Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

With the NIKKE launcher tampering in the news this week, here's the order I'd go in if software on your PC turns out to be compromised. Most of this applies to any trojanized installer.

1. Assume anything saved in your browser on that machine is gone. Saved passwords, cookies, autofill. Stealer malware grabs those first.
2. Change passwords from a different, clean device. Start with your main email, then banking, then anything that can reset other accounts.
3. Log out of all sessions. Changing a password doesn't always kill a stolen session cookie. Most big sites have a "sign out everywhere" option. Discord, Steam, Google and Microsoft all do.
4. Check 2FA settings for anything new. Attackers sometimes add their own authenticator or recovery email.
5. Clean or reinstall the machine before logging back in. Otherwise you're just handing over the new passwords.
6. Keep an eye on email for login alerts and password resets you didn't ask for over the next few weeks.

Stolen data like this often ends up in stealer log dumps that get traded later, so a "nothing found" result today doesn't mean much. Worth rechecking down the road.

Disclosure: I'm with OSINT Pro, a breach lookup tool. We wrote up how stealer logs work here if it's useful: https://www.osintpro.dev/resources/what-are-infostealer-logs

Happy to hear what others would add or reorder.

Vulnerability-Lookup (https://vulnerability.circl.lu/) is an open-source platform run by CIRCL, the Luxembourg CERT. It aggregates vulnerability data from many sources (CVE, GitHub advisories, PySec, CSAF feeds and more). It also collects "sightings": mentions, proofs of concept and exploitation reports seen on social media, in exploit databases, from honeypots and from the community. Every month we publish a report built from that data.

Highlights for October 2026:

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): two memory-safety flaws in the PHP interpreter leaked before their coordinated release on 21 October and drew 1,773 sightings. Exploitation was observed on disclosure day, five days before CISA listed them.
• 17,097 CVEs were published, a third record month in a row. Total sightings rose 20%, but proof-of-concept sightings fell 38% and exploitation sightings 20%.
• 200 vulnerabilities entered at least one of the five Known Exploited Vulnerabilities catalogs we track: CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation and Previdian. The catalogs are federated through GCVE (https://gcve.eu/), and the report includes a matrix showing which catalog covers what.
• Ivanti Connect Secure had three CISA entries. CIRCL confirmed the first one before its CVE record was published.
• Previdian covered all 36 CISA additions and flagged 19 of them earlier, in one case by 77 days.

Severity levels come from our open VLAI models (https://arxiv.org/abs/2507.03607). The report was generated with AI assistance using VulnMCP (https://github.com/vulnerability-lookup/VulnMCP). Feedback is welcome on GitHub (https://github.com/vulnerability-lookup/vulnerability-lookup/issues/).

Background: I’m using Ungoogled Chromium, which I do not keep up to date because non-Debian packages are a big hassle to maintain. I expect this risk to be mine alone.

Since websites are secretive¹ about their reasons for blocking, it has been quite painful (as a Tor user) that many services are not blocking Tor, but in fact blocking old versions of Chrome. WTF? Why does a website block old Chrome versions? My gut thought was the website wants to nanny users, to try to force users to secure themselves (“for the user’s own protection”), because surely a user with old chrome does not realistically threaten the server’s security.

The answer: it turns out that AI bots are strangely using old Chrome versions for a user-agent header. So webmasters are reacting by blocking old versions of Chrome. What I don’t understand is why devs of AI bots would try to masquerade as old Chrome versions.

And to a lesser extent I wonder why webmasters are reckless enough to take this collective-punishment-is-ok stance. It would be like a store owner banning customers wearing blue hats from their shop because some shoplifters were caught wearing blue hats.

¹ Exceptionally, codeberg.org actually respects our dignity enough to preduce an error message that says they are blocking old chrome. But they are the exception.

Hi everyone,

I'm looking for new blogs and, more generally, sources of information on the topics of "threat intelligence", "malware reverse engineering", "security engineering" and "DevSecOps". Do you have any recommendations?

Ryohin Keikaku (the company behind MUJI) said on Oct 30 that someone got unauthorized access to the official MUJI app. Up to about 27.26 million records may be affected, including people who already deleted their app account.

What they say leaked: email address, date of birth, gender. They say names, addresses, phone numbers and card details aren't part of it, and they haven't seen it posted or used for fraud yet.

Nobody can log in as you with that, so the practical stuff is pretty boring:

• Expect fake "MUJI" emails about points, coupons or account problems. MUJI itself warned about this. Open the app yourself instead of tapping links.
• Stop treating your birthday as a secret. If a bank or carrier uses DOB as a check, add a PIN or something stronger.
• If your MUJI password is reused anywhere, change those. Passwords aren't listed, but it's a free fix.
• Put 2FA on the email account tied to it, since email is the main thing in this leak.

The notice is Japanese only and doesn't say if MUJI apps in other countries are in scope, so if you're outside Japan watch for mail from your local MUJI.

If you get a breach notice and aren't sure what to do with it, we wrote up a plain guide here: https://osintpro.dev/resources/what-a-breach-notification-means (disclosure: I work on OSINT Pro).

Interesting that there were headlines and perhaps panic about an AI bot grabbing Georgia voter data -- yet no one gives a shit that registration records of every Georgia voter is fully shared with Cloudflare. That’s both public and private data.

And worse, Cloudflare controls who can register to vote. If Cloudflare excludes you from access, you must do a paper registration. Then after submitting paper reg, the data entry worker still gives your sensitive data to Cloudflare anyway.

LOL:

“Georgia is consistently recognized as having some of the most secure elections in the country, with voting systems not connected to the internet designed to prevent fraud, paper-ballots, and risk-limiting audits,” Raffensperger continued. “Twisting this into a security scare for clicks undermines confidence in our elections and is absolutely shameful.”

(source)

Last time I checked, 7 US states share voter registration data with Cloudflare. The other 43 states do better. (As of a few years ago when I checked.. probably a few more are sharing sensitive data with Cloudflare now).

It’s obviously like dealing with a poisonous well. If you spotlight the lack of security and deplore the reckless treatment of people’s sensitive data, you discourage voting. Which then helps republicans.

(edit) Cloudflare gatekeeping GA voter reg:

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

Someone used an Amadeus login to view airline reservation records from Aug 2023 to Sep 2026.

Confirmed so far:

• Japan Airlines: about 92k customers
• Cathay Pacific: about 53k bookings
• ANA: about 37.8k
• Also Jin Air, Star Flyer, Korean Air, and Asiana
• Bloomberg reports Condor as well

Most people had their name, booking code, and flight details exposed. A smaller group also lost email, phone, passport number, and frequent flyer number. The airlines say no cards or passwords were taken.

What to do:

• Expect fake "your flight changed" emails that quote your real route
• Open the airline app yourself instead of tapping links
• Check that upcoming bookings were not changed
• Add a PIN to frequent flyer accounts and check the points

Disclosure: I work on OSINT Pro, which does breach lookups. If you want to see where else your email shows up, https://osintpro.dev/lookup/email

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Wanna chat about something non-infosec amongst those of us who frequent /c/cybersecurity? Here’s your chance! (Keep things civil & respectful please)

https://archive.ph/4JXSC

Digital security also requires resources and ongoing support. As the Internet Society noted, the organisations on the front lines fighting for a safer internet need funding to sustain their work. Without that support, many protection initiatives are forced to rely on isolated efforts and on capacities that are not always available.

However, the responsibility does not lie with organisations alone. Platforms must offer effective mechanisms for reporting and addressing abuses, without giving up point-to-point encryption protection. States, for their part, have the obligation to protect people’s rights in the digital sphere. This entails enhancing privacy and security guarantees, not demanding backdoors or other ways of bypassing encryption, as well as preventing cybersecurity policies from becoming an excuse to expand surveillance or to persecute those working for a safer internet.

The Ola Bini case shows that the latter risk is not hypothetical. In early October, Ecuador deported the digital security expert after revoking his visa because the government claimed he posed a threat to national security, while a habeas corpus action was still pending.