_Commission and the @EUCouncil removed every safeguard the @Europarl_EN adopted from the AML Regulation.
3. You want politicians care more about privacy and digital rights protection?
Support and promote the MPs and MEPs who pushed for remedies. Demand accountability for rejected remedies by Commission and Council.
This year the European Parliament, under @HNeumannMEP @petras_petras @NachoSAmor leadership , named this risk transnational financial repression in its resolution of 18 June 2026.
@coe adopted Resolution 2669 on 25 June, rapporteur @constantinosefs , with @MarkusWiechel pushing specifically for an investigation into transnational financial repression and remedies against it.
The @oscepa followed in The Hague in July, led by @emmedibi , with an even more detailed focus on exactly these attacks.
MG retweeted
Avete presente #Revolut?
Sembra esserci di mezzo un punto di accesso in mani sbagliate.
Forse questo furto è solo uno dei problemi, più passano le ore e più sorgono dettagli amareggianti
internet-forum.it/d/5232-ave…
MG retweeted
Revolut non ha subito nessun hack, ha consegnato volontariamente dati sensibili di clienti dopo richieste fraudolente via PEC autentiche
IAmNotAVillain dice di aver usato per mesi sistemi delle forze dell’ordine italiane e di avere 147 GB di file
(Viminale non conferma x ora)
‼️ BREAKING: We're in contact with the Revolut hacker. According to them, they didn't only take Revolut data, they've also compromised multiple Italian law enforcement departments.
They say the operation targeting Revolut ran for six months, and that they used Italian law enforcement systems to send data requests to Revolut.
They claim to hold 147 GB taken from the Italian side, including internal docs, calendars and personal material, among it the chat logs of a federal officer arguing with his wife.
MG retweeted
Ne ho scritto per IBL @istbrunoleoni mettendo in luce
il vero problema:
📍si sta creando a priori una forma stratificata e ampia di sorveglianza diffusa.
🔴 l’analisi SI LEGGE QUI brunoleoni.it/wp-content/upl…
MG retweeted
Cassandra Crossing 692/ Arrivano i peluche, scompaiono i comandi.
Cosa succederà ai bambini che da oggi cresceranno con i nuovi peluche, fuffosi compagni di giochi animati dall’intelligenza artificiale? L’industria che c’è dietro sta esplodendo.
buttondown.com/cassandra/arc…
