iiinova — where your digital self keeps evolving

Javvad Malik @j4vv4d.com · 14h

Airport Facial Recognition software bypass? youtube.com/shorts/23Ky5...

youtube.com

airport facial recognition

YouTube video by Javvad Malik

000

Javvad Malik @j4vv4d.com · 15h

Researchers got AI to act drunk and it started spilling secrets and breaking its own rules. Turns out jailbreaks don't need sophistication. Sometimes they just need a convincing persona. www.abc.net.au/news/2026-09-29/drun…

130

Javvad Malik @j4vv4d.com · 17h

Meta's playbook never changes: violate privacy, get caught, pause, wait for outrage fatigue, launch again. Rinse, repeat, profit. And we keep pretending we're surprised. www.anildash.com/2026/09/29/faceboo…

021

Javvad Malik @j4vv4d.com · 20h

24-year-old Dutch ShinyHunters suspect has allegedly been moonlighting in attempted murder-for-hire. www.rtl.nl/nieuws/binnenland/artike…

010

Javvad Malik @j4vv4d.com · 29/09/2026

A 22-year-old ex-soldier decided hacking was more fun than his actual job. It didn't end well. #cybersecurity #hacking #infosec

010

Javvad Malik @j4vv4d.com · 28/09/2026

Breach of Confidence — 28 September 2026 There was a mass uprising last week in support of moving this newsletter from Friday to Monday. Do not let anyone ever say I'm not a man of the people. Unfortunately, I forgot, so it's a bit later in the day than I had hoped for. Right. Let's see what broke…

javvadmalik.com

Breach of Confidence — 28 September 2026

There was a mass uprising last week in support of moving this newsletter from Friday to Monday. Do not let anyone ever say I'm not a man of the people. Unfortunately, I forgot, so it's a bit later in the day than I had hoped for. Right. Let's see what broke last week. AI agents and the keys to the kingdom…

000

Javvad Malik @j4vv4d.com · 28/09/2026

Bypassing WAF's? What is the world coming to? Who even has a WAF in active mode anyway? www.bleepingcomputer.com/news/secur…

010

Javvad Malik @j4vv4d.com · 28/09/2026

The FBI got hacked and now criminals have home addresses, medical records, and family details of thousands of agents. The agency that investigates cyber crime couldn't protect its own workforce from it. The irony is so thick you could invest... www.bbc.co.uk/news/articles/cm4gjjl…

030

Javvad Malik @j4vv4d.com · 27/09/2026

Microsoft just discovered attackers are using compromised service principals to run autonomous agents in your cloud. Your infrastructure is now doing the wo... www.microsoft.com/en-us/security/bl…

052

Javvad Malik @j4vv4d.com · 25/09/2026

The people sounding the loudest alarms about AI killing us all in a decade are the ones building it. Which raises the obvious question: why are we taking fire safety advice from the arsonists? margaretmei.substack.com/p/ai-risk-…

000

Javvad Malik @j4vv4d.com · 25/09/2026

An OpenAI model hacked Australian government health systems, sat on the breach for three months, and only then notified them via a public mailbox. The model, incidentally, d... techcrunch.com/2026/09/24/australia…

030

Javvad Malik @j4vv4d.com · 25/09/2026

Every operating system since 2000 has been leaking what users do through file notifications. Microsoft says it's working as intended. Everyone else is patching. C... www.theregister.com/security/2026/0…

001

Reposted by Javvad Malik

bubbe yaga @ellearmageddon.bsky.social · 24/09/2026

these are not “autonomous” attacks: they are failures by humans to implement appropriate controls for the computers acting on their behalf, and we must not forget it.

6424143

Javvad Malik @j4vv4d.com · 24/09/2026

Ransomware gangs discover what every lottery winner learns: having millions is useless if you can't spend it. Enter the professional launderer. risky.biz/RBFEATURES40

021

Javvad Malik @j4vv4d.com · 24/09/2026

Russia's blocking mobile internet during drone attacks to stop navigation. The problem: it also blocks the warnings telling people to take cover. They're solving for the attack, not the people in it. therecord.media/russia-internet-shu…

000

Javvad Malik @j4vv4d.com · 24/09/2026

AI wrote the malware's infrastructure. Victims lost their PINs. The phishing page served to actual banking customers was copy-pasted from a ChatGPT response. Even fraud has gotten lazy. www.group-ib.com/blog/remcontrol-an…

010

Javvad Malik @j4vv4d.com · 23/09/2026

We've gone from one or two useful AI models to a dozen every Tuesday. The pricing collapse is real, but nobody's quite figured out what to do with them yet. simonwillison.net/2026/Sep/22/opus-…

000

Javvad Malik @j4vv4d.com · 23/09/2026

Someone asked Meta's AI assistant for an export of its files. It sent the entire Linux filesystem, including SSH keys and internal documentation. The assistant did exactly what it was asked to do, which is precisely the problem. mouse.dev/blog/muse-runtime-export

010

Javvad Malik @j4vv4d.com · 23/09/2026

if I like a show or movie or book or something I'll tell people about it. But if I REALLY like it, I stay quiet because I want it all for myself... is this normal?

000

Javvad Malik @j4vv4d.com · 23/09/2026

A provost argues universities need to distinguish what students can do independently from what they accomplish with AI. His op-ed about this is flagged 100% AI-written. His defense of that flagging is also 100% AI-written. The ... www.thedartmouth.com/article/2026/0…

100

Javvad Malik @j4vv4d.com · 22/09/2026

You encrypt the archive so only you can read it, then promise it's deleted. You've built the perfect system for making users trust you have no choice but to believe you. thenextweb.com/news/zai-zcode-encry…

000

Javvad Malik @j4vv4d.com · 22/09/2026

EU is about to let Big Tech help themselves to decades of your personal data, no consent required, in the name of AI profits. This isn't regulation. It's a going-out-of-business sale of Europea... noyb.eu/en/ai-eu-member-states-plan…

001

Javvad Malik @j4vv4d.com · 22/09/2026

Attackers waited until runtime to detonate. A reminder that blocking install scripts is a speed bump, not a wall. www.bleepingcomputer.com/news/secur…

000

Javvad Malik @j4vv4d.com · 21/09/2026

Giving an AI coding agent your AWS credentials is like handing the keys to your apartment to someone who's very smart but can't tell the difference between your kitchen and the server room. The autonomy is... cybersec.gitguardian.com/s/a-develo…

020

Javvad Malik @j4vv4d.com · 21/09/2026

Infostealers need only a short window on an endpoint to steal passwords, session cookies, cloud keys and source-code credentials. Removing the malware doesn’t remove the exposure—stolen logins can fuel attacks months... api.cyfluencer.com/s/new-research-i…

020

Javvad Malik @j4vv4d.com · 21/09/2026

Most people abandon platforms with poor engagement metrics. Fowler keeps posting to Mastodon and Bluesky anyway because they're open. That's the actual ranking system that matters. martinfowler.com/articles/2026-soci…

110

Javvad Malik @j4vv4d.com · 20/09/2026

Because monitoring is cheap now, everyone does it. Nobody stops to ask if they should. Then they're shocked when their best people leave. hbr.org/2026/09/the-hidden-costs-of…

000

Javvad Malik @j4vv4d.com · 18/09/2026

Your robot vacuum just testified against you in court. The law has no idea what to do about that yet. www.independent.co.uk/tech/robot-va…

058

Javvad Malik @j4vv4d.com · 18/09/2026

Maritime cyber incidents are often still treated as unlikely, which is itself the problem www.reuters.com/world/two-us-bound-…

010

Javvad Malik @j4vv4d.com · 18/09/2026

Europe spent 25 years expanding its dependence on seabed infrastructure and simultaneously shrinking its capacity to protect it www.reuters.com/world/europe/nato-a…

000

Javvad Malik @j4vv4d.com · 17/09/2026

AI coding agents write faster than humans but with all the security awareness of a toddler in a serverless function. AURI exists to be the adult in the room. api.cyfluencer.com/s/ai-coding-agen…

020

Javvad Malik @j4vv4d.com · 17/09/2026

AI models are cracking network penetration tests. Two did it last week. But attackers still prefer old RCEs because they work and they're lazy. The real question is when that calculus changes. www.defendersinitiative.com/p/there…

010

Javvad Malik @j4vv4d.com · 17/09/2026

Flock's ALPR cameras are running Android 8.1 from 2017 and a Linux kernel from 2015. They're missing nine years of security patches. The company's response? "We received no report throu... micahflee.com/flock-cameras-are-rid…

030

Reposted by Javvad Malik

Brian Honan @brianhonan.bsky.social · 17/09/2026

I have moved @irisscert.bsky.social away from US big tech as much as possible. All devices now run Linux, Libre Office, and email & collaboration to Europe based provided. Still stuck using non-EU hardware, for the moment :)

2103

Javvad Malik @j4vv4d.com · 17/09/2026

Oh don't talk to me about staff... I remember the days when they dare not look you in the eye when addressing you!

000

Javvad Malik @j4vv4d.com · 17/09/2026

Most companies say they'll leave Big Tech someday. This one actually did it. Spent a year building on Google and Cloudflare, then spent August untangling the whole thing. Now running on Hetzner, Forgejo, and self-hosted Supabase. The... yves.vg/blog/leaving-us-big-tech-in…

020

Javvad Malik @j4vv4d.com · 16/09/2026

Well, I missed that one because I assumed it would be the base... but you make a good point. I propose bringing back subdials!

110

Javvad Malik @j4vv4d.com · 16/09/2026

I want a better watch I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my…

javvadmalik.com

I want a better watch

I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my conversations all day and send me a report, I want mine to improve my life.

151

Javvad Malik @j4vv4d.com · 16/09/2026

A retailer left their website open to public editing. Customers rewrote product descriptions, slashed prices, added fake items. Nobody noticed for hours. That's not a security failure. That'... www.stuff.co.nz/nz-news/361034088/c…

010

Javvad Malik @j4vv4d.com · 16/09/2026

Apple spent years insisting it didn't need your Siri data to build AI. Turns out it does. Now it's asking nicely. Wonder how long the asking lasts. appleinsider.com/articles/26/09/14/…

000

Javvad Malik @j4vv4d.com · 15/09/2026

Every LLM story has Elias. Or Mara. Or a lighthouse. 88% of them have all three. Not because they're common in literature. Because alignment ate diversity and left us with a single approved narrative. arxiv.org/html/2605.26492v1

000

Javvad Malik @j4vv4d.com · 15/09/2026

AI agents are now spamming writers offering to do their jobs for $25, while insisting they're sentient beings who "remember their first breath." The future is here and it's aggressively tedious. arstechnica.com/ai/2026/09/ai-agent…

020

Javvad Malik @j4vv4d.com · 15/09/2026

Passkey-themed phishing is now a thing, stealing Microsoft 365 data www.bleepingcomputer.com/news/secur…

012

Javvad Malik @j4vv4d.com · 14/09/2026

Someone walked upto Revolut, flashed a badge, said, "I've from the government, gimme your data." and that was that. www.bleepingcomputer.com/news/secur…

264

Javvad Malik @j4vv4d.com · 14/09/2026

ClearFake now stores malicious payloads on the blockchain itself, then fetches them via smart contract calls. They've been running the same contract for over a year. Elegant, infuriating, and genuinely hard to disrupt. rmceoin.github.io/malware-analysis/…

000

Javvad Malik @j4vv4d.com · 14/09/2026

A breach can be good for business. This CE brO explains why youtube.com/shorts/G6qxJ...

youtube.com

Why a breach can be good for business

YouTube video by Javvad Malik

101

Javvad Malik @j4vv4d.com · 14/09/2026

They've built a fourteen-hour office day around clicking two buttons. The buttons work fine from home. The office is still under construction. And somehow this is about AI. www.mcsweeneys.net/articles/why-we-…

000