Hisense now allegedly breached.
No login needed for samples either.
Not a good week for security.
Good luck.
No login needed for samples either.
Not a good week for security.
Good luck.
‼️ The tracking server for VIDAA smart TVs, the system on Hisense sets, needed no login.
In 3 hours, Northeastern researchers pulled 57M+ records of what 1M+ TVs were watching, sorted into categories like religion and politics.
0
3
30
2,127
VIN Solutions, owned by Cox Automotive has allegedly been breached by Scarlett Group. VIN (Vehicle Identification Number) Solutions is a CRM platform for thousands of dealers.
Rival CDK Global was hacked in 2024 and caused havoc in the industry. I still don’t know the entry and pe but this doesn’t look as bad atm.
Cox Automotive was breached by Clop Ransomware last year w/ CVE-2025-61882.
Customer IDs, SSNs and dealer data has been released as samples including drivers licenses and insurance info.
Rival CDK Global was hacked in 2024 and caused havoc in the industry. I still don’t know the entry and pe but this doesn’t look as bad atm.
Cox Automotive was breached by Clop Ransomware last year w/ CVE-2025-61882.
Customer IDs, SSNs and dealer data has been released as samples including drivers licenses and insurance info.
1
3
13
2,296
Italy’s largest supermarket and consumer cooperative, Coop Italia has been breached by Qilin Ransomware.
It does not look like any customer data was stolen otherwise they would flaunt that for ransom.
It does not look like any customer data was stolen otherwise they would flaunt that for ransom.
0
3
18
2,102
Dominic Alvieri retweeted
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge ions potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.p…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-2026-10961…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/patch…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulner…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unbou…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/prote…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bug.cgi?i…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge ions potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.p…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-2026-10961…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/patch…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulner…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unbou…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/prote…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bug.cgi?i…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
39
180
631
71,175
Dominic Alvieri retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,304
10,844
70,337
12,462,544
Dominic Alvieri retweeted
New Node.js security updates
CVE-2026-105482
CVE-2026-105843
CVE-2026-106069
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-111497
nodejs.org/en/blog/vulner…
CVE-2026-105482
CVE-2026-105843
CVE-2026-106069
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-111497
nodejs.org/en/blog/vulner…
3
30
161
20,003
New Node.js security updates
CVE-2026-105482
CVE-2026-105843
CVE-2026-106069
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-111497
nodejs.org/en/blog/vulner…
CVE-2026-105482
CVE-2026-105843
CVE-2026-106069
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-111497
nodejs.org/en/blog/vulner…
3
30
161
20,003
Dominic Alvieri retweeted
CVE-2026-109618
CVE-2026-109619
PHP vulnerability
CVE-2026-109619
PHP vulnerability
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
9
22
190
39,573
Dominic Alvieri retweeted
Revolut outage disrupts online banking operations worldwide
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
4
24
57
9,909
Dominic Alvieri retweeted
‼️ BREAKING: The FBI suspects a US ransom negotiator helped run ShinyHunters' extortion site, KrebsOnSecurity reports.
The site listed nearly 100 victims and told them "Nobody has to know about this."
A source says seized chats show negotiators knew of hacks before victims did.
The site listed nearly 100 victims and told them "Nobody has to know about this."
A source says seized chats show negotiators knew of hacks before victims did.
16
50
372
37,072
Dominic Alvieri retweeted
The potential impact of the ConnectWise supply chain attack is massive.
One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants.
Even worse, attackers could establish ding credentials to other applications, surviving the revocation of the original compromised credentials.
And with MSPs involved, the potential blast radius could extend even further to downstream customers.
We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup.
linkedin.com/posts/microsof…
One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants.
Even worse, attackers could establish ding credentials to other applications, surviving the revocation of the original compromised credentials.
And with MSPs involved, the potential blast radius could extend even further to downstream customers.
We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup.
linkedin.com/posts/microsof…
13
126
448
38,517
NBC Universal has allegedly been breached by fairly new Scarlett Group.
Claimed data includes banking details (sample wire transfer), a CRM dump and unannounced upcoming films.
@NBCUniversal has not commented
Claimed data includes banking details (sample wire transfer), a CRM dump and unannounced upcoming films.
@NBCUniversal has not commented
0
4
18
2,546
Dominic Alvieri retweeted
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
bleepingcomputer.com/news/security/…
15
82
309
47,370
DataSuckers and Spy Chips
Russia arrests ShinyHunters-Lapsus style hackers in Russia!
Trevor hardware wallets have now been found to have spy chips implanted in them days after Ledger devices confirm spy chips & drained @ $80 million
per @campuscodi
na01.safelinks.protection.outlook.com/?url=https%3A%…
Russia arrests ShinyHunters-Lapsus style hackers in Russia!
Trevor hardware wallets have now been found to have spy chips implanted in them days after Ledger devices confirm spy chips & drained @ $80 million
per @campuscodi
na01.safelinks.protection.outlook.com/?url=https%3A%…
0
9
43
3,859
2026 is breaking ransom and victim record numbers. Just look at this today.
More than one victim has been posted per minute over the last 20 minutes:
BlackNevas 15 victims
Cinder 9
Eclipse 8
Qilin 5
LockBit 2
More than one victim has been posted per minute over the last 20 minutes:
BlackNevas 15 victims
Cinder 9
Eclipse 8
Qilin 5
LockBit 2
0
0
14
2,320
“ShinyHunters” pulling ALPHV BlackCat ghosts posting a fake seizure banner.
Bro I made the one you’re using 🤡🤡🤡
Bro I made the one you’re using 🤡🤡🤡
3
11
85
6,359
Original post ⤵️
ShinyHunters is reviving /shinypog… as a backup in case of seizure since the main site is still unreachable, and it’s not down by adding DDoS protection.
They are redirecting the old url to their main DLS which is still down, duh.
ShinyHunters DLS has NOT been seized
(so far)
0
0
3
1,128