❗️ A threat actor breached a Polish invoicing platform used by more than 600,000 businesses called Fakturownia, by exploiting a vulnerability which led to access to its servers.
Potentially exposing password hashes, bank account details, authentication and integration tokens, and invoices issued before 2023.
The attacker claims to have taken 6 TB of invoices.
https://zaufanatrzeciastrona.pl/post/nowe-wlamanie-fingerprinta-ofiara-firma-fakturowniapl/
Potentially exposing password hashes, bank account details, authentication and integration tokens, and invoices issued before 2023.
The attacker claims to have taken 6 TB of invoices.
https://zaufanatrzeciastrona.pl/post/nowe-wlamanie-fingerprinta-ofiara-firma-fakturowniapl/
😁8❤1🔥1
❗️ An Airbnb host used an AI-generated photo of an overflowing toilet to demand $1,700 in damages from a guest.
The image carries Google's invisible SynthID watermark, flagged by Gemini's own checker.
The guest says they never even used toilet paper during the stay.
https://www.reddit.com/r/isthisAI/comments/1wt6sb0/photo_of_a_toilet_airbnb_sent_in_justification/
The image carries Google's invisible SynthID watermark, flagged by Gemini's own checker.
The guest says they never even used toilet paper during the stay.
https://www.reddit.com/r/isthisAI/comments/1wt6sb0/photo_of_a_toilet_airbnb_sent_in_justification/
🤣42💩7🤬1
Google launched one of its AI chips into orbit for the first time today, and says data centers in space will only work if Starship flies about 1,800 times in 10 years.
A Planet Labs-built satellite carried the Google TPU up on a SpaceX rocket, the first hardware test for Project Suncatcher, its plan for data centers in space.
A Planet Labs-built satellite carried the Google TPU up on a SpaceX rocket, the first hardware test for Project Suncatcher, its plan for data centers in space.
🔥13💩5😁3👏1🤣1
❗️ Meet the 25-year-old Dutch national arrested in Manchester who is allegedly the negotiator for ransomware group KillSec.
Turns out he used to be fat and has since lost some weight.
US prosecutors name him as Fouad E., alias "Archduke", who allegedly phoned a victim as KillSec's representative and now faces extradition to Puerto Rico and up to 10 years in prison.
KillSec's suspected leader, arrested in Spain, is 16. 🤯
Turns out he used to be fat and has since lost some weight.
US prosecutors name him as Fouad E., alias "Archduke", who allegedly phoned a victim as KillSec's representative and now faces extradition to Puerto Rico and up to 10 years in prison.
KillSec's suspected leader, arrested in Spain, is 16. 🤯
😁17🔥2🤣2💩1
The alleged KillSec ransomware negotiator has a day job, and it's startup CEO.
His bio says he has dedicated his career to helping businesses across Oman and the Gulf "embrace digital transformation".
He allegedly phoned one victim as KillSec's representative, which is certainly a transformation.
The bio promises AI-driven solutions that help companies overcome challenges and unlock new opportunities, and unlocking things is famously where ransomware groups make their money.
It closes by inviting everyone to build the future together, and his own now includes possible extradition to Puerto Rico and up to 10 years in prison.
His bio says he has dedicated his career to helping businesses across Oman and the Gulf "embrace digital transformation".
He allegedly phoned one victim as KillSec's representative, which is certainly a transformation.
The bio promises AI-driven solutions that help companies overcome challenges and unlock new opportunities, and unlocking things is famously where ransomware groups make their money.
It closes by inviting everyone to build the future together, and his own now includes possible extradition to Puerto Rico and up to 10 years in prison.
🤣29😭3💩2
‼️ BREAKING: Microsoft's official X account with over 13 million followers was hijacked to boost a fake Clippy account tied to a crypto scam.
Microsoft wrote an apology threatening legal action, then deleted that post too.
The account followed and reposted the impersonator and swapped its profile picture for Clippy.
Microsoft wrote an apology threatening legal action, then deleted that post too.
The account followed and reposted the impersonator and swapped its profile picture for Clippy.
🤣49❤4🔥2😱2
🚨 BREAKING: Finland's cyber agency reports several intrusions through the Citrix NetScaler zero-days.
NCSC-FI has contacted the owners of hundreds of NetScaler instances in Finland and warns that patching alone will not remove an attacker who is already inside.
CVE-2026-88771 allows command execution without authentication.
https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland
NCSC-FI has contacted the owners of hundreds of NetScaler instances in Finland and warns that patching alone will not remove an attacker who is already inside.
CVE-2026-88771 allows command execution without authentication.
https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland
🔥6🤔2👏1
❗️ Attackers could use iCloud to send email as any icloud[.]com address, including tim.cook@icloud.com, while still passing SPF, DKIM and DMARC, the email authentication checks built to stop spoofing.
Researchers found and reported two parsing flaws in Apple's mail servers. An early fix by Apple only blocked the word "admin" and the full patch took 18 months.
Apple paid them $15,000.
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
Researchers found and reported two parsing flaws in Apple's mail servers. An early fix by Apple only blocked the word "admin" and the full patch took 18 months.
Apple paid them $15,000.
https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/
😭27😁4🤪2❤1😱1
❗️ICE has been uploading photos of people exercising their First Amendment rights into a Palantir-built database, along with their license plates and personal details, newly unsealed court filings say.
One agent tagged two observers "Threat to Law Enforcement, Professional Protestor" and had their faces run through facial recognition.
Agents also allegedly drove past observers' homes and phoned one observer's spouse to warn of a "domestic terrorism watchlist."
DHS calls the lawsuit "meritless."
https://www.courtlistener.com/docket/72313728/132/hilton-v-noem/
One agent tagged two observers "Threat to Law Enforcement, Professional Protestor" and had their faces run through facial recognition.
Agents also allegedly drove past observers' homes and phoned one observer's spouse to warn of a "domestic terrorism watchlist."
DHS calls the lawsuit "meritless."
https://www.courtlistener.com/docket/72313728/132/hilton-v-noem/
😱14💩8🥰3❤2🔥2👍1😭1
‼️ BREAKING: A key member of ShinyHunters has been detained in Jordan and is now helping the FBI identify the rest of the group that claims to have stolen data on every bureau employee, sources tell Reuters.
The sources name him as Saif al-Din Khader, alleged alias "Rey", and say he was taken into custody on Tuesday.
He told KrebsOnSecurity in 2025 that he was "already cooperating with law enforcement", a claim Krebs could not verify.
The sources name him as Saif al-Din Khader, alleged alias "Rey", and say he was taken into custody on Tuesday.
He told KrebsOnSecurity in 2025 that he was "already cooperating with law enforcement", a claim Krebs could not verify.
🤣24😭4🤬3😱1