What better way to kick off the New Year than an episode of @DarknetDiaries with @JackRhysider? In this episode I absolutely unload on #RomanceScams, #PigButchering, and the true horrors of this crime. It's (literally) a bloody mess. darknetdiaries.com/episode/1…

PHP2Shell patch is out for PHP 8.2 to 8.5 only. 8.1 and older: no fix. Patch now, add a WAF rule for the rest, and alert on php-fpm/apache spawning shells. api.cyfluencer.com/s/mitigat…

LOLLLLLL

PHP2Shell: two critical PHP RCE flaws, CVSS 9.2. Everyone needs to patch now. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Internet-facing first. On 8.1 or older? No fix announced, so put it behind a WAF or off the internet. api.cyfluencer.com/s/php2she…

Supply chain attacks now go after the credentials on developer machines and CI/CD runners: GitHub tokens, cloud keys, SSH keys, publishing creds. GitGuardian's report covers the chain and the response. cybersec.gitguardian.com/s/w…

Nine real AI agent incidents, one pattern. The injected instruction opens the door, the credential is the prize. GitGuardian's six controls limit the blast radius, though none stop prompt injection itself. cybersec.gitguardian.com/s/a…

GitGuardian found GhostAction victims were also hit by separate cryptomining campaigns. Rotating the exfiltrated secrets isn't enough. Revoke the GitHub credential that let the attacker in. cybersec.gitguardian.com/s/t…

That flicker of "something's off" usually fires before your conscious brain finishes the sentence. Your intuition is pattern matching faster than logic can. Learn to trust the flicker: youtu.be/2dqMl03Zrwk

The FBI now calls people mid-scam to pull them out. 10,406 contacted, 77% had no clue. Trouble is, that is also exactly what the impersonation scam looks like. Here is how to tell: antiscam.education/blog/the-…

Awareness Month kit: ready-made posts, videos and PDFs, 3x a week for 4 weeks. AI tools, family safety, real life scams, wire fraud. Scams and wire fraud weeks are where I'd start. api.cyfluencer.com/s/cyber-s…

Prompt injection is social engineering for LLMs: malicious instructions hidden in inputs hijack what the model does next. Miggo's short video on why what goes in matters as much as what comes out. api.cyfluencer.com/s/prompt-…

474 of 4,802 leaked GitHub App private keys still authenticate. 44 Apps had org admin. App keys never expire, so a forgotten commit from years ago is still an open door. GitGuardian's writeup is worth a read. cybersec.gitguardian.com/s/g…

1,809 complaints. $140M lost. FBI's data shows international students and foreign nationals get hit hardest by jury duty scams, exactly when they're least sure how the US system works. antiscam.education/blog/jury… #FraudPrevention

Crypto scams don't need a technical exploit. Urgency and confusion do the work. If a message is pushing you to move fast, that's the tell, not the opportunity. Broke down the patterns here: youtu.be/Zmax77Gs6mY #cryptoscams

The tell in the jury duty scam nobody catches in the moment: the caller keeps you on the phone while you drive to pay. No real court does that. It exists to stop you calling your kid, your lawyer, or the courthouse. antiscam.education/blog/jury… #FraudPrevention

The "ask for video" trick died. FBI's new PSA: scammers use real time AI to fake cops and officials on video calls. Badge, uniform, backdrop, all generated. New rule: hang up, find the number yourself, call back. antiscam.education/blog/jury… #ScamAwareness

IDScan breach: 153M ID images (licenses, passports, med cards) now for sale on the dark web. Possessing an ID isn't proving one, and service desks keep treating it like it is. api.cyfluencer.com/s/idscan-…

Mini Shai-Hulud is back. New wave hit keyv and 800+ npm packages, now scanning 469 locations for secrets, including Cursor, Gemini, crypto wallets, and CI/CD creds. Infection chain breakdown: cybersec.gitguardian.com/s/m…

Fed a threat actor fake W-2s with real-structure SSNs once. It worked so well the IRS called, confused where I'd gotten them. Making a criminal's own data untrustworthy is an underrated disruption tactic. Story plus a Labor Day fraud warning: youtube.com/watch?v=xdwaoTDZ…