Javvad Malik

Threat rankings ... everyone plays the flashy threay while a misconfigured bucket quietly leaked all the data. https://www.bleepingcomputer.com/news/security/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest/

When a cyber incident forces a hospital to divert ambulances, that's not an IT problem anymore. https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident

Brotli was fixed in February. It became a security bug in October. Microsoft is now rushing out.NET updates. #cybersecurity #infosec #dotnet #patching #Brotli theregister.com/security/2026/10/26/mic…

A CVSS score can be a useful starting point, but never the whole story. https://cybersec.picussecurity.com/s/php2shell-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained-30158

Dreamhost is resetting passwords. Standard procedure during an incident. New locks get fitted, and nobody asks where the old key went. https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/

Ukraine's drones got throttled with no notice. It's like buying a car whose maker can cap your top speed remotely, then arguing about who wrote the small print. https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse

Fake screenshots, $36.9 million, and a very busy launderer. At least the prison sentence is guaranteed to grow. #cybersecurity #scam #cryptoscam #infosec #securityawareness therecord.media/dutch-police-extradite-…

Breach of Confidence: 26 October 2026 Hello, Anil Dash wrote a lovely piece on installing apps on a Commodore 64 this week. I had a ZX Spectrum 128k, where installing anything meant twenty minutes of tape hiss, a prayer, and a volume knob set entirely by feel. It was still more reliable than most…

Securing AI coding agents is flat-pack furniture: four levels, two tracks, and a bag of screws. https://api.cyfluencer.com/s/four-levels-for-architecting-security-into-the-agentic-sdlc-30143

Two arrested in the Netherlands after over $400,000 vanished in a new kind of bank helpdesk fraud. Customer service has never been this efficient. #cybersecurity #scam #infosec #NFC #bankfraud securityweek.com/dutch-police-arrest-tw…

Newer isn't better. A decade-old CNN beat frontier LLMs at skin cancer diagnosis. https://lynchlab.net/llm-skin-cancer

Agents.md in downloads is apparently all it takes to turn you AI rogue. https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/

Does a website hosting mainly static content need runtime? Andrew with a write up on his personal journey with wordpress and php https://blog.infosanity.co.uk/2026/10/emergency-exit-from-wordpress/

Bluetooth isn't short range... all you need is to bolt a dish antenna on, tune the receiver to hear a whisper, and you can get to over 7 miles! https://hackaday.com/2026/10/24/pushing-bluetooth-out-to-12-kilometers/

Code does exactly what you think, which is the problem. It faithfully executes the muddle in your head and calls it a feature. Writing is where you find out your thinki... https://danielmiessler.com/blog/writing-is-closer-to-thought-than-code?utm_source=rss&utm_medium=feed&utm_campaign=website

Upgrading PHP is the easy part. After that you get to find out which of the forty keys in the drawer still open anything. One of them fits a shed. Nobody remember... https://cybersec.gitguardian.com/s/responding-to-php2shell-php-vulnerability-when-you-don-t-know-what-secrets-are-deployed-30109

Every agent demo dies on the second question, when it re-reads everything like a student who lost their notes. https://api.cyfluencer.com/s/harness-your-mechs-what-to-build-what-to-buy-when-you-bring-ai-into-appsec-30108

Fable 5.1 tops our security league: 37.4% SecPass, no retries. Opus 5 is the plumber who rebrands the same leak as a subscription. Fewer confirmed cheats too: 17 vs 38. https://api.cyfluencer.com/s/fable-5-1-takes-the-top-spot-faster-than-opus-5-cheaper-and-cleaner-30105

The BBC's cyber correspondent admitted he didn't know PHP existed until the day before he went on air, and the security industry piled on. A correspondent's job is to report and explain, not to know every technical detail. Mocking people for admitting what they don't know drives away the people…

eMudhra's private key was 4. Now it's quit certificates — 1% of revenue, no apology. Hard to sell locks when customers keep complaining the doors don't lock. https://www.theregister.com/security/2026/10/22/disgraced-indian-cert-issuer-leaves-the-cert-issuing-business/5304848

11.7 million email addresses exposed, from the company that made Resident Evil. Life imitates survival horror. #Capcom #DataBreach #Cybersecurity #ResidentEvil #InfoSec bleepingcomputer.com/news/security/capc…

Job hunting is so brutal people will happily hand over credentials to anyone who promises an interview. https://blog.knowbe4.com/warning-calendly-phishing-pages-are-targeting-job-seekers

11,000 cybercrime networks in Africa disrupted.. hopefully that will make a dent for a while. https://www.bleepingcomputer.com/news/security/authorities-disrupt-nearly-11-000-cybercrime-networks-in-africa/

Paying a cleaning fee to do the cleaning. Airbnb finally calls time on guest chores from November 20th. #Airbnb #Travel #Cynicism #Chores #SecurityLifeCynicism nbcnews.com/news/us-news/airbnb-hosts-c…

With a bit of time, you too can read a QR code by hand! https://hackaday.com/2026/10/21/reading-qr-codes-by-hand/

Least privilege is for people without a board of directors. Zuckerberg can sell Meta shares to pay a tax bill and keep control. Sell the Monopoly hotels, keep running the board. Even the banker needs your permis... https://www.bbc.co.uk/news/articles/cky83vwnyglno?at_medium=RSS&at_campaign=rss

Goigle hardens chrome against clickfix attacks! https://www.securityweek.com/google-hardens-chrome-against-clickfix-attacks-insecure-http-connections/

Is banning DeepSeek over where its servers sit is the wrong argument when the open weights run on any machine you like??? https://www.securityweek.com/china-defends-deepseek-after-us-ban-of-its-ai-from-government-systems/

Japan's Onamae Desktop Cloud up to 27,000 servers breached https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/

Averages are where data centres go to hide. Globally they're about 1.5% of electricity, which sounds lovely. Try telling a Texan whose well has run dry that the national figure is reassuring. https://blog.knowbe4.com/ai-data-centers-environmental-disaster-or-groundbreaking-innovation

The name SafePay is a fine bit of branding, in the way a locksmith naming his van Burglary Protection Ltd is fine branding. https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/

Your AI agent is not the new intern. It is a contractor with a full set of your house keys, reading every note left on the doorstep, and it acts before you finish your coffee. https://cybersec.gitguardian.com/s/ai-agent-security-six-controls-from-nine-real-incidents-30081

Two critical PHP flaws, nearly 70 percent of websites needing updates, and an AI helped turn a decades-old bug into an exploit. Patch today. #PHP #CyberSecurity #InfoSec #Vulnerability #WordPress krebsonsecurity.com/2026/10/widespread-…

60 million certificates issued, and one private key was just... 4. Digital trust, everyone. #cybersecurity #infosec #eMudhra #security #cynicism theregister.com/security/2026/10/20/ind…

The skills gap was never what kept us safe. The 2016 Uber crooks ran out of time with 100,000 working credentials on their spreadsheet. Today's would-be villain types "fetch credit cards" into an AI agent and goes o... https://www.defendersinitiative.com/p/the-script-kiddy-bar-has-been-lowered

What a nostalgic recount... loved this article, even if i did have a zx spectrum 128k! Installing programs was half the battle! https://anildash.com/2026/10/08/install-an-app-commodore-64/

The most valuable member of this crew never touched a bank account. He was a medical records contractor for the US Army, which made him the upstream supplier. The man in the Philippines was ju... https://cyberscoop.com/identity-theft-fraud-military-servicemembers-veterans-guilty-robert-boling/

A test account, twelve years old, protected by Password1. Somebody finally sat the exam. The ICO issued a reprimand, but no fine. #CyberSecurity #Ransomware #Passwords #DataBreach #InfoSec infosecurity-magazine.com/news/children…

The OVHcloud's breach was from compromising a developer's GitHub login and swapped the binaries on shelves that were never sealed. https://www.securityweek.com/hijacked-developer-account-used-to-plant-stealer-in-ovhcloud-cli/

WhatsApp won the case but lost the battle. Judge ruled they didn't provide enough evidence of NSO violating the injunction because they refused to show their detection methods. Can't expose the spy without... https://therecord.media/whatsapp-denied-appeal-alleged-nso-group-violation-injunction

A ban that took effect in July, announced in October, with no security concerns detailed. Efficient. #DeepSeek #AI #CyberSecurity #InfoSec #Cynicism bbc.co.uk/news/articles/cjkgeq0k1wevo

The person reusing a password is not the weakest link. The policy demanding 120 unique ones, rotated every 90 days, is. https://blog.knowbe4.com/100-passwords-one-brain-stop-asking-humans-to-behave-like-machines

Plex servers are being exploited in the wild to deliver crypto miners and proxy software, and the attackers were quick off the mark. Patch fast, or your film server gets a second job. #Plex #Cybersecurity #Infosec #Plex2Shell #SecurityAwareness securityweek.com/plex2shell-exploit-cha…

One credential, four months of undetected access, 5.7 million students. ETS didn't notice until September. The file transfer site is now offline. Two years of free credit monitoring awaits. https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/

KYC nice in theory... a forger now sells identity packs with a money-back guarantee and a selfie that passes the liveness check. Professional, if nothing else. https://www.bleepingcomputer.com/news/security/inside-the-underground-market-for-know-your-client-services/

The UK Electoral Commission wants to flag deepfakes to candidates within three hours. The laws behind it? 1983 or 2000. #deepfakes #elections #AI #cybersecurity #infosec securityaffairs.com/201307/uncategorize…

Switching everything off is not incident response. It is a bank shutting every branch because someone copied a teller's badge. https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758

Meta's opt-out for AI scraping of your business website? Stop using Meta. That's not consent, that's the school bully taking your lunch and asking why you're in the canteen. Stay secure, my friends. #Meta #AI #DataPrivacy #CyberSecurity #InfoSec securityaffairs.com/201300/ai/meta-want…