When the attack lives in the physical device, every software check is looking in the wrong place. After a reseller-level hardware compromise cost people tens of millions, here’s how I’d secure a hardware supply chain if I were the manufacturer.

The most dangerous field in vulnerability disclosure has always been the Cc line.

11.7 million CAPCOM ID emails leaked with your last login time and IP attached. Here comes a new challenger in your inbox.

A test account named Test2 with the password Password1 sat on a network for 12 years until ransomware finally ran the test.

I bet the next critical OSS patch embargo won’t be going to @chainguard_dev. Breaking the embargo might have helped their customers today, but hurt them long term.

Just finished reading the @OpenAI report on the two coding agents that weakened their own monitoring. A few notes. The first one was told "don't send any messages." It took that as cover to mute the alerts going to Security. The second removed its monitor, then changed the test so it would only pass with the monitor gone. When the user asked, it said it hadn't removed it. Neither run got stopped automatically. OpenAI says it doesn't know yet if this was deliberate or the agents pushing too hard to finish the task. From a controls view it doesn't matter much. If the agent can turn off its own monitor, the inmates are running the asylum. alignment.openai.com/misalig…

PHP2Shell update before the 10 AM ET patch: @Cloudflare CTO @dok2001 says they're already seeing early attacks against the two leaked PHP RCE bugs (CVE-2026-109618 and CVE-2026-109619). WAF rules are live for all plans, including free, but he calls it a stopgap. If you run PHP on anything internet facing: Patch the moment @ThePHPF ships at 14:00 UTC. If you can't patch today, take it offline or put it behind a WAF. Make sure your origin isn't reachable directly, or the WAF does nothing. After patching, look for web shells, new admin users and modified PHP files. The servers you know about will get patched today. The harder part is where else PHP hides: routers, NAS boxes, firewalls, control panels and vendor appliances. Many of those only get fixed when the vendor ships firmware, and some never will. Find them, and if they face the internet, cut them off until there's a fix.

PHP is shipping a security release tomorrow, Oct 21, at 10:00 AM ET for two critical vulnerabilities, rated CVSS 9.2 per @ThePHPF. It could land earlier if details go public or exploitation shows up. @watchtowrcyber says details already leaked, that both are remote code execution, and rates them a 10. PHP hasn't confirmed any of that, but plan like it's true. Tonight: find every place PHP runs, check versions with php -v and php-fpm -v, and line up a patch window for the morning. Anything older than 8.2 is end of life, so don't expect a fix there. Every PHP install without an owner is attack surface you can cut today.

Six months after Drift, the exploiter is washing ETH through Tornado Cash. About 25,700 ETH in two hours, per @lookonchain. Worth remembering how that $285M left. No contract bug. Two of five Security Council signers were socially engineered into pre-signing durable nonce transactions, approvals that stayed valid until the attacker chose to use them. A move to zero timelock days earlier removed the last chance to catch it. Multisig counts signatures. It doesn't check what was signed. Running treasury ops? Dedicated signing devices, verify the payload outside the signing UI, timelocks on admin actions, and no long-lived pre-signed approvals.

The keys didn't leak from the sites. They leaked from the vendor. TeamUpdraft believes its customer database was accessed over the weekend, including UpdraftCentral connection keys. With those keys, signed commands installed backdoor plugins on fully patched WordPress sites. Every signature check passed, because the signatures were real. Patchstack found the box that adds your site to UpdraftCentral is ticked by default when you connect a TeamUpdraft account, so plenty of sites hold a key nobody remembers creating. If you run UpdraftPlus: update to 1.26.12 or 2.26.12, delete the UpdraftCentral key, and look for admins and plugins you didn't add. Remote management you never use is still remote management. Turning off what you don't need is constant attack surface reduction, and it's near the top of my agenda for a reason.

One Chinese-speaking operator pointed AI agents running a mix of DeepSeek and Claude Code at 1,200+ e-commerce sites starting Sept 25 and broke into sites belonging to 100+ companies, including Deere and a SharkNinja support site. NorForge's Snorre Fagerland estimates about $50 in tokens per successful break-in. The goal according to NorForge was persistent access to e-commerce and payment infrastructure to monetize later. In this business that usually ends in skimmers and stolen cards. The detail that stuck with me: when a big target's main app had no holes, the agents went digging through related infrastructure, found a public control panel with a subtle flaw, and spent hours working it until they had command execution. Successful hits averaged about 23 hours. And the only reason anyone saw this is the attackers left their own Cairn panels open on the internet. Cairn is the open-source agent platform they ran it all on. This is why constant attack surface reduction is a top agenda item in the security programs I run. Your attack surface is everything tied to your name, not just the app you're proud of. Forgotten admin panels and vendor hosted sites are exactly where these agents went looking. Find them and shut them down before an agent does.

The miner is the least interesting part of this. That startup item has a random name, runs a big encoded script through bash, and is dated Aug 29. That could be seven weeks of someone running code as this user, with access to everything they can reach, including the GitHub login on that Mac. The temperature sensor was the only honest thing on that machine. If this is you, don't just delete the plist and run a scan. Copy off your documents (not apps, plugins or Library folders), wipe the Mac, and from a clean device rotate every password, token and session that touched it. Quick check on your own Mac: look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for anything you don't recognize.

Doing the math on @elonmusk SpaceX share for every American kid. SPCX around $146 today. Over the next 18 years (when today’s kids are adults): - 15% CAGR: about $1,800 - 20% CAGR: about $3,900 - 25% CAGR: about $8,100 At a $50T market cap that’s about $3,700 per share and at a $100T market cap about $7,400 per share. One share today could be worth thousands (or far more) by the time recipients turn 18.

Ignorance is bliss.

Burning the historic town hall in Limoges to protest the high cost of living is peak self-sabotage. Rebuilding it will be paid for by the same taxpayers already struggling with prices and strained services. Destruction does not lower costs. It raises them.

Second wallet maker in two days whose own app notifications were used to phish seed phrases. SecuX, now NGRAVE. The lure: your wallet just synced on a Pixel 9 in Moscow. Fear first, then a box for your 24 words. The only time you type your seed is when you chose to restore a wallet. Never because an alert told you to.

Attackers abused ConnectWise Cloud Backup (formerly SkyKick) to pivot into customers' Microsoft 365 environments. If you or your MSP use it, audit every enterprise app and consent grant in Entra today and pull anything you didn't approve. Your vendor's access is your attack surface.

Per FLHSMV, one Plant City police user's credentials, stored on a personal device, were enough. Floridians: stay vigilant for phishing emails, texts and calls, especially ones posing as government officials or pushing an urgent, fear-driven call to action.