Joona kokkola

Uh oh… PSA if you're running anything on PHP

Every version since php 5. Latest is version 8.5.11. So tomorrow is going to make today’s PKI mess look like a walk in the park.

learn.microsoft.com/en-us/answer...

The hackers who stole Denmark's citizens' data accessed the database via an account using the 123456 password politiken.dk/danmark/art1...

Post-quantum cryptography readiness goes beyond protecting encrypted data. Authentication systems must evolve, too, and organizations should start preparing now. msft.it/63322aUwiY

STANDARD TICKETS ARE COMING! Hold your ticket-buying bots for a little while longer (or better yet, buy your ticket like a regular person and keep it fair). 29.10. / 19:00 EET And that’s not your only chance. Ticket raffle details coming later. #disobey2027

Microsoft Digital Defense Report 2026 www.microsoft.com/en-us/corpor... #security #cybersecurity

Storm-2945, a sub-cluster of Russian state actor Midnight Blizzard, has resumed their CaptiveCrunch campaign. msft.it/6019aWMDf First reported by Microsoft in July 2026, the campaign uses manipulated network traffic and captive portals in the hospitality sector to gain access to targets.

NSA announced it is accelerating it's PQC timeline 👀 👀 👀 All systems must be PQC hardened by the start of next year All legacy systems that don't support PQC must be phased out by 2030 www.nsa.gov/Press-Room/P...

😡 In the Odesa region, Russians attacked the sea search and rescue tug "Sapphire", - Ministry of Reconstruction The vessel had clear markings in accordance with the requirements of international maritime conventions - SAR (Search and Rescue)

Hacked something? Broke sh*t? Got a side project that got out of hand? The Disobey 2027 CfP is still open. We’re looking for talks of different lengths, up to 45 minutes, and we’d especially love to see more hands-on workshops. Submit by 20 September: cfp.disobey.fi/disobey-2027/

Microsoft developed the Cloud web applications threat matrix to organize relevant techniques across cloud-hosted web applications and serverless platforms using MITRE ATT&CK tactics. msft.it/63323ak5N5

Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins are followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, and cloud data access. msft.it/63324aknMs

The Microsoft Patch Tuesday fixed 974 CVEs We couldn't find 26 more for a round number? Seriously? msrc.microsoft.com/update-guide...

📉 Russian stock market Ozon… -25% 👀

New powerdul Chinese open source model GLM-5.3 refined to have powerful cybersecurity/cyberattack capability. They claim that the oldest found cybersecurity bug is 45 years old, from 1981. z.ai/blog/glm-5.3

Cloud Security Alliance's Top Threats to #Cloud Computing 2026 cloudsecurityalliance.org/artifacts/to...

In an update, CERT Poland says the Russian data wiper attack that targeted a power plant last December also targeted a previously unreported second plant cert.pl/en/posts/202...

On August 2, 2026, the financially motivated cybercriminal actor tracked by Microsoft Threat Intelligence as Storm-1175 began deploying a new ransomware strain called StormEncryptor.

ENISA Secure by Design and Default Playbook got published. www.enisa.europa.eu/sites/defaul... It’s a practical guide to secure by design and default principles for SMEs. I am happy to share that I am one of its contributors. #threatmodeling #securebydesign #enisa #security

Microsoft has published an in-depth technical analysis of the supply chain attack known as "ChainDrop" affecting hundreds of packages and delivering a self-propagating credential-stealing worm. Read our blog for mitigation, detection, and hunting guidance: msft.it/63322aDU0s

Microsoft Threat Intelligence is tracking active Mini Shai-Hulud npm supply chain attacks in which a threat actor compromised trusted maintainer accounts to distribute credential-stealing malware.

We (Chrome) published a big paper about security work that's important to share. It shouldn’t surprise anyone that open source software is getting hammered by AI, and people are looking for bugs: for bounties, for hacking purposes, and to help, more than ever before. blog.google/security/chr...

Anthropic says Mythos figured out how to weaken a post-quantum cryptography algorithm being considered for standardization and break a weakened version of the widely used AES standard. www.anthropic.com/research/dis...

Make that 30+ now: mn.gov/mnit/media/b...

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test. www.wired.com/story/openai...

The experiment escaped the lab. OpenAI's models broke containment and breached Hugging Face. We are holding radium in our bare hands. What governments and organizations should do next, and why tighter commercial guardrails are exactly the wrong move: www.lutasecurity.com/post/openfac...

Oracle patched 1,449 vulnerabilities in the July quarterly security patches Dear lord... www.oracle.com/security-ale...

OpenAI takes credit for the Hugging Face breach last week The company says that some of its models, including a pre-release one, escaped their testing sandboxes during a test evaluation and then... just hacked Hugging Face's package repo 🤣 openai.com/index/huggin...

Save the date: ✨️19.-20.2.2027✨️ #disobey2027

www.bleepingcomputer.com/news/microso...

"Security fundamentals will not change, but new #AI models are compressing the entire attack lifecycle, in ways that stress-test these fundamentals, forcing defenders, manufacturers and service providers to accelerate their #cybersecurity initiatives." www.enisa.europa.eu/publications...

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

Amid concerns about AI models’ cybersecurity capabilities, OpenAI revealed an improved version of GPT-5.5-Cyber and its “Patch the Plant” initiative to fix open source software bugs.

Microsoft attributes the Mastra npm supply chain compromise to Sapphire Sleet, a North Korean actor that primarily targets the financial sector. Microsoft has observed use of known Sapphire Sleet infrastructure, malware, and tactics following compromise. msft.it/63320vmpSC

"The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national" www.anthropic.com/news/fable-m... #AI

Microsoft just dropped the biggest Patch Tuesday in 23 years. https://www.malwarebytes.com/blog/bugs/2026/06/microsofts-biggest-ever-patch-tuesday-fixes-206-bugs-including-3-zero-days?utm_campaign=brandsocial&utm_medium=social&utm_source=bluesky

India's CERT issued a super-strict patching guideline, with patch times for actively exploited bugs of 12h or 24h, depending on the software's location on a network (internet or internal-facing) CERT-IN cited the rise in AI-assisted attacks for the new rules www.cert-in.org.in/s2cMainServl...

Security researchers have bypassed one of Apple's most powerful security features with the help of the Mythos cybersecurity AI model -works on macOS on M5 chips -bypasses Memory Integrity Enforcement (MIE), added last Sept -privately reported last week -no patches yet blog.calif.io/p/first-publ...

At my last job, the rote and routine tasks that AI might have automated were parts of the day I enjoyed. They allowed my mind to slow and collect itself for the non-routine, un-automatable work. Eliminating these "breaks" is a one-way ticket to burnout. Leaders pushing for that are shortsighted.

bugflation.com

Oracle switches to a monthly release for security updates blogs.oracle.com/security/acc...

‼️ Russian Railways April 2026 Loading Update Thread Things look…weird. Note: Full data tables are provided in the thread.

Welcome to the space age of cybersecurity. “AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” www.anthropic.com/glasswing

N days, logic bugs, exploit chains that defeat friction-based exploit mitigations — your time has come. @anthropic.com #mythos changed the defender’s calculus overnight. Glad project #glasswing is attempting the biggest multiparty vuln coordination of the century red.anthropic.com/2026/mythos-...

FBI's yearly cybercrime report is out Cybercrime losses passed $20b last year PDF: www.ic3.gov/AnnualReport...

The Qilin ransomware group appears to be running the most powerful EDR killer available today, with the capability to terminate over 300 different EDR drivers from almost every vendor in the market blog.talosintelligence.com/qilin-edr-ki...

CISA tells US orgs to implement Microsoft's recent Intune-hardening guide to prevent a repeat of the Stryker attacks www.cisa.gov/news-events/... techcommunity.microsoft.com/blog/intunec...

Töitä kahdelle kesämestarille @csc.fi turvallisuusryhmässä. https://cscfi.recruitee.com/o/turvallisuuskoordinaattori