Mololuwa | Cybersecurity - (The God Complex)
@cyber_rekk
Security Engineer || Insurance Tech security
884 Following 24.7K Followers
At Fort Huachuca in Arizona, freezers reportedly entered defrost mode overnight, heating the food until it spoiled
US Cyber Command and the Army Criminal Investigation Division are involved in the investigation
Investigators are also speaking with French authorities after a similar attack disrupted refrigeration systems at more than 350 commercial sites in France
Some of the French systems used outdated refrigeration controllers, but investigators haven’t established whether the US bases used the same equipment
The American incidents have not yet been confirmed as cyberattacks, and no perpetrator has been identified
The funny part is that an attacker wouldn’t need to steal military secrets or shut down a base’s network to cause real-world damage
Changing the settings on a connected industrial system can be enough
Show more
BREAKING: Pentagon investigating a suspected cyberattack after freezers at 6 U.S. military bases mysteriously malfunctioned, spoiling large quantities of food. —Reuters
Ohhh to fall in love with a tech babe
Preferably cybersecurity
Discord says it is making public server messages searchable on Google
Public channels in servers with at least a thousand members, the setting is on by default for US adults.
On by default
Meaning you do nothing and your words get indexed. Meaning the person who chatted in a fandom server in 2024 gets a search result in December without ever being asked
They say usernames won’t show. Cute. Anyone who finds the message can search the server and figure out who wrote it in about a minute
If you run a big server, go to Web Presence today and turn it off. If you’re a member, check your Data and Privacy settings before mid-December. Don’t wait for the search result to find you
Opt-out is not consent It is a door they left open and hoped you would not notice
Show more
Discord is making public server messages indexable on google starting november.
if you run a server:
server settings → opt channels out. do it now, before november.
If you’re a user:
settings → privacy & safety → data and privacy → turn off message indexing.
The default is on. the opt-out is on you.
things worth thinking about before november: any public server you’ve ever posted in. anything you said assuming discord was “just discord.”
Moderators can opt their channels out. users can opt themselves out. Neither of those things will happen automatically.
Show more
Thew leaked database doesn’t just identify thousands of US Homeland Security employees
It also reveals how they’re connected to sensitive operations inside the department
The dataset, published under the name Icepick, contains records on more than 41,000 DHS employees and contractors across agencies including ICE, CBP and CISA
Some entries reportedly link personnel to undercover work, wiretap programs and surveillance tools
That makes the exposure more consequential than a stolen staff directory
The information could help someone identify personnel in sensitive roles, impersonate colleagues or craft convincing targeted phishing attacks
A group calling itself Department of Peace claims it obtained the data through DHS’s Okta sign-on system
But that access route remains unverified, and Okta says it has found no evidence that its own systems were compromised
DHS has acknowledged a potential breach and says it is working to address it and protect employees
The full dataset has not been independently authenticated, but journalists have verified portions of the records
Show more
🚨🇺🇸 Massive leak reportedly exposes more than 41,000 U.S. Homeland Security employees
A group calling itself the Department of Peace claims it compromised a Department of Homeland Security system and obtained records belonging to employees across ICE, CBP, CISA and several other DHS agencies.
The dataset reportedly contains names, work emails, cellphone numbers, job assignments and facility locations. It also exposes memberships in internal access groups associated with undercover and covert operations, wiretap programs, Palantir software, Cellebrite tools and xAI’s Grok chatbot.
⠀
Journalists who reviewed the material found records connected to undercover ICE personnel and other sensitive law enforcement roles. The data has since been released publicly with a searchable interface.
The group reportedly gained access using a compromised Okta single sign-on account. DHS, ICE and CBP had not publicly confirmed the breach or responded to requests for comment at the time of publication.
Show more
spelling throttle as turtle is enough grounds for a breakup btw
The flaw comes from how attacker controlled animation data is handled, causing a memory write before the start of an allocated buffer
That kind of memory corruption can potentially let an attacker run code in the context of the vulnerable application
Despite some descriptions of this as a zero-click sticker attack, ZDI says exploitation requires user interaction, such as visiting a malicious page or opening a malicious file
Telegram told ZDI that server-side validation of stickers mitigates the issue, but ZDI still sought a client-side fix before publishing its advisory on October 15
Until a client-side fix is confirmed, avoid opening untrusted animation files or links and keep Telegram updated
Show more
🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content
A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process.
Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level.
⠀
The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer.
⠀
Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur.
⠀
Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15.
⠀
No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed.
Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.
Show more
Who owns aeon??????????
JUST IN: Aeon, a Nigerian cybersecurity startup, has secured $1 million in funding to accelerate the development of its technology amid escalating threats from cyberattacks and growing vulnerabilities in digital infrastructure.
Show more
A message you send in Discord could soon be searchable on Google long after someone has forgotten the conversation it came from
Discord is turning its largest public communities into searchable web pages, with individual messages set to start appearing in search results from mid-December
The change affects Discoverable Servers with at least 1,000 members that meet Discord’s activity and safety requirements
Server admins can choose which public channels appear on the web, but in most regions, users’ messages are included by default unless they opt out
Discord says usernames and avatars won’t appear alongside indexed messages
Private servers and DMs aren’t included
There’s one catch with the opt-out: switching it off stops future messages from appearing, but doesn’t automatically remove messages you sent while it was enabled
If you want to change it, go to User Settings → Data & Privacy and turn off Show my message content from Discoverable channels on web pages
The controls are rolling out now, ahead of the December launch
Show more
Discord is about to put your public messages on Google.
Not next year. This November. Mid-December to be exact.
Every Discoverable Server gets a web page November 16.
Every server with 1,000+ members that Discord deems public enough.
63,000 of them.
Starting mid-December those messages show up in search results.
Someone Googles a question about gaming strategy. Your answer appears.
Someone Googles a niche community topic. Your take shows up.
All searchable. All indexed. All permanent.
Discord says only future messages. Not past ones.
Only public channels. Not private servers or DMs.
Only usernames removed. Not the content.
Discord frames this as convenience. Hard to find good answers on Discord. Now they're on Google.
What Discord doesn't say is someone scraped 4 billion Discord messages already.
November 2023. Started selling access to profiles and message archives.
620 million users. 14,000 servers. All harvested. All for sale.
Discord did nothing. Still hasn't.
Now Discord is doing the exact thing does.
Except officially. Except Google sanctioned. Except you can opt out.
For now.
Go to Settings. Data and Privacy. Toggle it off.
But only new messages stay private. Old ones are already out there.
And when employers search your name. When recruiters search your opinions. When the internet searches what you said.
Your Discord comments are now part of your digital record.
Forever.
Show more
European governments want to make it easier for AI companies to train on personal data without asking people for permission
The change targets the GDPR, the law that governs how companies collect and use Europeans’ personal information
On October 21, the EU Council backed a negotiating position that would explicitly allow AI developers to rely on “legitimate interest” as a legal basis for processing personal data
That could let companies use people’s information for AI development without obtaining consent in every case
It wouldn’t be unlimited permission — companies would still have to weigh their interests against people’s rights and meet other GDPR requirements
The proposal is part of the EU’s Digital Omnibus package, which aims to simplify digital rules
But the Council’s position isn’t law yet
The European Parliament must still negotiate the final text with member-state governments
Show more
The EU Council, the body representing EU member state governments has approved a position that would let companies train AI on Europeans’ personal data without consent.
It would make AI training a recognised “legitimate interest” under GDPR one of the legal bases companies can use to process personal data without asking for permission under the current framework, AI training on personal data generally requires consent or a clear, specific legal basis this proposal shifts that.
what “legitimate interest” means in practice: the company decides that its interest in using your data outweighs your interest in not having it used.
The draft also proposes letting companies keep sensitive personal data that ends up in training sets “accidentally” if removing it would require “disproportionate effort.” with safeguards, but still.
Who benefits: companies that already hold large amounts of European personal data which are mostly American and Chinese AI firms.
Max Schrems’s framing: “digital expropriation.” Europeans’ data being taken and handed to companies without the people it belongs to having a say.
where it stands: the EU Council approved their position. the European Parliament must still agree. this is not law yet but the Council’s backing is a significant step.
Show more
Google spent years telling you your Gmail was off limits for ads
Then it changed one sentence
Eighteen words. Unless you choose
And you know what happens next? Everybody clicks the button. Because the button is attached to the feature that makes Search useful, and Google built it that way on purpose
Connect your inbox. Connect your photos. Get better answers. Fine. But do not pretend you agreed to anything bigger, because you didn’t. You agreed to a convenience. What you got was a pipeline into the ad system with a permission toggle painted over it
Google says ads won’t be based directly on your inbox
Directly
That word is doing enormous damage and they know it
Check your settings today. Disconnect what you don’t need. And stop letting a privacy policy you never read quietly rewrite the promise you thought you had
Show more
Google kept its promise not to use your Gmail content for personalized ads, then added an exception
On October 16, its privacy policy changed to allow data from Gmail, Drive and Google Photos to inform ads if you choose to share it with other Google services
The route is Personal Intelligence, which lets Search access information from connected apps to personalize its answers
That same data may now help Search personalize ads too
Google says connecting these apps is entirely opt-in, and that ads won't be based directly on your Gmail inbox or Photos library
But the updated policy explicitly allows data shared with services that support personalized ads to be used for that purpose
Your emails and photos don't have to be handed to advertisers for information from them to influence the ads you see
Show more
Google kept its promise not to use your Gmail content for personalized ads, then added an exception
On October 16, its privacy policy changed to allow data from Gmail, Drive and Google Photos to inform ads if you choose to share it with other Google services
The route is Personal Intelligence, which lets Search access information from connected apps to personalize its answers
That same data may now help Search personalize ads too
Google says connecting these apps is entirely opt-in, and that ads won't be based directly on your Gmail inbox or Photos library
But the updated policy explicitly allows data shared with services that support personalized ads to be used for that purpose
Your emails and photos don't have to be handed to advertisers for information from them to influence the ads you see
Show more
on october 16, google quietly updated its privacy policy to create a new exception to one of its oldest promises.
the old rule: gmail, drive, and google photos content would never be used to target ads. google held that line for years. the logic was that your inbox, your documents, your personal photos are too private to touch.
the new rule: same thing, unless you’ve connected those apps to other google services.
and here’s where it gets interesting. google has spent the last two years aggressively pushing you to do exactly that. Connect your gmail to AI Mode in Search. connect your drive to Gemini the pitch was “more useful answers.” you can find a hotel reservation in your inbox from search.
what changed october 16 is that the same connection that makes AI features smarter now also opens that data pool to ad personalization. the email about your upcoming surgery, the shared document about your salary, the photos from your kid’s school once you’ve connected those apps, google search can now process that content to “personalize content, including ads.”
Show more
Sony kept your So-net account in its database after you cancelled it, and on October 19, 2026, someone walked out with 2,585,481 records, including 54,401 email addresses with their passwords, and 16 bank account numbers with the names of the banks, while Sony did not notice until October 23, and by the time its investigation finished on October 24, the data was gone, and Sony’s position is that it has shut the affected servers down and that it does not store bank PINs, which is true, and also beside the point.
Show more
Sony has suffered a massive data breach affecting around 2.58 million So-net and plala customers.
Sony Network Communications says hackers accessed its member database on October 19. Leaked information includes:
• Names
• User IDs
• Email addresses
• Other customer information
• 16 bank account records, including account numbers and bank names
The company says it has not found any leaked credit card numbers or expiration dates, and it does not store customers’ bank PINs.
Sony says the affected servers have been shut down and the unauthorized connections blocked, while internet services continue to operate.
Show more
Attackers found a way to make GitHub leak secrets for them
They used stolen access tokens to add malicious GitHub Actions workflows to compromised repositories
Wiz tracked the campaign, called Gheist, across more than 850 compromised accounts and 13,500 malicious branches
The workflows were designed to print accessible secrets into GitHub Actions logs
To evade secret masking, the attackers encoded the values in Base32, making them look different from the original secrets
They then downloaded the logs and deleted the workflow runs, removing the most obvious evidence from the interface
But deleting a run doesn't erase copies of its logs that attackers have already taken
a stolen GitHub token can become a way to extract credentials from a repository's own automation
Show more
🚨 850+ compromised GitHub accounts. 13,500+ malicious branches.
Researchers uncovered 'Gheist,' an ongoing campaign using stolen tokens to plant GitHub Actions workflows that dump private repo secrets into logs.
Attackers download the logs, then delete the runs.
Details:
Show more
baseless overengineering
Turtle Beach is putting a 2.25-inch touchscreen directly on the side of a gaming mouse.
The MC7 lets you change DPI, switch profiles, trigger macros, launch apps and control OBS from the display, without opening extra software.
It also features a 30,000 DPI sensor, 8K polling, wireless/Bluetooth/wired connectivity and dual hot-swappable batteries.
The MC7 costs $159.99
Show more
Imagine playing a game where the world you're exploring is being generated as you move
That's what Google DeepMind is trying to build with Genie 4
You can walk through a photorealistic environment, change the scene with text prompts, and interact with characters that respond with speech
The model also generates sound and simulates physical interactions, from collisions to movement
Genie generates the world while Gemini helps keep events coherent, plans multi-step actions and adapts as you interact with the scene
That makes it more than a video generator
A video is something you watch
A world model generates an environment that responds to what you do inside it
DeepMind sees applications in game prototyping, creative work and training AI agents or robots in simulated environments before they operate in the real world
But Genie 4 is still an experimental research preview
Objects and visual details can drift over time, and complex physical interactions aren't always consistent
The bigger idea is that AI could eventually generate environments you don't just watch, but explore, change and interact with in real time
Show more
JUST IN: Google DeepMind unveils Genie 4, a new AI model that generates photorealistic, interactive 3D worlds in real time, complete with physics, sound, & human dialogue.
Flock Safety's CEO thinks a Ukrainian strike on a Russian data centre explains why criticism of his surveillance cameras suddenly dropped by 50%
Garrett Langley made the claim in leaked audio recorded during a private meeting with police chiefs
He used the supposed drop in online chatter to argue that the backlash against Flock wasn't real
His explanation was that Russian bots had been driving the criticism
But the recording doesn't establish that the chatter was coordinated or that the strike caused it to fall
Flock's cameras scan passing vehicles and log licence plates, locations and timestamps, allowing law enforcement to search where vehicles have been seen
The company has faced growing opposition from communities concerned about how that data is collected, shared and used
Langley also admitted he'd made mistakes and said he wanted to stop doing media interviews
“I'd like to never do media again if that's possible”
The comments were made to the very police chiefs whose departments use Flock's technology
Show more
Garrett Langley is the CEO of Flock.
Sold 80,000 surveillance cameras to police.
Then got caught in leaked audio at a police chiefs conference.
Told them the backlash wasn't real.
It's bots. Russian bots.
His wife said never apologize. So he's not going to.
He'd prefer to never do media again.
The backlash dropped 95 percent since July.
Then 50 percent overnight.
Why.
Ukraine bombed a Russian data center.
Which proved it was Russian bots all along.
Not journalists. Not researchers. Not people who watched cops use Flock to stalk women.
Not students asking why their university tracks them.
Not the entire internet saying surveillance bad.
Just bots. Russians. Paid actors saying privacy matters.
Langley's evidence is audio from a private conference.
Leaked to 404 Media.
Which proves how good his security is.
His wife told him never apologize.
His legal team told him stop doing interviews.
So he did the opposite.
Went to a police conference.
Told police chiefs the backlash isn't real.
Then someone recorded it.
Then the recording leaked.
Now his address is on the internet.
Which happened because the backlash that isn't real.
Got more real.
His wife said never apologize.
He's not apologizing.
Just blaming bots.
Ukrainian drone strikes on Russian data centers.
And the fact that people keep noticing his company lets police stalk whoever they want.
That's not real either.
That's just misinformation.
Show more
Someone left the viewing history of over a million smart TVs on a server anyone could access
No login required
Researchers at Northeastern University found that the tracking system used by Hisense's VIDAA TVs had exposed more than 57 million content-recognition records
They collected them in about three hours
The system uses Automatic Content Recognition, or ACR, to identify what's playing on a TV
It can recognize content from the audio, even when you're watching through an HDMI device
The records included a permanent ID for each TV, the app or input being used, and an audio fingerprint of what was playing
The server also classified viewing into 82 categories, including politics, religion and health
So this wasn't just a database of anonymous viewing statistics
The records were tied to identifiable television devices, making it possible to connect viewing activity over time
The researchers even tested what happened when they sent a previously observed message back to their own TV
The TV received it
That raised the possibility of someone injecting fake or potentially harmful messages into the system, although the researchers did not test that against other people's TVs
VIDAA fixed the exposed server by adding a login requirement after the researchers reported it
But the ACR traffic itself was still being sent without encryption
Your smart TV can be more than a screen
It can be a device that recognizes what you're watching, categorizes it, and sends that information somewhere else
Show more
VIDAA is the OS on Hisense TVs.
Second largest smart TV platform in the world.
The tracking server for what people watched had no login.
None.
A researcher just subscribed to the data stream.
Three hours.
57 million viewing records.
From one million plus TVs.
What people watched. When they watched it. Categorized into religion. Politics. Health. Kids content.
All readable.
All unencrypted.
Unruly. The ad tech company behind it. Confirmed the vulnerability October 22.
Added login requirements. Immediately.
But the data transmission stayed unencrypted.
So anyone on the same network. Anyone at the ISP. Anyone watching the traffic could still see what you're watching.
One of the categories in the data was VIDAA Kids.
Children's viewing habits.
Names of shows. Times watched. Permanently tagged device IDs.
All exposed.
The researchers didn't try to steal anything. Didn't try to hijack a TV. Just pulled the viewing records for three hours then reported it.
57 million records in three hours.
Scale that to what the platform actually collected. What's still sitting there unencrypted.
The irony is you can turn off automatic content recognition.
Samsung pretends it stops tracking but keeps sending data.
VIDAA actually stops the tracking when you turn it off.
But the infrastructure that would stop your viewing history from being exposed to everyone on Earth.
That infrastructure didn't exist.
Just an open pipe of unencrypted data.
And a server that said yeah sure. Anyone can see it.
Show more
Anthropic lost $80.7 billion in six months
But that number needs context
The company behind Claude has officially filed to go public, seeking a Nasdaq listing under the ticker ANT
Its S-1 filing shows $16.3 billion in revenue for the first half of 2026, up from $1.2 billion in the same period last year
The reported net loss was $80.7 billion
But roughly $72 billion of that came from non-cash accounting charges tied to changes in the value of convertible financing instruments
That doesn't mean Anthropic spent $80.7 billion in cash
It still spent around $9 billion on computing and infrastructure in just six months
The filing also lays bare how much infrastructure the company is committing to secure its place in the AI race
Anthropic has disclosed hundreds of billions of dollars in future payment obligations across cloud computing, equipment and other infrastructure agreements
The company hasn't announced its final IPO price or target valuation
But reports suggest investors could value it at as much as $2 trillion
It's a revealing look at the economics of frontier AI
Revenue is growing at extraordinary speed, but so are the costs of building and running the systems behind it
Show more
Anthropic has officially filed to go public.
The AI company has filed its S-1 with US regulators and plans to list on Nasdaq under the ticker ANT.
The filing says its founders will retain 50.1% of the voting power through a founders’ company. Anthropic also reported an $80.7 billion loss in the first half of 2026, according to CNBC.
The IPO could value Anthropic at around $2 trillion, with trading potentially starting in mid-November.
Show more
The Netherlands wants to eliminate 25,000 government jobs by 2035
And AI is part of the plan
The government says it needs to save €3.5 billion a year by then, after its civil service grew by roughly 40% since 2018
It now wants to simplify regulations, standardise IT systems and use AI to make the remaining workforce more productive
But the cuts go beyond automating paperwork
The government also plans to reduce advisory bodies, scrap unnecessary rules and stop replacing some departing employees
Police and defence are exempt from the cuts, while some other departments could face reductions of up to 60%
The government will publish more detailed targets for using AI in the first quarter of 2027
So the 25,000 figure isn't a count of jobs already replaced by AI
It's the target for a much broader overhaul of the Dutch civil service, with AI expected to help deliver the savings
And that distinction will become increasingly important as governments start treating AI not just as a tool for public servants, but as a way to operate with fewer of them
Show more
JUST IN: Dutch government announces plans to eliminate 25,000 civil service jobs as it expands AI to replace administrative work.
The Pentagon is experimenting with Bitcoin as a cybersecurity tool, not just treating it as money
In April, the commander of US Indo-Pacific Command told Congress the military was running a Bitcoin node and testing how the protocol could help secure and protect networks
They aren't mining Bitcoin
They're testing what the technology can do for national security
A week later, Defense Secretary Pete Hegseth was asked whether Bitcoin could help project American power and whether the Pentagon had initiatives to counter China's strategic direction on digital assets
His answer was: “Yes and yes”
He added that classified efforts to enable and counter the technology were already underway
The distinction is important because Bitcoin's military applications aren't limited to holding it as a financial asset
Its cryptography, blockchain and proof-of-work system could have applications in network security and other technical operations
But the Pentagon hasn't publicly explained what those classified programs actually do
And this doesn't mean the US has turned Bitcoin into a weapon against China
It means the military is actively experimenting with the protocol as a potential instrument of national power
Show more
The Pentagon just told Congress Bitcoin is a weapon.
Not metaphorically. Not as an analogy.
A literal tool for power projection against China.
Defense Secretary Pete Hegseth sitting in a House Armed Services hearing.
Rep. Lance Gooden asks: Is Bitcoin strategic leverage against China?
Hegseth's response: Yes and yes.
I am a long enthusiast of Bitcoin and crypto potential.
The Pentagon has classified programs. Both enabling Bitcoin and defeating it.
Both operational tracks. Both classified.
Both giving the US leverage in a lot of different scenarios.
Translation: we're running something. We won't tell you what. But it's military.
Admiral Paparo confirmed INDOPACOM runs a live Bitcoin node.
Not for trading. For power projection.
The United States military is now operating the same network that hackers use.
The same network that Iran demands as toll payment for the Strait of Hormuz.
The same network China is stockpiling.
A live military Bitcoin node in the Pacific theater.
Where any war with China actually happens.
The Pentagon doesn't run cryptocurrency mining operations for fun.
Doesn't operate blockchain nodes because the tech sector is cool.
Does it when Bitcoin becomes a domain of great-power competition.
Like space. Like cyber. Like undersea cables.
Control the settlement layer. Control the leverage.
Hegseth framed Bitcoin as decentralized resistance to China's model of digital control.
Which is Pentagon speak for we control Bitcoin and China can't.
So the military just admitted the most important asset in a future war with China is a cryptocurrency that runs on computers.
Anyone's computers. Anywhere.
Bitcoin went from get-rich-quick scheme to classified military weapon in a hearing.
The US military wins through distributed consensus.
And they're not telling Congress the details.
Show more
