🔐 STOP OVERCOMPLICATING YOUR SECURITY. THESE 17 STEPS ARE FREE. Good news: no new device, no subscription. Bad news: nobody is going to do it for you. Start with this test. Your laptop and phone get stolen tonight. Locked: do you still have access to everything? Unlocked: could someone empty your wallets in two clicks? Malware on your computer is the unlocked scenario. Habits • Auto-updates on everything, and don't postpone the Chrome update. • Urgent message? Do nothing. Open the official app or call back yourself. Urgency is the scammer's main tool. • Never enter your seed after an email, call or letter. After every big hack, fake "your seed is compromised" letters show up, sometimes by post. • Never paste a command someone sends you into your terminal. Classic one on video calls: "I can't hear you, run this to fix Zoom." Computer • Full-disk encryption: FileVault (Mac), BitLocker (Windows), LUKS (Linux). • Firewall on. On Mac, I use LuLu and BlockBlock, free and open source. • Turn on Lockdown Mode on your iPhone and Mac. • No hot wallet on your computer. It's a matter of time. • Passwords only in a password manager (KeePassXC is free), never in the browser or in cleartext. Browser passwords are the first thing malware grabs. Accounts • Bookmark the login pages you use and only log in from there. The top Google result is often a sponsored ad, and fake ads are a favorite phishing trick. • 2FA everywhere, starting with your password manager. • Remove your phone number from 2FA and recovery. SIM swaps still drain people. Seed • Never digital: no notes, photos, cloud or password manager. I still find seeds in password managers way too often. • Split it across 3 papers: words 1-16, 9-24, and 1-8 + 17-24. Any 2 rebuild it, one alone is useless. Keep them in 3 different places. Real life • Google yourself down to page 5 and request removal of your address. • Don't talk about your holdings. Some attackers assume "in crypto" means millionaire. • Keep a small decoy wallet. If someone threatens you, give it. Your life comes first. Anyone who contacts you first offering to recover your funds is the second scam.

Everybody rushes to buy YubiKeys after the last attacks. Good, but not enough. A YubiKey protects the login, not what happens after. Infected laptop? Malware steals your session and the attacker gets in, no key needed. YubiKey + EDR. Do not be the easy target.

🚨 27 MAJOR SECURITY INCIDENTS YOU SHOULD KNOW ABOUT From stolen website credentials to poisoned AI tools and critical infrastructure attacks. Here’s what happened: - PHP: A critical flaw put websites at risk, forcing some governments to take sites offline. - eMudhra: Compromised certificate authority keys threatened the trust behind HTTPS. - California: Student records, including disability information, were reportedly stolen. - Railway: Hackers stole customer secrets from a developer hosting platform. - Zeabur: 321,810 accounts reportedly breached. The company is shutting down. - LiteLLM: A malicious update turned a widely used AI tool into a password stealer. - GitLab: A maximum-severity vulnerability affected versions dating back to 2014. - Cairn: An AI-powered hacking tool was reportedly used against 100+ companies. - Ahold Delhaize: A cyberattack disrupted the retail giant behind Food Lion and Stop & Shop. - Onamae: Malware reportedly reached up to 26,739 customer servers. - Signal: A bug could leave your microphone and camera active after a call. - NGINX: Three critical vulnerabilities threatened infrastructure powering a huge share of the web. - HTTP/3: A single connection could crash multiple types of web servers. - Plex: Attackers targeted home media servers. - SafePay: The FBI warned of attacks affecting 600+ critical infrastructure organizations. - Palo Alto: Ransomware gangs targeted organizations through firewall vulnerabilities. - Bullhorn: A platform serving 10,000+ companies suffered a major outage. - Medi-Cal: Data belonging to 970,000 patients was reportedly stolen. - WordPress: Stolen plugin developer credentials enabled backdoor distribution. - AOMEI: A compromised update server reportedly distributed a backdoor. - Meta Muse: An AI agent exposed sensitive personal and business information. - Tor: 333 relays were reportedly hijacked to steal login credentials. - TiDB Cloud: A cloud database provider suffered a security breach. - State Bank of India: India’s largest bank confirmed a data breach. - OVHcloud: A password stealer was reportedly embedded in an official tool. - Siemens: A software vulnerability was exploited to distribute malware. - North Korea: State-linked hackers launched a new campaign against South Korea. The common thread? Your website, cloud provider, AI tools, browser, or trusted software can become the attacker’s entry point. Security isn’t just about your code. It’s about everything you trust. Follow @opsek_io if you want to improve your security, or just try to do your best

🚨 CRITICAL PHP SECURITY ALERT 2 critical vulnerabilities rated 9.2/10. PHP is expected to release the fixes today. How bad is it? The vulnerabilities may affect PHP versions from PHP 5 onwards, including PHP 7 and PHP 8. PHP powers WordPress and millions of other websites, so this could affect a massive number of servers. The impact could include remote code execution, data theft or a full server compromise. What you should do TODAY: Update PHP as soon as the fix is available. Check with your hosting provider if you don’t manage your own server. Don’t assume updating WordPress plugins will fix a vulnerable PHP version. Official announcement: php.net/archive/2026.php