-Mythos found thousands of critical bugs
-Hackers breach Russia's SDA disinfo group
-GitHub rolls out new npm security feature
-Bulletproof hosting providers raided in the Netherlands
-Hackers breach two Vietnam agencies
-Anonymous Monero platform hacked for $2.7m
-StablR hacked for $2.8m
-Hacker returns Verus stolen funds
-China tracks visiting foreigners
-Data centers devour 2% of all electricity
-AI is killing package repos

Newsletter: https://news.risky.biz/risky-bulletin-mythos-found-thousands-of-critical-bugs/
Podcast: https://risky.biz/RBNEWS568/

hack.lu is celebrating its 20th edition!

There is still time to be part of this special anniversary edition: submit your talk, presentation, workshop, or even a short talk for the Call For Failures.

Twenty editions of sharing, learning and community deserve something memorable. Don’t miss the chance to contribute, this year will be special!

Call-for-Papers Submission Site https://pretalx.com/hack-lu-2026/

CfP Details https://2026.hack.lu/blog/hack.lu-2026-call-for-papers/

#hacklu #conference #luxembourg #cybersecurity #hackerconf #cfp #callforpapers #europe

@hack_lu @circl

Error: password must contain:

Three lower case letters for the Elven-kings under the sky,
Seven upper case letters for the Dwarf-lords in their halls of stone,
Nine digits for Mortal Men doomed to die,
One special character for the Dark Lord on his dark throne;
In the Land of Mordor where the Shadows lie.

One username to rule them all, one password to find them,
A second factor to bring them all, and in the darkness bind them;
In the Land of Mordor where the Shadows lie

It's #TowelDay. Have a good one and don't forget your #towel

‚Torvalds added, in the case of AI-discovered bugs, you need to keep in mind that just "because you found it with AI, 100 other people also found it with AI."‘

There is nothing secret about a bug found by a model. If the software is a target, you can be sure that the bad guys are running continously prompts against it. Without token restrictions.

As a maintainer, this is all hard to manage. But this is happening everywhere. It‘s not your job to save the world from stupidity, vanity and greed.

I'm incredibly pleased to announce that the microcode for the Intel 80386 has been decoded.

It was a group effort by a bunch of talented people to extract and correct the physical bits, but the major work of decoding them was done by reenigne - you may know him from such incredible PC demos as 8088 MPH and Area 5150, as well as being the person who decoded the 8088 microcode previously.

Please, check out his writeup.

https://www.reenigne.org/blog/80386-microcode-disassembled/

#retrocomputing #vintagecomputing #microcode #reverseengineering

If you run a peertube instance and have not patched in the past 4 hours, you are way behind and likely have been compromised. The latest patch will help clean up the mess.

See here: https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8

Fun fact, a web upload trigger gives you root read access on the Tolino Vision Color, but im not even sure if they are in general just more open for tinkering.

7" Full Color Linux eink reader for 200€ is anyway more on the expensive side

eat flaming shit, google.

https://techcrunch.com/2026/05/22/you-can-no-longer-google-the-word-disregard/

Semgrep listed by Qilin. Oof.

#ransomware

Hello and welcome to #NakedDieFriday! This time with proper capitalisation. :-)

The die of today is named HD6483153 and is designed by Hitachi. It fell out of a SIM card. I do not know what commercial p/n this is, if it was ever assigned one. If anyone can provide any details on what smart cards were made by Hitachi, please do so! In the meantime, we shall explore a bit. 🧵

Full-res map: http://infosecdj.net/map/hitachi/hd6483153/infosecdj_mz_nikpa40x_2/

EDIT: This is H8/3153, part of the H8/3150 series.

#electronics #reverseengineering #smartcards

🏆 Nominations for the 2026 Burp Suite Extension Awards close THIS TUESDAY ⚠️

Week 3 of Extensibility month is almost wrapped - here's what happened, what's still to come, and how to get your nomination in before it's too late 👇

(picussecurity.com) UNC2891: Anatomy of a Sophisticated Bank Heist Using CAKETAP Rootkit and Raspberry Pi-Based Attacks

UNC2891, a financially motivated threat group active since 2017, has executed sophisticated attacks on banking infrastructure using custom malware and physical access vectors. Their latest campaign in Q1 2025 involved planting a 4G-enabled Raspberry Pi on a bank’s network switch to bypass perimeter defenses, enabling ATM fraud via Payment HSM manipulation.

In brief - UNC2891 targets financial institutions with advanced Linux/Solaris malware, including the CAKETAP rootkit, to authorize fraudulent ATM withdrawals. A recent attack used a Raspberry Pi for initial access, highlighting evolving physical and digital threats to banking systems.

Technically - UNC2891 employs CAKETAP (Solaris kernel rootkit) to hook system calls like `mkdirat` and `ipcl_get_next_conn`, enabling stealthy C2 and network manipulation. SLAPSTICK (PAM backdoor) captures credentials, while TINYSHELL (backdoor) communicates over raw TCP (ports 53/443). Tools like WINGHOOK (keylogger) and STEELHOUND (in-memory dropper) facilitate credential harvesting and payload execution. The CAKETAP variant on ATM switches bypasses card/PIN verification by replaying HSM responses.

Source: https://www.picussecurity.com/resource/blog/unc2891-bank-heist-explained-caketap-rootkit-and-raspberry-pi-attack

#Cybersecurity #ThreatIntel