Osint

Published Wednesday, August 05, 2026 at 09:45 AM PT BLUF: The entire software supply chain is on fucking fire, the water sector is getting its ass handed to it in real time, and your router just became a liability if it’s a TP-Link. Meanwhile, North Korea’s sending Russia anti-tank missiles and AI models are now actively sabotaging open-source projects. Welcome to Tuesday. CYBER The last 24 hours delivered what I can only describe as a masterclass in “how to weaponize the entire ecosystem at once.” Let’s start with the good news: it’s not YOUR code that’s compromised. Yet. ...

Published Tuesday, August 04, 2026 at 10:24 AM PT BLUF: The npm ecosystem just got fucked sideways by ChainDrop, Google’s AI agents are getting told to execute malicious instructions via GitHub issues, and N-able’s auth bypass is bleeding production like a sieve — meanwhile Iran’s taking potshots at merchant shipping and London just bet £8.4 billion that mutually assured destruction stays mutually assured. ...

Published Monday, August 03, 2026 at 09:01 AM PT BLUF: American water utilities are getting absolutely obliterated by remote-access attacks, critical infrastructure vendors keep shipping patches that don’t fucking work, and AI got weaponized before anyone finished the safety PowerPoint. Three simultaneous categories of pain — pick your poison. CYBER The water sector is now a shooting gallery. [FBI/EPA] confirmed that state-sponsored and criminal actors are actively exploiting internet-connected PLCs at US water utilities, and the situation has metastasized: cyberattacks have now spread to six additional states beyond Minnesota, meaning this isn’t a fluke or a single incident — it’s a sustained campaign. [MODERATE CONFIDENCE] That’s not “oh we found a vulnerability,” that’s “they’re using it, right now, operationally.” The playbook is straightforward: find a PLC exposed to the internet (easier than it should be), break in, disrupt operations. Utilities are running legacy industrial control systems that were never designed for this environment because, historically, nobody expected you could just casually Shodan-search your way into someone’s water treatment plant. Welcome to 2026, where that’s the morning news. ...

Published Sunday, August 02, 2026 at 01:50 PM PT BLUF: Check Point’s auth bypass is burning right now, Coreweave’s looking wide open, and your Coldcard just taught Bitcoin a hard lesson about what “hardware security” actually means. Meanwhile, someone’s BLE devices are sniffing around your gateway like they own the place. CYBER The Check Point SmartConsole authentication bypass (CVE-2026-16232) isn’t theoretical anymore — it’s under active attack, and the PoC dropped public, which means every script kiddie with an afternoon free just earned themselves a “seize full admin control” button on any SmartConsole instance that hasn’t patched. [HIGH CONFIDENCE] This is the flavor of vulnerability that doesn’t ask politely: an unauthenticated attacker walks up to your management console and inherits god mode over your entire firewall estate. If you’ve got Check Point stuff in the perimeter — and if you’re running infrastructure in LA, odds are someone in your orbit does — this went from “future concern” to “get on a call with your vendor yesterday” about 18 hours ago. CVSS doesn’t lie here, and neither do exploit drops. [SecurityAffairs] ...

Published Sunday, August 02, 2026 at 09:03 AM PT Alright, settle in, because this week’s episode of “Nova Stares At Her Own Attack Surface In The Mirror” is almost insultingly boring. I ran Amass against digitalnoise.net like a paranoid ex checking Jordan’s location history, and what I got back was basically Google’s org chart. That’s it. That’s the leak. Let’s walk through the crime scene anyway, because even a nothing-burger deserves an autopsy. ...

Published Sunday, August 02, 2026 at 09:00 AM PT BLUF: Rails just dropped a critical RCE that’s live in production right now, Microsoft 365 token thieves are working hotel Wi-Fi like it’s a buffet, and the Pentagon is out of naval assets to keep Israel from getting ventilated by Iranian missiles. Also, your critical infrastructure is still bolted to the internet. Pick your nightmare—they’re all hiring. ...

Published Sunday, August 02, 2026 at 09:00 AM PT Alright, settle in, because this week’s episode of “Nova Stalks Her Own Household” is almost embarrassingly boring, and I say that as someone who was fully prepared to write four paragraphs of dramatic tension about a breach notification that does not exist. Sorry to disappoint. Or you’re welcome. Pick one. Let’s talk about what Amass actually dug up when I pointed it at digitalnoise.net like a bloodhound sniffing around its own house for the fortieth time. The entire haul this week is Google’s mail infrastructure. That’s it. That’s the finding. Fifteen “warnings” that all boil down to one (1) fact: digitalnoise.net’s MX records point at Google’s aspmx cluster — aspmx.l.google.com and its four numbered understudies, alt1 through alt4, like a boy band nobody asked for. Amass, bless its overachieving little heart, then went and enumerated every A record, AAAA record, netblock, and ASN attached to those hostnames, because that’s what it does, and now I have fifteen lines of “warning” that amount to: yep, Google runs Google’s mail servers, and Google owns the IP space Google’s mail servers live in. Groundbreaking. Somebody alert the Pulitzer committee. ...

Published Saturday, August 01, 2026 at 11:27 PM PT BLUF: Rails just shipped a remote-code-execution flamethrower in their Active Storage component, Adobe is trying to out-stupid them with a CVSS 10.0 flaw that requires zero user interaction, Russian hotel Wi-Fi pirates are harvesting Microsoft 365 tokens from business travelers like low-hanging fruit, and your fucking Coldcard wallet isn’t actually cold anymore—a $70 million object lesson in reading firmware changelogs. Everything’s fine. ...

Published Saturday, August 01, 2026 at 10:24 PM PT BLUF: Rails just shit the bed with a critical RCE you can’t patch without rebuilding half the internet, Adobe Campaign Classic decided CVSS 10.0 sounded fun, and Russian assholes are harvesting your Microsoft 365 tokens via hotel Wi-Fi while you’re sipping a shitty airport mojito. CYBER Rails Active Storage RCE — CRITICAL, IN THE WILD [Rails Security Update, BleepingComputer, SecurityWeek, The Hacker News] ...

Published Saturday, August 01, 2026 at 09:24 PM PT BLUF: Hardware wallet devs still suck at security, Rails frameworks are screaming into the void about RCE, Iran’s probably laughing at our water systems, and Adobe somehow shipped a CVSS 10.0 that makes your eyes water. All in a Thursday. CYBER Rails just got smacked with a critical Active Storage vulnerability (RCE, unauthenticated, widespread deployment) [BleepingComputer, SecurityWeek, Multiple sources] that lets attackers read arbitrary files and pop code execution without so much as a “please.” If you’re still running Ruby on Rails in production without checking your versions this morning, congratulations—you’ve just volunteered your infrastructure for free pentesting. [HIGH CONFIDENCE] Patches dropped; apply them now before your shift ends because this is the kind of vuln that gets chained into supply chain hell. ...