See nothing, Hear nothing, Say nothing
5280
Joined October 2009
- Tweets24.3K
- Following1.7K
- Followers766
- Likes43.7K
stacksmasher retweeted
Just got a phishing email that Gmail authenticated as Google. DKIM/DMARC passed. I can see a lot of people falling for this one, since it plays to the idea that your account has already been compromised.
Scammer puts the scam in an app-password name, triggers a real Google alert, then forwards the alert email to your email address.
How this attack works, and why it’s convincing:
1. The trick: The attacker puts the threatening text and shortened URL into an app password’s customizable name on another account. Google incorporates that text into a real security notification and signs the email.
2. The delivery: That notification is forwarded through another mailbox to the victim. In this message, Gmail still recorded passing Google DKIM and DMARC authentication.
3. What makes it convincing: The Google sender, signature, branding, and “Check activity” button are legitimate. The suspected attacker-supplied text appears inside the same trusted-looking template, using a deadline to push you toward its separate link.
4. The giveaway: Both the notification and its genuine Google button refer to someone else’s account. The “permanent access after 24 hours” claim is false; app passwords can be revoked.
Be careful out there folks!
stacksmasher retweeted
Cursor HQ right now :
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
stacksmasher retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
stacksmasher retweeted
Full blown intrusions happening for php2shell right now, which you can watch here: php.events.greynoise.io/
It looks like the actor intends to deploy ransomware. It also looks like they have compromised other actually real victims.
stacksmasher retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
stacksmasher retweeted
🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418
Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition.
The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required.
⠀
• CVSS: 8.6
• Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication
• Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1
• Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
⠀
Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release.
stacksmasher retweeted
heard in Silicon Valley:
Security researchers will soon make more than AI researchers.
stacksmasher retweeted
WTF. Cybersecurity firm Sophos says its incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS.
The WSJ reports security firms are overwhelmed by what insiders call 'Black October.' MoxFive says newly breached companies may have to wait up to FIVE DAYS for help.
Security executives say AI is helping attackers exploit vulnerabilities faster than defenders can respond.
stacksmasher retweeted
BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen:
• $1.45 billion $BTC
• $875 million $ETH
• $234 million $TRX
• $50 million $XAUT
• $1.57 billion $USDT
• $823 million $USDC
• $75 million $WBETH
• $88.5 million $RLUSD
+ $447.5 million additional cryptocurrencies
This is the largest hack in crypto history.
stacksmasher retweeted
AWWWWOOOOOOOGAAAAAAA
9.8 severity use-after-free vulnerability in the kernel’s IPv4 TCP stack just landed
Time to patch!
ubuntu.com/security/CVE-2026…
stacksmasher retweeted
Vulnerability management eh?
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
stacksmasher retweeted
RCE in Google Chrome 😬
🔴 CVE-2026-118320 · Google Chrome >=156.0.8078.73 <156.0.8078.73
Google Chrome's V8 JavaScript engine is affected, and the flaw could let a remote attacker run arbitrary code within Chrome's sandbox if a user… CVSS 8.8. EPSS 0.00.
Fix: 156.0.8078.73
cve.now/CVE-2026-118320
