Reading Rain in Islington.A normal lunch. I'm looking out.There's nothing realbeyond the window,and yet, I still want.Clusters of raindrops raceeach other down my car,and I think that's moreinteresting than my soup,clustering in my beard, ready torace itself in streaks downthe front of my freshest,most-ironic t-shirt.So, will betting on these…

A reblog of my post from August 20th 2020, updated with audio and video.

A poem by Nathan Cocker Slow, sad sails, empty of all their power,Wagging through the trailing mists of morning.Quiet decks, awash with fluttering foam,Robbed of regimented hands batteningQuarter hatches, holes and starlit skylights.Each cabin lost of all souls except phantomsThat shift in time like the absent Bosun's call.No hurried feet clambering the rigging…

The article critiques SecurityWeek's question whether "Is patching dead?," emphasizing that the sources don't seem to support all claims, highlighting the tightening of vulnerability deadlines under CISA's BOD 26-04 and arguing that patching remains critical, particularly for high-risk vulnerabilities.

CVE-2026-45659 affects on-premises SharePoint products, requiring users to verify builds for potential vulnerability. A recent update from CISA changed its status to known exploitation in ransomware, but the vulnerability needs authenticated access, making internal assessments crucial. Organizations should prioritize patching, review account access, and enhance security measures.

An ongoing investigation addresses recent AI containment failures involving multiple organizations, including OpenAI. While incidents were linked to misconfigurations rather than model escapes, the necessity for enhanced risk management and decision-making surrounding AI capabilities is emphasized. Organizations are urged to reassess AI risk acceptance parameters and security protocols.

Disclaimer: All information in this podcast is for informational purposes only and does not constitute legal or professional advice.Levi Strauss & Co. Cyberattack: Hackers used social engineering against employees to access and steal corporate data. We discuss the human element in cybersecurity and the importance of training under UK GDPR. (Source: Link not available)North Carolina Ports Disrupted: A cyberattack slows operations at major US ports, highlighting the vulnerability of critical national infrastructure and the relevance of the UK's NIS regulations. (Source: Link not available)Software Supply Chain Threats: We look at two major software vulnerabilities: unpatched TrueConf servers being used to distribute backdoors, and a critical zero-day in Metabase leading to customer data theft. (Source: Link not available)Massive Healthcare Data Breach: Unlimited Technology Systems reports a breach from October 2025 impacting over 3.8 million people, a stark reminder of data protection obligations and potential regulatory fines. (Source: Link not available)Financial Sector Under Fire: An extortion group, UNC6671, is linked to a wave of attacks targeting hedge funds and private-equity firms. (Source: Link not available)And Finally...: A quick look at new attack chains involving clipboard hijacking, a macOS infostealer targeting crypto assets, and a major upgrade for ChatGPT users. (Source: Link not available)

By 2026, AI-driven threats have transformed enterprise security, making traditional defenses obsolete. The rise of machine-generated phishing and autonomous cyberattacks highlights a critical shift where AI exploits human weaknesses. Organizations face existential risks, with sophisticated attacks necessitating a transition to AI-native security solutions like Remote Browser Isolation, emphasizing proactive defense measures.

A quick disclaimer: The information in this podcast is for informational purposes only and does not constitute legal or professional advice. The Double-Edged Sword of AI: Hackers are now using AI models like DeepSeek to automate attacks on vulnerable servers with minimal human intervention. In contrast, OpenAI teases its next major model, Astra, which has already been used to solve long-standing maths problems. OpenAI also announces significant price reductions for its GPT-5.6 models, making powerful AI more accessible. Breaches, Supply Chains, and Data Protection: Pharmaceutical firm Amgen discloses a major data breach involving sensitive patient health information stored in third-party cloud systems. We discuss the UK GDPR implications. Ad-tech firm Adform suffers a supply-chain attack, with malicious scripts pushed to websites to steal cryptocurrency from visitors' clipboards. The Arch Linux project temporarily halts package adoptions on its Arch User Repository (AUR) after a wave of malicious takeovers. Vulnerabilities and Mitigations: A critical flaw in the Ruby on Rails Active Storage framework could allow for remote code execution. Patching is urged. An estimated $88 million in Bitcoin was stolen due to a flawed random number generator in COLDCARD hardware wallets. In positive news, Google Chrome is set to block extensions that hijack your New Tab page by default. Critical Infrastructure Under Threat: The US CISA issues a stark warning about increased cyberattacks targeting water utilities, a reminder for UK operators under the NIS regulations.

The latest release of The Poet's Guidebook explores the physicality of poetry, emphasizing how vocal muscles engage as we read. Key insights include the contrast between euphony and cacophony, the evocative power of sibilance, and the impact of plosives. A practical editing technique sharpens the connection between sound and emotion in writing.

Big Tech Troubles: We discuss the massive, unrelated outages at Microsoft 365 and OpenAI's ChatGPT, and what they mean for business resilience and dependency on core services. Data Breach Fallout: From credential stuffing at Chick-fil-A and a network hack at OnTrac, to the nasty ShinyHunters sextortion scam, we explore the lifecycle of a data breach and its real-world consequences under UK GDPR. Evolving Attack Vectors: Hackers get creative with hotel Wi-Fi DNS hijacking to steal Microsoft 365 credentials, build malware directly in your browser, and even use AI agents to automate attacks. A Defensive Step Forward: We end on a positive note, looking at new time-based defences from GitHub and PyPI designed to thwart software supply chain attacks. Disclaimer: All information in this podcast is for informational purposes only and does not constitute legal or professional advice.

A Week of Urgent Patching: Public exploits for the critical WordPress "wp2shell" RCE vulnerabilities are now live. We also discuss a new Windows zero-day ("LegacyHive"), a remote code execution flaw in 7-Zip, and the "HollowByte" DDoS flaw affecting OpenSSL servers. Breaches and Supply Chain Risks: Ernst & Young discloses a data breach originating from a third-party support system, highlighting crucial UK GDPR considerations around data processors. Corporate Incidents Under Investigation: Healthcare giant Abbott is probing two separate cybersecurity incidents, one involving claims of extortion, while Microsoft warns of a surge in attacks from the ACR info-stealer malware. Evolving Fraud Tactics: A look at how cybercriminals are seeking "clean" residential proxies to bypass modern fraud detection systems. The Privacy and Compliance Angle: As regulations like the UK's Online Safety Act take hold, we explore on-device age verification technology as a privacy-preserving solution that aligns with GDPR principles of data minimisation.

The SonicWall SMA 1000 series, crucial for secure remote access, has been compromised by two severe zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410. Exploiting these flaws allows attackers to bypass security and gain administrative access. Organizations must act quickly to investigate breaches and reconsider their remote access architecture to prevent future risks.

Disclaimer: All information in this podcast is for informational purposes only and does not constitute legal or professional advice. Urgent Warning for ShareFile Admins: Progress Software issues an alert for a “credible threat” and advises customers to immediately shut down on-premises Storage Zone Controller servers. Read more. Active Exploitation of Gitea: A critical authentication bypass vulnerability in the official Gitea Docker image is being actively exploited, allowing attackers to impersonate any user. Read more. 'Ghostcommit' AI Attack: Researchers reveal a new technique that hides prompt injection attacks within PNG image files to trick AI coding agents and steal secrets. Read more. RedHook Android Malware Evolves: A new version of the RedHook malware abuses the Wireless ADB feature to gain shell access on Android devices without a physical connection. Read more. U-Boot Bootloader Vulnerabilities: Six new flaws discovered in the widely-used U-Boot bootloader could enable stealthy firmware attacks that bypass security measures. Read more. Ryuk Ransomware Member Pleads Guilty: An Armenian national pleads guilty in the US for his role in the Ryuk ransomware gang, facing a potential 15-year prison sentence. Read more. Global CMS Exploitation Campaign: Australia’s cyber security agency warns of a widespread campaign targeting vulnerable content management systems and plugins. Read more. Odido Breach Investigation: Dutch police suspect local hackers were involved in the February data breach at telecommunications provider Odido. Read more.

The perception of Artificial Intelligence in enterprises is lagging, often seen as mere chatbots rather than autonomous agents capable of accessing sensitive environments. The "lethal trifecta" of risks—access to private data, untrusted input, and public output channels—calls for robust security measures. Organizations must focus on closing the "Agentic Gap" to mitigate these risks effectively.

The latest chapter of The Poet’s Guidebook focuses on mastering rhyme in contemporary poetry. It challenges traditional rhyming advice, offering actionable techniques like slant rhyme, internal rhyme methods, and a checklist to maintain authenticity. The guide aims to enhance poetic expression while encouraging feedback and discussion among writers.

The "FortiBleed" crisis reveals vulnerabilities in national security infrastructure, exposing over 80,000 firewalls due to compromised Fortinet systems. High-value government credentials are being sold, posing risks to critical services like healthcare. With state-supported hackers, this crisis necessitates immediate defenses and highlights systemic flaws in cybersecurity strategies.

Cheap Android TV streaming boxes may seem like bargains, but they are linked to a global cybercrime network, the Popa botnet. These devices can be hijacked to serve as proxies in cyberattacks, compromising home networks. Users are urged to avoid unknown brands and reconsider the true cost of such savings to their security.

Poetry is a gift to the mind. I’ll feed your qualia with mine if you feed my qualia with yours. Click to read Poetry-365 on Substack. Launched a minute ago.

RunZero discovered seven unpatched vulnerabilities in the FatFs filesystem library, a crucial yet overlooked component in modern technology, affecting various devices. Without centralized updates, security falls on developers. The findings highlight a significant supply chain risk, exposing devices to severe attacks, particularly through physical access, as AI advances in vulnerability detection.

In the second episode of Popcorn and Cyber, the hosts discuss the classic 1983 film WarGames, which explores early hacking and cybersecurity. The movie features David, a young hacker who accidentally threatens nuclear war by accessing a military supercomputer. While it dramatizes certain elements, it remains a foundational piece of cyber culture and highlights the impact of Cold War anxieties.

The Poet’s Guidebook challenges conventional poetry advice, promoting a practical and accessible approach to writing. It focuses on overcoming the fear of the blank page through strategies like embracing constraints, establishing a daily routine, and using an Object Journal for concrete inspiration. It's an invitation to refresh creative practices.

A quick disclaimer: The information in this podcast is for informational purposes only and does not constitute legal or professional advice. The AI Double-Edged Sword: We discuss how benign-looking GitHub repositories can trick AI coding agents into running malware, and how threat actors are using fake OpenAI organisations to steal corporate data. On the flip side, we look at how AI can be used as a GRC agent to automate compliance tasks. Clean GitHub repo tricks AI coding agents Cybersecurity firms targeted by fraudulent OpenAI organization invites Your First GRC Agent: A Red Teamer's Walkthrough Phishing's New Playbook: Russian intelligence-linked hackers are now targeting Signal backup keys to access message histories. Plus, how scammers are abusing the Shopify 'Shop' app with fake receipts to launch callback phishing attacks. FBI: Russian hackers now target Signal backup recovery keys Order-tracking app Shop abused to push callback phishing attacks Breaches, Supply Chains, and Takedowns: A massive data breach in Japan exposes up to 14.2 million email logins, highlighting third-party risk. We also cover the $3 million supply-chain attack on Polymarket and a positive law enforcement win against a SIM-swapping gang in Poland. Data breach exposes up to 14.2 million email logins at six ISPs Polymarket customers lose $3 million in supply-chain attack Poland busts SIM-swapping gang Patch Now Alert: A warning about an actively exploited vulnerability in Cisco Unified Communications Manager that requires immediate attention. CISA sets urgent deadline to fix Cisco flaw

Cybersecurity threat maps (often called "pew-pew maps") are interactive, animated global maps that show glowing lines or lasers representing cyber attacks flying from one country to another. Major cybersecurity companies like Kaspersky, Fortinet, Check Point, Trellix (formerly FireEye), and SonicWall provide these maps. Key Threat Map Tools Kaspersky Cyberthreat Real-Time Map: One of the most visually stunning maps. It features a fully 3D rotating globe and lets users toggle between various detection types (such as Mail Anti-Virus, Web Anti-Virus, Intrusion Detection System, and On-Access Scan).

It’s time to build a new kind of political party. One that belongs to you.

Gaza: Doctors Under Attack, which was due to air in February, was made by an independent company.

LiveTrack creates a real-time view of your location during an activity, so friends and family can follow along.

Israeli media says activists face detention if they fail to comply with Israeli army orders.

Episode 1: Tales from the mouths of incurable romantics

Poetry 365 · Episode

Has a star formed up there?Is a supernova of biblical proportionsladling out spun light into a tight sphere cast from liquid glowing?Because from its tarnish winksa blade of pinkish light that reaches down, pointing, topenetrate the fog of war,and iconify a baby blue born to a combustible holy land.Above, shepherds are watching,as they always do.

Disproven health claims are accepted with little challenge by host on number one podcast, BBC investigation finds.

There is a scream so loud that no one can hear it