Fran Donoso

Hey new folks, welcome to BlueSky! My name is Fran and I run the following #cybersecurity feed: bsky.app/profile/did:... I'll be working keep it spam free & good. If you're curious here are the keywords I'm looking for: gist.github.com/francisck/d8... Please provide feedback if you have any.

The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.

I had to read the sentence "Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237" several times, because despite knowing @dangoodin.bsky.social superior attention to detail, my brain was *certain* that could not be correct.

🚨 Rapid Response: Critical AnyDesk Linux RCE (CVE-2026-109390, CVSS 9.8). Public exploit available. Censys detects 175,838 Internet-exposed AnyDesk hosts on TCP 7070 (not confirmed vulnerable). Censys ARC advisory: https://bit.ly/47jqCEh

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

Here we go. Free, no-reg versions of favorite stories from my four years at the Washington Post. First, three pieces from our Pulitzer-finalist series on how India's ruling party coerced U.S. tech giants into violating their own policies. www.washingtonpost.com/world/2023/0...

OpenAI disrupted new malicious use of ChatGPT... mostly for romance scams and info-ops openai.com/index/disrup...

Cisco said there are no workarounds for the vulnerability and urged customers to apply available patches immediately. The company also recommended reviewing system logs, validating controller integrity, and implementing additional hardening measures where possible. www.csoonline.com/article/4137...

patch ye MongoDB, there's an exploit for a vuln which has been in the product for over a decade that allows the remote, unauth read of any memory - which includes plaintext creds. Somebody posted an exploit on Christmas Day, Merry Christmas! doublepulsar.com/merry-christ...

HARDEN YO' N8N - [CVSS 10.0 RCE] Remote Code Execution via Expression Injection m.cje.io/4qhl2JX cc: @networkchuck @danielmiessler @jhaddix

I may have gone overboard on the Halloween goodies this year #halloween

Plex was hacked. It included usernames, emails, and hashed passwords. Change your passwords when you can,

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/7

SentinelOne and Beazley Security have discovered a new Windows infostealer used in the wild named PXA Stealer, most likely the work of a Vietnamese-speaking cybercrime group. www.sentinelone.com/labs/ghost-i... labs.beazley.security/articles/gho...

I mean I’ve been urging people to toss their sonicwall devices into a shredder for years now 🤷🏻‍♂️

Our team collaborated with our friends at @sentinellabs.bsky.social to identify and disrupt a PXA infostealer campaign that has an intricate and complex delivery chain: labs.beazley.security/articles/gho... Thanks for the fantastic collab SentinelLabs team!

👀 Update from @threatintel.microsoft.com: 'our continued monitoring of exploitation activity by Storm-2603 leading to the deployment of Warlock ransomware' www.microsoft.com/en-us/securi... #Microsoft #SharePoint #cybersecurity #ransomware @gate15.bsky.social @ransomwaresommelier.com @ecrime.ch

We’re actively seeing this exploitation as well. Here is my team’s advisory on this vulnerability: labs.beazley.security/advisories/B... Is your have a publicly exposed SharePoint server, its probably already compromised so get ready to do some IR.

🩸& #threatintel | We (GreyNoise) just published a quick note (www.greynoise.io/blo...) regarding CVE-2025-5777 - CitrixBleed 2 1/2

Two high-severity patches are coming to Node.js on Tuesday nodejs.org/en/blog/vuln...

Context: labs.watchtowr.com/pre-auth-sql...

Worth turning on if you have AT&T. Other carriers (like T-mobile) have similar programs.

Need something positive to do in your life this week? If you don’t have a library card, go get one. Then learn about all the awesome things your local public library has to offer.

This is related to ROP code exec on switch 2

New, by me: Data broker giant LexisNexis has revealed that its risk solutions unit (think "know your customer," risk assessing, due diligence, and law enforcement assistance) was breached, affecting the personal data and Social Security numbers of at least 364,000 people.

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections. My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees. Here’s what I found and why it matters 👉 wietze.github.io/blog/bypassi...

Ubiquiti has released a security update for UniFi Protect Cameras to fix an RCE vulnerability with a severity score of 10/10 Oh boy... community.ui.com/releases/Sec...

🧙 Want to join the team? 🧙 We’re on the hunt for volunteer DFIR analysts—with potential for paid opportunities! You’ll get a set of artifacts and a limited time to show us what you’ve got. 🔎 Follow us on socials—details drop soon!

Wrote up something about Techdirt's recent coverage, and why (whether we like it or not) we need to be a "democracy blog" now, rather than just a "tech" blog (not that we've ever been just a tech blog). This story is *the* story and it impacts everything else. www.techdirt.com/2025/03/04/w...

China's Salt Typhoon hackers are still breaching telecom networks worldwide, including two in the US in Dec-Jan, says Recorded Future. Lately they're exploiting Cisco devices with unpatched 2023 bugs and seem undeterred by high profile exposure and sanctions. www.wired.com/story/chinas...