‼️BREAKING: Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11.
Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times.
Boot ROM code is burned into the chip. No update can fix it.
Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times.
Boot ROM code is burned into the chip. No update can fix it.
🤪8❤4🤣2👍1
‼️ Japan is facing a storm of data breaches, and it keeps getting worse.
Delivery giant Yamato Transport now says hackers took 5.31 million records, from names and addresses to what people bought.
Cosmetics firms Fancl and Attenir say 834,947 more may have leaked.
Ransomware gang Qilin claims it hit rail operator Keio and posted what it says are Keio files.
In the past month, JR East, travel site Skyticket and software firm Sourcenext have each disclosed possible leaks of millions of records.
Japan's National Police Agency says it is not yet clear whether the attacks are linked.
https://www.japantimes.co.jp/news/2026/10/17/japan/crime-legal/more-data-breaches-japan/
Delivery giant Yamato Transport now says hackers took 5.31 million records, from names and addresses to what people bought.
Cosmetics firms Fancl and Attenir say 834,947 more may have leaked.
Ransomware gang Qilin claims it hit rail operator Keio and posted what it says are Keio files.
In the past month, JR East, travel site Skyticket and software firm Sourcenext have each disclosed possible leaks of millions of records.
Japan's National Police Agency says it is not yet clear whether the attacks are linked.
https://www.japantimes.co.jp/news/2026/10/17/japan/crime-legal/more-data-breaches-japan/
🤔5😢5❤1😁1
‼️ BREAKING: Hackers hijacked a CDU email account and sent phishing mail to German Chancellor Friedrich Merz.
Police say it went to about 6,500 contacts of the party's Heilbronn branch, many in security-relevant roles.
The message contained an invite to an event.
https://www.heise.de/news/Phishing-Angriff-auf-Merz-und-viele-andere-CDU-Mailkonto-in-Heilbronn-gehackt-11491677.html
Police say it went to about 6,500 contacts of the party's Heilbronn branch, many in security-relevant roles.
The message contained an invite to an event.
https://www.heise.de/news/Phishing-Angriff-auf-Merz-und-viele-andere-CDU-Mailkonto-in-Heilbronn-gehackt-11491677.html
🤣13🥰1😍1
❗️ Apple now explicitly requires App Store apps to block and remove nonconsensual intimate images, including AI fakes.
Hiding features with code obfuscation can get a developer banned.
In January, Tech Transparency Project found 47 App Store apps that would undress people.
https://developer.apple.com/news/?id=vvzx6cul
Hiding features with code obfuscation can get a developer banned.
In January, Tech Transparency Project found 47 App Store apps that would undress people.
https://developer.apple.com/news/?id=vvzx6cul
🤣11👍5❤4🤬1
‼️ UPDATE: A researcher says the Broadcom Wi-Fi router bug affects way more countries.
The vulnerable code is also in ZTE's F680 v4, which ISPs from Spain to Vietnam, Egypt and Moldova offer.
Three Movistar Spain routers appear affected. Broadcom still won't assign a CVE.
Our previous post on this matter:
A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.
Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.
The bug dates to 2010. Broadcom won't assign a CVE.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
The vulnerable code is also in ZTE's F680 v4, which ISPs from Spain to Vietnam, Egypt and Moldova offer.
Three Movistar Spain routers appear affected. Broadcom still won't assign a CVE.
Our previous post on this matter:
A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.
Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.
The bug dates to 2010. Broadcom won't assign a CVE.
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
🤣13🤬5❤1
Media is too big
VIEW IN TELEGRAM
😭11💩9🥴5👏4🤣1
‼️ Linus Torvalds called rules against AI coding tools "UTTERLY STUPID" on the Linux kernel mailing list.
He says people he respects and calls intelligent do not shy away from using new tools.
He says people he respects and calls intelligent do not shy away from using new tools.
🥴27👍18💩5🤣4👏3😁2💯2😭1
❗️ Eurofiber France says an threat actor has accessed Waza, its portal for partner orders and tickets.
Partner names, work emails and some IBANs may be exposed. It does not yet know the exact scope of what has been leaked.
Eurofiber runs 77,500 km of fibre in Europe.
Partner names, work emails and some IBANs may be exposed. It does not yet know the exact scope of what has been leaked.
Eurofiber runs 77,500 km of fibre in Europe.
🤣11❤1👏1😁1🤯1
‼️ BREAKING: Unauthenticated attackers are hijacking Plex Media Servers.
Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.
A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.
A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
😱7😭3❤1🔥1🤣1
Media is too big
VIEW IN TELEGRAM
`🚨 EXCLUSIVE: Meta Ad Campaign Exposes AI-Generated Priest Scam
We uncovered a Meta ad campaign seeking donations for prosthetic legs for Father Miguel, an AI-generated priest.
Scammers used AI, religion and disability to steal money from users of Facebook, Instagram and WhatsApp via Meta ads.
The ads ran from a Facebook page called Miguel between 26 September and 18 October. Meta’s Ad Library lists about 170 versions in French and Spanish.
The biggest ran on Facebook, Instagram, WhatsApp, Threads and Meta’s Audience Network. All are now inactive.
One ad reached 9,565 accounts in France. Nearly 8 in 10 were women, and most were over 45.
It says Miguel is a priest in a town of 5,000 people in São Paulo state, Brazil. The Spanish donation site says the organiser is in Colombia.
An AI-detection scan scored Father Miguel’s face 0.91 for AI generation.
The crucifix reads “VDX” instead of INRI, his face changes from photo to photo, and his wheelchair warps.
The sites are built to look like GoFundMe pages, down to GoFundMe’s own typeface. None of them is on GoFundMe.
The donations shown are static code, fake.
Two of them send donors to the exact same six payment links, from $25 to $1,000.
In the Spanish version, the medical note says both legs were amputated above the knee, while the clinic quote prices below-knee prostheses.
The note is signed in the name of a real Brazilian haematologist. No evidence he wrote it.
The trail leads to Brazil. Donations go through a checkout from Stelar (Brazilian payments platform) with Stripe card fields.
Visitors are tracked by Metrito (Brazilian ad-tracking service). Some code comments are in Portuguese.
Meta lists a Brazilian sole trader (registered in Roraima in May as a driver-for-hire business) as payer for the French ads.
The Spanish ads name a car repair business in Rondônia whose website has nothing to do with Miguel.
Either identity may have been misused.
The checkout preselects a $5 add-on and names no merchant or charity.
Stelar’s terms say sellers plug in their own payment gateway. Meta, Stelar and Stripe hold the records that would show who is behind the ads and who gets the money.
Meta removed one version of the ad for “Unacceptable business practices”, while others kept running until 18 October.
The donation sites are still online today.
🤣11😱3❤2
❗️ The FBI says Jonathan Kramer, 21, secretly ran a pro-ISIS SimpleX account that talked about attacks, then got hold of a rifle.
The account told its SimpleX group the app was "100% anonymous".
The FBI says it unmasked him anyway, using Reddit and Amazon records, a stakeout and a paid informant.
Agents seized his rifle and about 190 rounds from his Pennsylvania hotel room and bags on 12 September.
He hid behind the name "Hamza Al Rashid" on SimpleX, a messenger that needs no phone number or email.
Separately, Discord flagged "alternate" accounts that shared IP addresses or browser cookies with Kramer's known accounts.
One of them, last used from his home internet connection, sent users to a Discord profile showing a masked man in front of the ISIS flag.
Hamza Al Rashid had also called SimpleX "the most secure messenger available".
Weeks later, a Reddit account registered to Kramer's email wrote "simplex is where its at".
Hamza Al Rashid offered to chat at "7PM mecca time", noon in Pennsylvania, which the FBI says fits Kramer's night shifts.
Agents watched Kramer being driven to work at 9:41PM and home at 6:31AM.
The paid informant chatted with Hamza Al Rashid, who laid out a plan to blind a crowd with pepper grenades.
Amazon records show Kramer had bought pepper spray.
A federal grand jury indicted him on 6 October for receiving the rifle to commit terrorism for ISIS.
He has pleaded not guilty.
https://www.justice.gov/usao-wdpa/media/1461241/dl
The account told its SimpleX group the app was "100% anonymous".
The FBI says it unmasked him anyway, using Reddit and Amazon records, a stakeout and a paid informant.
Agents seized his rifle and about 190 rounds from his Pennsylvania hotel room and bags on 12 September.
He hid behind the name "Hamza Al Rashid" on SimpleX, a messenger that needs no phone number or email.
Separately, Discord flagged "alternate" accounts that shared IP addresses or browser cookies with Kramer's known accounts.
One of them, last used from his home internet connection, sent users to a Discord profile showing a masked man in front of the ISIS flag.
Hamza Al Rashid had also called SimpleX "the most secure messenger available".
Weeks later, a Reddit account registered to Kramer's email wrote "simplex is where its at".
Hamza Al Rashid offered to chat at "7PM mecca time", noon in Pennsylvania, which the FBI says fits Kramer's night shifts.
Agents watched Kramer being driven to work at 9:41PM and home at 6:31AM.
The paid informant chatted with Hamza Al Rashid, who laid out a plan to blind a crowd with pepper grenades.
Amazon records show Kramer had bought pepper spray.
A federal grand jury indicted him on 6 October for receiving the rifle to commit terrorism for ISIS.
He has pleaded not guilty.
https://www.justice.gov/usao-wdpa/media/1461241/dl
🤣13❤3👏1💩1