International Cyber Digest
5.28K subscribers
623 photos
39 videos
2 files
106 links
Your weekly go-to cybersecurity newsletter, curated and commented on by our senior analysts.
Download Telegram
This media is not supported in your browser
VIEW IN TELEGRAM
πŸ›©οΈ This is so cool: A Redditor living under SFO's takeoff path built a ceiling projection that maps every plane flying over their house in real time, using ADS-B, the open radio signal aircraft broadcast on 1090 MHz. Same feed as FlightRadar24, picked up with a cheap SDR dongle and beamed onto the ceiling.
❀11πŸ”₯5
πŸš¨πŸ‡©πŸ‡ͺ Germany just fined a citizen up to a month's income for posting "LΓΌgenfritz" ("Lying Fritz") about Chancellor Friedrich Merz in a Facebook comment.

Politicians love to call themselves the guardians of democracy. But Germany has a special law that gives politicians MORE legal protection from insults than ordinary citizens get. The powerful, shielded from the powerless who criticize them.

Fining people for airing their opinion is how you take free speech away. It makes the government the editor of every sentence you publish.

🀑 And here's the kicker: German MPs have "IndemnitÀt", near-total lifelong legal immunity for what they say in parliament.

https://www.welt.de/politik/deutschland/article6a1ee49d1f46a650bff5cf50/mehrere-verfahren-beleidigung-von-merz-unter-facebook-post-gericht-verhaengt-hohe-geldstrafe-fuer-luegenfritz.html
πŸ’©14🀬8🀯2😁1
❗️ Peak slop achieved: Microsoft announced "Scout," an always-on AI agent that reads your email and chats and acts on your behalf unprompted. They call it an "Autopilot." It's the sloppification of work: AI slop now runs all day reading your inbox.
πŸ’©14😁3🀬2🀣2
β€ΌοΈπŸš¨ A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar.

The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at .claude, .cursor, .gemini, and .vscode paths, a separate persistence and repo-poisoning angle.

Source: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
❀4
❗️Google employees are flooding an internal meme board with posts about how bad the company's AI is.

A source says dozens of anti-AI memes post weekly, spiking when models update or their internal coding tool Jetski breaks. One showed Jetski admitting it fabricated report metrics with over 400 upvotes.

Engineers say AI removed the code-gen bottleneck but jammed everything else: testing, build times, and human review now drowning in code nobody wrote.

CEO Pichai says 75% of new code is AI-generated, btw.

Via 404Media https://www.404media.co/google-employees-internally-share-memes-about-how-its-ai-sucks/?ref=daily-stories-newsletter
❀9😁3πŸ‘1
‼️ The alienation continues: more security researchers are sticking up the middle finger after feeling squeezed by Microsoft and GitHub. MSRC emailed Black Hat USA 2026 presenters asking which MSRC cases, VULN-IDs, or CVEs their talks would cover. GitHub told a researcher to delete his public PoC repos and flagged his accounts under ToS.
πŸ’©8❀4😁1
β—οΈπŸš¨ Zcash crashes nearly 50% after an AI-powered white-hat researcher, using Claude Opus, found a critical flaw in Zcash's privacy pool (Orchard) that could mint unlimited, undetectable counterfeit ZEC.

It went unnoticed for 4 years until the emergency patch on June 1...
❀5πŸ₯°3πŸ”₯1
‼️ Pump[.]fun launched "GO," a tool to pay anyone to do anything. Within a day it was hosting live bounties soliciting people to harm themselves for money. This is the predictable result of shipping an open-bounty market with no guardrails.
😱8😁4🀣2
β—οΈπŸš¨ An Israeli company has backdoored hundreds of millions of households through countless Smart TV apps, and they're quietly turning Samsung and LG TVs into exit nodes for AI web-scraping. Your TV is relaying strangers' web traffic from your home IP, your bandwidth, your address attached to whatever those scraping jobs touch.

Roku, Fire TV and Google TV banned the practice. Samsung and LG didn't. The culprit is Bright Data's proxy SDK, which rides inside Tizen and webOS apps, 200+ on webOS alone. Datacenter IPs get blocked, home IPs don't.

Include Security reverse-engineered the SDK and found its relay protocol has no message signing, authentication, or device attestation. Their words: less secure than typical malware command-and-control.

To make things worse, they found that in iOS the relay tunnel binds straight to the physical network interface, so it routes around any VPN the user is running.

Bright Data's config also ships per-country tiers. Devices in Uzbekistan and Oman are cleared to relay down to 1% battery, with data caps up to 60x the worldwide default.

Before the BaCkDoOrEd replies land: technically you agreed. In practice you were enrolled into a global proxy network you were never given the information to refuse. And these exit nodes drag down your IP's reputation, potentially leaving you with blocks from providers.

Read: https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/
πŸ’©12🀬8❀3πŸ₯°1😁1