Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

Catalin Cimpanu

@campuscodi.risky.biz
14K followers 499 following 5.5K posts

☆ Cybersecurity reporter ★ Newsletters at Risky Business #infosec #cybersecurity risky.biz

PostsRepliesMedia
Catalin Cimpanu @campuscodi.risky.biz · 1h
-ARMORY CASTLE abuses BeyondTrust zero-day -SiteGuard WAF bug abused in the wild -Apache Airflow failed host key verifications -TP-Link Tapo camera takeover bugs -Big Fish vulnerability impacts all FreeBSD releases -PostgreSQL RCE -PhantomBuffer technique -BalCCon 2026 videos
040 4
Catalin Cimpanu @campuscodi.risky.biz · 1h
-Scammers return to scam centers after arrests in Timor-Leste -SMS blaster squad arrested in Manila -Yahoo Boys adopt AI tools -Malware in Rank Math SEO WordPress plugin -TAG-217 targets South Korean banks -New malware: QuartzLine, HypeAgent, Romulus -CL-UNK-1211 adopts AI tools
141 4
Catalin Cimpanu @campuscodi.risky.biz · 1h
-PyPI adds email reputation checking -RubyGems adds package security warnings -MEPs targeted by deepfake porn -Romania kept buying Kaspersky despite ban -Server seizure scandal in the Netherlands -Drone strikes hit VK data centers -Arrested Qilin member linked to Synnovis hack
120 2
Catalin Cimpanu @campuscodi.risky.biz · 1h
-Gamdom hacked for $4.2m -Pirate Chain hacked for $10m -Hackers breach VPS provider FirstVDS -Edge rolls out silent security updates -Meta admits it throttled Lula accounts -Meta takes down No Kings account -TikTok bans Musk documentary account -GitHub expands malware advisories to eight services
120 2
Catalin Cimpanu @campuscodi.risky.biz · 1h
-Cyberattack hits Romania's stock market agency -Cali DoE breach impacts 7m California students -Burger King Japan hack impacts 11.2m customers -South Korea fires employee who sold patient data -AI agents hacked Indian sites -Ukrainian hacktivist deface school testing system
120 2
Catalin Cimpanu @campuscodi.risky.biz · 1h
-PwnEscape vulnerability lets you escape KVM -Supply chain incidents at AOMEI and ConnectWise -Intel discontinues SGX -US infosec job postings fell by 25% -OpenCode abused for distillation attacks -Cyberattack impacts US bankruptcy courts N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS622/
194 9
Reposted by Catalin Cimpanu
Anne Applebaum @anneapplebaum.wsocial.eu · 16h
Worth noting this, in light of Meta's temporary ban on the 'No Kings' Instagram account
512601802 2.6K
Catalin Cimpanu @campuscodi.risky.biz · 15h
GitHub has expanded its Malware Advisories database to cover eight package repositories. Starting last week, the database also includes warnings for malicious packages on PyPI, Maven, RubyGems, NuGet, Go, Rust Crates, and PHP Composer... on top of npm openssf.org/blog/2026/10...
01813 18
Catalin Cimpanu @campuscodi.risky.biz · 16h
More than 80 Romanian government institutions kept buying Kaspersky security software even after the government banned it in March 2023. According to Romanian journalists, buyers include city halls, hospitals, schools, and even a military and NATO research institute publicrecord.ro/2026/10/16/a...
publicrecord.ro
Statul a interzis antiviruși rusești, dar a continuat să îi cumpere  - Public Record
Din martie 2023, instituțiile din România nu mai au voie să cumpere sau să folosească produse dezvoltate de compania Kaspersky, după o lege emisă în Statul a interzis antiviruși rusești, dar a continu...
1134 13
Reposted by Catalin Cimpanu
Dr Heidy Khlaaf (هايدي خلاف) @heidykhlaaf.bsky.social · 18/10/2026
We warned about this exact scenario last year: That AI companies will situate themselves as the arbiters of life or death, taking over the arbitration of risk determinations and subverting democratic processes. All through the co-option of safety engineering terminology.
Risk thresholds provide a measure of the level of risk exposure that a society or individual is willing to withstand, ultimately shaping how we determine the safety of technological systems. Against the backdrop of the Cold War, the first risk analyses, such as those devised for nuclear systems, cemented societally accepted risk thresholds against which safety-critical and defense systems are now evaluated. But today, the appropriate risk tolerances for AI systems have yet to be agreed on by global governing efforts, despite the need for democratic deliberation regarding the acceptable levels of harm to human life. Absent such AI risk thresholds, AI technologists-primarily industry labs, as well as "AI safety" focused organizations-have instead advocated for risk tolerances skewed by a purported AI arms race and speculative "existential" risks, taking over the arbitration of risk determinations with life-or-death consequences, subverting democratic processes.
In this paper, we demonstrate how such approaches have allowed AI technologists to engage in "safety revisionism," substituting traditional safety methods and terminology with ill-defined alternatives that vie for the accelerated adoption of military AI uses at the cost of lowered safety and security thresholds. We explore how the current trajectory for AI risk determination and evaluation for foundation model use within national security is poised for a race to the bottom, to the detriment of the US's national security interests. Safety-critical and defense systems must comply with assurance frameworks that are aligned with established risk thresholds, and foundation models are no exception. As such, development of evaluation frameworks for AI-based military systems must preserve the safety and security of US critical and defense infrastructure, and remain in alignment with international humanitarian law.
9355163 355
Catalin Cimpanu @campuscodi.risky.biz · 21h
Hackers backdoored backup provider AOMEI in a novel, first-of-its-kind supply chain attack. Hackers replaced backup software on the company's servers in short bursts of five to ten minutes. The bursts took place across multiple windows between May and July. cloud.google.com/blog/topics/...
02411 24
Catalin Cimpanu @campuscodi.risky.biz · 23h
The Python Software Foundation has rolled out email reputation checks for all new PyPI accounts The measure specifically targets disposable email providers It also restored the ability to register PyPI accounts with Outlook and Hotmail domains, blocked in 2024 blog.pypi.org/posts/2026-1...
blog.pypi.org
Checking email reputation, and allowing Outlook again - The Python Package Index Blog
PyPI now checks the reputation of new email addresses during registration, and accepts outlook.com and hotmail.com addresses again.
051 5
Catalin Cimpanu @campuscodi.risky.biz · 18/10/2026
A cyberattack has hit Romania's Central Depositary, the agency that handles Romania's stock market transactions. The attack targeted the agency's online user portal and stole data on all registered users. www.economica.net/ultima-ora-a...
economica.net
UPDATE - Atac informatic la Depozitarul Central, organism esențial pentru Bursă. Aplicația Depozitarului, unde sunt inclusiv datele "cuponarilor", blocată. Ce trebuie să facă investitorii, ceilalți ut...
Depozitarul Central, entitatea prin intermediul căreia se realizează toate tranzacțiile la Bursa de Valori București(BVB) și care administrează toate datele privind tranzacțiile și contractele, a fost...
071 7
Catalin Cimpanu @campuscodi.risky.biz · 18/10/2026
First Brazil.... now the US... Meta's not hiding it anymore
2204 20
Reposted by Catalin Cimpanu
Joe Slowik @pylos.co · 16/10/2026
“ShinyHunters” is the new “Anonymous” - FFS everyone just jumping on that “brand” now
4253 25
Reposted by Catalin Cimpanu
Molly White @molly.wiki · 16/10/2026
Nice to see Tesla reclaiming from OceanGate the cutting edge of new and embarrassing ways for the very rich to kill themselves.
311103155 1.1K
Reposted by Catalin Cimpanu
Dmitry Grozoubinski @explaintrade.com · 17/10/2026
The Lindsey Graham Act would have imposed significant new sanctions on Russia from 18 October, but allowed the President to issue waivers. He just did. To avoid screaming, I went through every provision explaining them and indicating which he waived. Spoiler: All the ones that did anything.
dmitryopines.substack.com
Explaining the Russian Sanctions Trump just Cancelled
A section by section breakdown of what each provision of the Graham Act would have done, and what Trump waived.
521286550 1.3K
Reposted by Catalin Cimpanu
Ryan Mac 🙃 @rmac.bsky.social · 17/10/2026
On X, users have circulated nonconsenual AI videos created by Grok of a woman they think is Jane Doe. They continue to spread her name. People have praised X for staying relevant for AI and tech conversation. But it also is the main vector for a doxing. That is X. www.nytimes.com/2026/10/16/n...
nytimes.com
When a Social Media Mob Came for Cornell’s Jane Doe
After a former student named seven men in a lawsuit saying they had sexually assaulted her, a movement gained steam online to reveal her identity.
33907273 907
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
German police have detained a Russian man behind the 2024 Synnovis hack www.bbc.com/news/article...
bbc.com
Russian man linked to deadly London hospitals hack arrested
The 28-year-old detained by German police is accused of being part of the cyber-crime gang that hacked blood-test firm Synnovis in 2024.
0153 15
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
You naughty AI, you!
082 8
Reposted by Catalin Cimpanu
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Russia arrests DataSuckers hacking group -Ad company delivered zero-click exploits and spyware -OpenAI employee arrested for planting spy device -US disrupts 40 DPRK laptop farms -Cyberattack halts Danish-German tunnel construction N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS621/
3186 18
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Russia arrests DataSuckers hacking group -Ad company delivered zero-click exploits and spyware -OpenAI employee arrested for planting spy device -US disrupts 40 DPRK laptop farms -Cyberattack halts Danish-German tunnel construction N: news.risky.biz/risky-bullet... P: risky.biz/RBNEWS621/
3186 18
Reposted by Catalin Cimpanu
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Bug exposes Czech business registry data -Hackers leak photos from Netanyahu campaign personnel -Thailand arrests 39 scammers after visa reviews -North Macedonia arrests OLVX admin -Three cybercrime markets disrupted -US seizes crypto scam domains -FTC sues a sextortion assistance provider
141 4
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Bug exposes Czech business registry data -Hackers leak photos from Netanyahu campaign personnel -Thailand arrests 39 scammers after visa reviews -North Macedonia arrests OLVX admin -Three cybercrime markets disrupted -US seizes crypto scam domains -FTC sues a sextortion assistance provider
141 4
Reposted by Catalin Cimpanu
Oleg Shakirov @shakirov2036.bsky.social · 15/10/2026
Antiy tried to map >300 threat actors, but it's super confusing Head Mare, Awaken Likho, Sticky Werewolf, Inception aren't linked to Russia, they target Russia UAC-0020 & WarSunflower aren't linked to Ukraine Noisy Bear was a phishing simulation Etc. www.antiy.cn/research/not...
271 7
Reposted by Catalin Cimpanu
—>realhackhistory.org @bsky.realhackhistory.org · 16/10/2026
Was genuinely curious about DataSuckers, they were hacking Russian and Ukrainian businesses, trashing servers, stealing data and extorting victims. Seems the old hacker adage of not shitting where you eat caught up with them.
1163 16
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-New PEERSTITCH implant, Hirudo Android banking trojan, Aoki infostealer, KGB RAT, CikaBika Bot, Help TDS -Twitter suspends influence operations -Kazakh APT targets all its neighbours -0-days in Cisco SEG, PAN-OS, Nextcloud app -curl RCE -Chrome exploit chain gets $250k -Check Point to leave Russia
030 3
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Spy implants also found in Trezor wallets -Refrigerator attacks expand to two more vendors (Copeland and Dixon) -Danfoss controllers exposure goes down in France -A proxyjacking campaign is underway -Hundreds of malicious packages uploaded on AUR -New Divine Seagull iOS exploitation framework
130 3
Catalin Cimpanu @campuscodi.risky.biz · 16/10/2026
-Aeza is still alive -Swarm of Chinese AI agents detected in the wild -Anthropic adds distillation attack protections -OpenAI sued in eight states -FTC subpoenas AI companies -Let's Encrypt switches to 64-day certs -WhatsApp calls get guest support (yey social engineering!)
120 2
Reposted by Catalin Cimpanu
austin @aparker.io · 16/10/2026
linus dropping truth bombs lore.kernel.org/lkml/CAHk-=w...
lore.kernel.org
LF git repositories
Browse git repositories hosted by the Linux Foundation.
1338568 385
Reposted by Catalin Cimpanu
The Horse Knuckler of Ichabod Crane @horseknuckler.bsky.social · 16/10/2026
It is kinda amazing that Linus became one of the nicer, less weird, guys to come out of the 90s internet. It's like him, and Mr Craig List; everyone else went insane in different ways
3372 37
Reposted by Catalin Cimpanu
Ian Campbell @neurovagrant.bsky.social · 16/10/2026
cannot wait to see how dipshits are going to abuse this asshattery to phish people
083 8
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
A cyberattack has halted construction on a tunnel between Denmark and Germany femern.com/da/presse/ny... www.dk-sundhed.dk/ritzau/1f0b6...
femern.com
Hovedentreprenør på Femern-projektet ramt af cyberhændelse
Vores entreprenør FLC har orienteret os om, at de har været udsat for en cyberhændelse. Vi er i dialog med FLC om situationen, og på nuværende tidspunkt har vi ikke yderligere oplysninger. - siger Jen...
1108 10
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
Thank you Google for crippling ad blockers for the sake of your profits
13111 31
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
Israeli ad company helped a spyware firm target Al Jazeera through online ads Researchers say Discover-Tech used online ads to deliver zero-click spyware, the first public evidence of the technique, with its ads reaching nearly 200,000 websites and apps www.nbcnews.com/tech/securit...
nbcnews.com
Israeli ad company helped a spyware firm target Al Jazeera through online ads, researchers say
Researchers say Discover-Tech used online ads to deliver zero-click spyware, the first public evidence of the technique, with its ads reaching nearly 200,000 websites and apps.
096 9
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
Despite being sanctioned into oblivion by the US, the UK, and others, the Aeza bulletproof hosting provider is still operating under seven new identities www.qurium.org/press-releas...
1104 10
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
And a Palo Alto Networks zero-day too security.paloaltonetworks.com/CVE-2026-0322
security.paloaltonetworks.com
CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root...
030 3
Catalin Cimpanu @campuscodi.risky.biz · 15/10/2026
Looks like Check Point has left the Russian market tass.ru/ekonomika/28...
081 8
Reposted by Catalin Cimpanu
Tom Warren @tomwarren.co.uk · 14/10/2026
Epic is bringing Fortnite to Linux. There’s no timeline on when, but Epic is rebuilding its anti-cheat software so that Fortnite will be playable on Linux www.theverge.com/games/101080...
theverge.com
Epic is bringing Fortnite to Linux
That could include Valve’s SteamOS.
5538 53
Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026
They didn't like Elon's tweets fast enough They had to go
040 4
Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026
Ahsay patches two zero-days spotted last week by Huntress: www.ahsay.com/en/company/a... www.huntress.com/blog/ahsaycb...
ahsay.com
(Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134 | Ahsay Backup
(Update) Critical Security Alert: Immediate Action Required for CVE-2026-105133 and CVE-2026-105134
030 3
Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026
Wow... Twitter suspended some influence operations clusters for the first time in years x.com/GlobalAffair...
x.com
Global Government Affairs (@GlobalAffairs) on X
People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms. Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town...
152 5
Reposted by Catalin Cimpanu
Design | Decorating | Kitchens | Bathrooms | Gardens | www.home… @homesandgardens.com.web.brid.gy · 14/10/2026
homesandgardens.com
Benjamin Moore Unveils Its 2027 Color of the Year – It's a Classic Green That Transcends Fleeting Trends
'Webster Green' is Benjamin Moore's Color of the Year for 2027 – It's a rich, sophisticated dark green with endless appeal
001 1
Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026
And a Cisco Secure Email Gateway zero-day too: sec.cloudapps.cisco.com/security/cen...
180 8
Catalin Cimpanu @campuscodi.risky.biz · 14/10/2026
Nextcloud patches zero-day exploited last month github.com/CollaboraOnl...
github.com
Security issue - Hack · Issue #354 · CollaboraOnline/richdocumentscode
I'm not sure if this is the right place for this report, but anyway. We're hosting a bunch of Nextcloud servers with richdocumentscode aka Collabora Online - Built-in CODE Server. Since yesterday w...
1114 11
Reposted by Catalin Cimpanu
Chi En (Ashley) Shen @ashl3y-shen.bsky.social · 14/10/2026
Read our research: 📖 Cisco Talos blog: blog.talosintelligence.com/break-the-si... 📖 Record Future blog: www.recordedfuture.com/blog/tag193-... 📄 Full Virus Bulletin paper: www.virusbulletin.com/uploads/pdf/...
blog.talosintelligence.com
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources...
032 3
Reposted by Catalin Cimpanu
Julian-Ferdinand Vögele @julianferdinand.bsky.social · 14/10/2026
1/8 Today, @ashl3y-shen.bsky.social from Cisco Talos and I are publishing “Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure,” a report on cyber espionage across Central Asia / wider CIS that we presented today at @virusbtn.bsky.social: www.recordedfuture.com/blog/tag193-...
recordedfuture.com
TAG-193’s Regional Espionage Operations
Explore joint Cisco Talos and Recorded Future research on TAG-193's cyber-espionage operations targeting government across Central Asia and the wider Commonwealth of Independent States (CIS)
296 9
Reposted by Catalin Cimpanu
Katie Drummond @katie-drummond.bsky.social · 14/10/2026
It is a total coincidence, I swear, that the image for this story looks exactly like my husband, who loves AI more than he loves me.
wired.com
Men Can’t Stop Faking How Much They Know About AI
More than half of the men surveyed in a new Harvard study claimed to recognize AI leaders who were, in fact, totally fictional.
67512 75
Reposted by Catalin Cimpanu
Ross Nesbitt @arc-codex.com · 14/10/2026
Risky Business #855 -- ShinyHunters done sowing, enters reaping phase This article heavily emphasizes the exploitation of specific software flaws, like NetScaler and SharePoint bugs, framing the issue as a collection of preventable vendor mistakes rather than a systemic… via Risky Business Podcast
huntaegis.com
011 1
Reposted by Catalin Cimpanu
Donald Campbell @dncampbell.bsky.social · 14/10/2026
Internal documents reveal Amazon is using an AI risk-scoring tool to surveil union activity among its workers: www.computerweekly.com/news/3666521...
computerweekly.com
Amazon uses AI-powered ‘risk’ system to track union activity globally | Computer Weekly
Internal documents disclosed during a Canadian labour dispute show Amazon is using an artificial intelligence-powered risk-scoring system named Atlas to track union organising among its workforce, whi...
03322 33