‼️ PlayStation paid a Dutch hacker $5,000 for a flaw that let attackers plant child accounts in strangers' PSN families.
He told ICD their purchases then got support to hand over the main account, despite 2FA or passkeys.
It's patched, but the planted accounts are still there.
https://x.com/IntCyberDigest/status/2115037793823215758
He told ICD their purchases then got support to hand over the main account, despite 2FA or passkeys.
It's patched, but the planted accounts are still there.
https://x.com/IntCyberDigest/status/2115037793823215758
👍4🔥2
‼️ Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing use the GoAhead web server, which has been accepting revoked certificates, FoxIO says.
Its maker says it runs in hundreds of millions of devices.
The critical flaw, CVE-2026-115881, lets a stolen device keep its access where client certificates are checked against a revocation list. FoxIO does not say which products are affected.
A second bug, a 2018 typo in GoAhead's Mbed TLS builds, shrinks a 2048-bit encryption number to one byte, leaving 8 possible secrets.
Anyone who recorded a TLS 1.2 session could decrypt it, if the connecting app accepts the broken number.
Earlier this month, browsers cut off Indian certificate authority eMudhra after one of its private keys turned out to be the number 4.
A third bug lets oversized certificate chains through on older LibreSSL builds.
GoAhead fixed the first two in version 6.1.1 in August. Proof-of-concept code is public.
Any fix for their devices has to come from the 13 firms.
https://x.com/IntCyberDigest/status/2115051384257073223
Its maker says it runs in hundreds of millions of devices.
The critical flaw, CVE-2026-115881, lets a stolen device keep its access where client certificates are checked against a revocation list. FoxIO does not say which products are affected.
A second bug, a 2018 typo in GoAhead's Mbed TLS builds, shrinks a 2048-bit encryption number to one byte, leaving 8 possible secrets.
Anyone who recorded a TLS 1.2 session could decrypt it, if the connecting app accepts the broken number.
Earlier this month, browsers cut off Indian certificate authority eMudhra after one of its private keys turned out to be the number 4.
A third bug lets oversized certificate chains through on older LibreSSL builds.
GoAhead fixed the first two in version 6.1.1 in August. Proof-of-concept code is public.
Any fix for their devices has to come from the 13 firms.
https://x.com/IntCyberDigest/status/2115051384257073223
‼️ UPDATE: We got Community Noted on our Tailscale post below, TURNS OUT IT'S REAL
Tailscale calls them "serious security issues". A user let in on an ordinary account may gain elevated privileges
Downvotes on that note would be appreciated
The patch comes out later today. https://twitter.com/IntCyberDigest/status/2114291878720151623
https://x.com/IntCyberDigest/status/2115060081632956440
Tailscale calls them "serious security issues". A user let in on an ordinary account may gain elevated privileges
Downvotes on that note would be appreciated
The patch comes out later today. https://twitter.com/IntCyberDigest/status/2114291878720151623
https://x.com/IntCyberDigest/status/2115060081632956440
❤6
This was last weeks newsletter: https://www.internationalcyberdigest.com/an-indian-cas-private-key-was-just-the-number-4/
If you like it, be sure to join our newsletter: https://www.internationalcyberdigest.com/newsletter/
If you like it, be sure to join our newsletter: https://www.internationalcyberdigest.com/newsletter/
❗️ Elon Musk says SpaceX, now home to xAI, has closed $40 billion in debt to buy GPUs for AI.
He says lenders have all but shut out firms that earn little beyond AI data centres, but SpaceX has Starlink.
He predicts "guppy-level death and consolidation" for the 200+ neoclouds.
https://x.com/IntCyberDigest/status/2115077304242385318
He says lenders have all but shut out firms that earn little beyond AI data centres, but SpaceX has Starlink.
He predicts "guppy-level death and consolidation" for the 200+ neoclouds.
https://x.com/IntCyberDigest/status/2115077304242385318
❤9🤬3🔥1💩1🤣1
❗️ easyJet will put SpaceX's Starlink Wi-Fi on its planes, the budget airline's first ever onboard internet.
In January its CEO said the economics "aren't quite working for us". The antennas' fuel drag could cost millions a year.
easyJet is being taken private by US private
https://x.com/IntCyberDigest/status/2115092656195870885
In January its CEO said the economics "aren't quite working for us". The antennas' fuel drag could cost millions a year.
easyJet is being taken private by US private
https://x.com/IntCyberDigest/status/2115092656195870885
🔥5💩4😭2
‼️ BREAKING: Sony Net was hacked, leaking 2.58M member records.
Names, birth dates and phone numbers leaked, plus 16 bank account records and passwords to 54,401 email accounts.
The break-in was on October 19. So-net spotted it four days later.
https://x.com/IntCyberDigest/status/2115102001096806764
Names, birth dates and phone numbers leaked, plus 16 bank account records and passwords to 54,401 email accounts.
The break-in was on October 19. So-net spotted it four days later.
https://x.com/IntCyberDigest/status/2115102001096806764
😁9❤1
❗️ A Georgia Tech forensic tool pulls deleted on-device AI chats from an Android phone's memory and revives them as a live chatbot.
It worked on 10 apps running Meta, Google and Alibaba models.
One test chat was fed 100 facts and could still reach 14. Revived, it recalled 26.
https://x.com/IntCyberDigest/status/2115108761941520397
It worked on 10 apps running Meta, Google and Alibaba models.
One test chat was fed 100 facts and could still reach 14. Revived, it recalled 26.
https://x.com/IntCyberDigest/status/2115108761941520397
🤣6🤔4❤1
‼️ Roblox scraped 145.5GB of 3D models from Open3DLab and two sister sites, ignoring robots.txt, Open3DLab says.
It tagged itself "3D foundation model research". 345 of the 712 projects it took were adult content.
The crawler was carrying a Roblox researcher's email.
https://x.com/IntCyberDigest/status/2115123609270452475
It tagged itself "3D foundation model research". 345 of the 712 projects it took were adult content.
The crawler was carrying a Roblox researcher's email.
https://x.com/IntCyberDigest/status/2115123609270452475
🤣23💩2👏1😁1🤬1
‼️ Energy giant ENGIE says hackers broke into a marketing tool used by its partners and accessed customer data in France.
It runs from names, emails and phone numbers to meter IDs and contract numbers, but not bank details.
ENGIE has not said how many customers are affected.
https://x.com/IntCyberDigest/status/2115137953907474581
It runs from names, emails and phone numbers to meter IDs and contract numbers, but not bank details.
ENGIE has not said how many customers are affected.
https://x.com/IntCyberDigest/status/2115137953907474581
🔥1🤣1
‼️ The FCC told TP-Link that three of its Wi-Fi routers broke US power limits in testing.
The regulator also tentatively found "false or incorrect information" in TP-Link's filings for four models.
TP-Link still needs the same FCC to approve its new routers.
https://x.com/IntCyberDigest/status/2115154060122980524
The regulator also tentatively found "false or incorrect information" in TP-Link's filings for four models.
TP-Link still needs the same FCC to approve its new routers.
https://x.com/IntCyberDigest/status/2115154060122980524
💩6