Karlouse

Those who HATE expect the worst but those who LOVE never lose hope.

[Spencer Baggins @bigaiguy]

A French engineer who lives quietly in Paris has spent 30 years writing software that the entire internet now runs on without knowing his name.

He wrote the code that streams every YouTube video, every Netflix show, every TikTok clip. He wrote the code that runs the virtual servers underneath AWS, Google Cloud, and Microsoft Azure. He calculated more digits of pi than anyone in history. He has no Twitter. He has no marketing. He just keeps shipping.

His name is Fabrice Bellard.

Here is the story, because almost nobody outside the systems programming world knows what one man has built.

Fabrice was born in 1972 in Grenoble, France. He studied at École Polytechnique, the top French engineering school. He never went to Silicon Valley. He never built a startup empire. He just wrote code.

In 2000 he started a project called FFmpeg, an open-source multimedia framework for encoding, decoding, and streaming video. He was 28. The project did one thing nobody else had done well. It handled every video and audio format that existed, in one library, on every operating system. He led it himself for years.

Today FFmpeg is the invisible engine of the internet. YouTube uses it. Netflix uses it. VLC uses it. Chrome and Firefox use parts of it. Every Android phone, every iPhone, every smart TV, every video editing tool you have ever touched runs FFmpeg somewhere underneath. If you have watched a video on a screen in the last 20 years, Fabrice's code processed it.

He was not done.

In 2003 he started QEMU, a machine emulator and virtualizer. He wrote it solo until version 0.7.1 in 2005. QEMU lets you run any operating system on any other operating system. It became the foundation of modern virtualization. KVM, the Linux kernel hypervisor, runs on top of QEMU. Every major cloud provider, AWS, Google Cloud, Microsoft Azure, IBM Cloud, runs virtual machines on infrastructure built around it. The Quick Emulator is the most cited piece of cloud infrastructure code on Earth.

He kept going.

In 2001 he won the International Obfuscated C Code Contest with a small C compiler that grew into TCC, the Tiny C Compiler. TCC can compile and boot a Linux kernel from source in under 15 seconds. In 2004 he calculated the most digits of pi ever computed at the time, using a personal desktop computer and an algorithm he derived himself called Bellard's formula. In 2011 he wrote a complete PC emulator in pure JavaScript that runs Linux in your browser, a project called JSLinux that engineers still cannot believe is real.

In 2019 he released QuickJS, a small but complete JavaScript engine that fits where V8 cannot. In 2021 he released NNCP, a neural network based lossless data compressor that immediately took the lead on the Large Text Compression Benchmark.

Then he turned his attention to large language models. He built TextSynth Server, a web server with a REST API for running LLMs locally. He released ts_zip and ts_sms, compression utilities that use language models to compress text and short messages at ratios traditional algorithms cannot reach. He released TSAC, a very low bitrate audio compression system. In December 2025 he released Micro QuickJS, a new JavaScript engine for microcontrollers, separate from QuickJS, designed for environments with almost no memory.

Fabrice co-founded a telecom company called Amarisoft in 2012, where he serves as CTO. Amarisoft builds 4G and 5G base station software used by carriers and labs around the world. He has been running it for over a decade while continuing to ship personal projects from his own home page at bellard dot org

He has no Twitter. He has no Instagram. He gives almost no interviews. His personal website is a flat list of projects with no styling, no fonts, no marketing copy. Just titles and links.

A quiet French engineer who never moved to Silicon Valley wrote the code that quietly runs the internet.

He is still shipping.

[Dark Web Intelligence @DailyDarkWeb]

🇿🇦 South Africa: Webafrica Customer Database Allegedly Advertised for Sale

* Threat actor claims to be offering data allegedly sourced from Webafrica, a South African internet service provider

* The listing advertises approximately 742,000 records containing customer, subscription, and support-related information

* According to the seller, the dataset is organized into three primary categories:
* Customer contact records
* Internet service subscription information
* Customer support case data

* Allegedly exposed customer information includes:
* Full names
* Dates of birth
* Email addresses
* Mobile and landline phone numbers
* Physical and mailing addresses
* Postal codes
* Customer segmentation details
* Language preferences
* Account tier information
* Marketing preferences
* Login activity
* Assigned account managers
* Contact scores and lifecycle status

* The subscription dataset reportedly contains:
* Subscription identifiers
* Service plan information
* Activation and expiration dates
* Monthly fees
* Payment methods
* Outstanding balances
* Contract durations
* Data usage statistics
* Internet speed tiers
* Installation dates
* Service provider information
* Account management details
* Service termination reasons

* The support case section allegedly includes:
* Customer support tickets
* Issue descriptions and categories
* Resolution notes
* Assigned support personnel
* Escalation levels
* SLA deadlines
* Customer satisfaction scores
* Interaction histories
* Follow-up records
* Internal support notes

* The threat actor is advertising the dataset as containing customer communications, subscription records, and support case information from the organization

* At the time of reporting, Daily Dark Web has not independently verified the authenticity of the dataset or the claims made by the threat actor

Analyst Note:

Telecommunications and ISP datasets are particularly valuable because they combine identity information, billing records, service usage data, and customer support interactions. If authentic, such information could facilitate highly targeted phishing campaigns, SIM-swap preparation, account takeover attempts, customer impersonation, and business email compromise operations against both customers and employees.

#DDW #Intelligence #Webafrica #DarkWeb

[MyBroadband @mybroadband]

Hackers infiltrated South Africa's top supercomputer and used it to mine cryptocurrency, the Centre for High Performance Computing has told users. https://t.co/lEzumtmutN

[Dark Web Intelligence @DailyDarkWeb]

🇿🇦 A threat actor operating under the name “Nullsec” is claiming responsibility for compromising State Information Technology Agency (SITA), the government-owned IT agency responsible for providing technology services to multiple South African state institutions.

According to the underground post, the alleged leak contains:
• names
• Gmail addresses
• password hashes
• plaintext/non-hashed passwords
• platform access information

The actor also references a downloadable leak package, suggesting the data is being publicly distributed rather than used solely for private extortion.

This is particularly significant because SITA plays a critical role in South Africa’s governmental digital infrastructure and supports numerous public-sector services and departments.

If authentic, even limited credential exposure tied to SITA environments could create risks including:
• government account compromise
• credential stuffing across public-sector systems
• phishing against officials
• lateral movement into connected agencies
• intelligence collection operations
• impersonation attacks targeting government personnel

The mention of both:
• hashed passwords
• non-hashed passwords
is especially concerning because it may indicate:
• poor credential storage practices
• plaintext credential exposure in logs/configurations
• legacy systems
• improperly secured exports

Another notable detail:
the actor specifically references “platform of entry,” which may imply:
• initial access vectors
• exposed panels
• compromised portals
• reused credentials
• third-party vendor access

From a geopolitical and cyber-intelligence perspective, government IT agencies remain extremely high-value targets because they often act as centralized technology hubs connecting:
• ministries
• citizen services
• procurement systems
• government email infrastructure
• identity systems
• interdepartmental platforms

Compromising a centralized IT provider can create cascading downstream exposure across multiple agencies.

At this stage, the authenticity and scope of the claims remain unverified.

Possible scenarios include:
• partial credential leak
• recycled datasets
• old credential dumps
• third-party contractor compromise
• phishing-derived access
• exposed development systems
• limited internal panel exposure rather than full infrastructure compromise

Still, organizations connected to public-sector ecosystems should immediately review:
• password reuse exposure
• MFA enforcement
• privileged account activity
• SSO integrations
• VPN access logs
• credential rotation policies
• exposed admin portals
• government contractor access
• suspicious authentication attempts

This incident also reflects a broader trend:
threat actors increasingly target centralized government technology providers because compromising one operational hub can potentially provide access paths into multiple institutions simultaneously.

🇿🇦 #DDW #Intelligence #CyberSecurity #SouthAfrica #SITA #DarkWeb #ThreatIntelligence #GovernmentSecurity #DataLeak #OSINT #Infosec #CyberThreats #CredentialLeak #PublicSectorSecurity

[mark 🇿🇦 @markmywords]

🚨 BREAKING BOMBSHELL ALERT! 🚨

Auditors just blew the lid off a MASSIVE SCANDAL at the Compensation Fund – missing files, PHONY bank accounts, cyber security DISASTER, and a JAW-DROPPING R71 MILLION vanished into thin air over just TWO years!

Heads MUST roll! 😱

@CompensationFnd @UIFBenefits

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Karlouse @Karlouse]

@MokoenaDee @CLK_141 Uzosifaka enkingeni 😏

[ParrotOS @MokoenaDee]

This is no longer the time for slow bureaucracy, denial, or PR spin.

Bring together DFIR specialists, threat intelligence teams, telecoms, banks, state cyber units, private-sector responders, ISPs, cloud providers, and infrastructure operators into one coordinated response structure.

Because the people targeting South African systems are clearly organised, motivated, and escalating. And they are not joking.

[Yasir Ai @AiwithYasir]

🚨BREAKING: Two researchers from UPenn and Boston University just published a paper that should be uncomfortable reading for every CEO automating their workforce right now.

The argument is straightforward. Every company replacing workers with AI is also eliminating its own future customers. Laid off workers stop spending. Enough of them stop spending and nobody can afford to buy anything. The companies that fired everyone end up selling into an economy with no purchasing power left.

Every executive can see this. The math is not complicated. But here is why nobody stops.

If you do not automate, your competitor does. They cut costs, lower prices, take your market share, and you collapse anyway. So every company automates knowing it is collectively destructive because the alternative is dying alone while everyone else survives. The researchers proved this is a Prisoner's Dilemma playing out in real time.

The numbers are already moving. Block cut nearly half its 10,000 employees this year. Jack Dorsey said AI made those roles unnecessary and that within the next year the majority of companies will reach the same conclusion. Salesforce replaced 4,000 customer support agents with AI. Goldman Sachs deployed a coding tool that lets one engineer do the work of five. Over 100,000 tech workers were laid off in 2025 and AI was cited as the primary driver in more than half those cases. 80% of US workers hold jobs with tasks susceptible to AI automation.

The researchers tested every proposed solution. Universal basic income does not change a single company's incentive to automate. Capital income taxes adjust profit levels but not the per-task decision to replace a human. Collective bargaining cannot hold because automating is always the dominant strategy.

They also identified what they call a Red Queen effect. Better AI does not solve the problem, it accelerates it. Every company chases faster automation to gain market share over rivals but at the end everyone has automated equally, the gains cancel out, and the only thing left is more destroyed demand.

The one thing the math says could work is a Pigouvian automation tax. A per-task charge that forces companies to account for the demand they destroy each time they replace a worker.

The conclusion is that this is not a transfer of wealth from workers to owners. Both sides lose. Workers lose income. Companies lose customers. It is a deadweight loss with no market mechanism to stop it on its own.

(Link in the comment)

[Dark Web Intelligence @DailyDarkWeb]

🇹🇷 🇿🇦 Fresh Access Listings Target Companies in Turkey & South Africa

A threat actor has posted multiple initial access listings on a dark web marketplace, targeting organizations across energy, education, construction, aerospace, retail, and media sectors.

📊 Key Access Types:
• SSH (Local Admin / Root)
• Citrix Gateway (Domain User)
• RDP (Server Admin)
• RDWeb (Cloud Admin / Owner)
• VPN (SYSTEM-level access)

🌍 Targeted Regions:
• 🇿🇦 South Africa: Energy, University, Construction, Aerospace
• 🇹🇷 Turkey: Retail/E-commerce, Media/Publishing

🛡️ Security Stack Observed:
• Sophos, CrowdStrike Falcon, SentinelOne, Kaspersky
• Some listings claim “no EDR detected”

🧠 Threat Intelligence Insight:
• These are not exploits — they are ready-to-use access points
• Typically leveraged for:

Ransomware deployment
Data exfiltration
Lateral movement within enterprise networks
Presence of EDR does not prevent access resale — it only raises attacker cost

⚠️ Potential Risks:
• Full enterprise compromise
• Supply chain impact across sectors
• High-value targets with significant revenue exposure

📊 Status: Unverified — based on underground marketplace listings

⸻

💬 The most dangerous breaches are the ones already inside — and for sale.

#CyberSecurity #ThreatIntel #DarkWeb #Ransomware #InitialAccess #EDR #DDW

[Karlouse @Karlouse]

@MokoenaDee Can’t help but wonder why the sudden interest or is something brewing!

[Karlouse @Karlouse]

Is it just me or does it feel like South African companies have been getting hit way more than usual lately? The last few months have been rough from a breach perspective. 🤔

[Karlouse @Karlouse]

The scary part isn’t the initial access, it’s that someone can move around the environment freely (a bank at that) and nothing triggers. No SOC noise, just quiet lateral movement happening under the radar.

[Dark Web Intelligence @DailyDarkWeb]

🇿🇦 Alleged Breach of Standard Bank & Liberty Holdings Systems

A threat actor claims to have gained access to systems belonging to Standard Bank and Liberty Holdings, maintaining persistence for over 3 weeks before exfiltration.

📊 Key Claims:
• Access reportedly obtained in late February
• Lateral movement across multiple enterprise platforms:
•SharePoint
•OneDrive
•PowerApps
•Jira / Confluence
•Citrix & internal tools
• Databases impacted:
•Microsoft & Oracle SQL environments

📦 Data Exposure:
• Claimed exfiltration of 1.2 TB of data
• Includes:
•~154 million SQL rows
•Customer-related records (unverified)

🧠 Threat Intelligence Insight:
• The attack suggests:
•Deep internal access, not surface-level breach
•Possible compromise of:
•Identity systems
•Enterprise SaaS integrations
• Multi-platform movement indicates:
•Weak segmentation or excessive trust between systems

⚠️ Risk Implications:
• Financial sector targeting → high-value data
• Potential for:
•Fraud
•Identity theft
•Secondary attacks using internal access

📊 Status: Unverified — no official confirmation yet

⸻

💬 Multi-platform lateral movement across SaaS and internal systems continues to be a major blind spot for large enterprises.

#CyberSecurity #DataBreach #ThreatIntel #Banking #DarkWeb #CTI #DDW

[NinjaOne @ninjaone]

Perfect security policies don’t exist because they don’t reflect reality.

@techspence shares real-world lessons on patching, CIS benchmarks, and designing policies that actually work.

Security should enable operations. Not fight them. 👇
https://t.co/xONEvs38Hn

[Karlouse @Karlouse]

@CindyPoluta I'm in the East Rand and we woke up asking the same question.

[Karlouse @Karlouse]

Been scratching my head with this article, what is “keystroke lag” and how do you even begin to monitor it? 🤔

[INFOSEC F0X 🔥 @infosec_fox]

This is how they found out:

“Keystroke data from the laptop of a worker who was supposed to be in US should have taken tens of milliseconds to reach Amazon’s Seattle headquarters. Instead, the flow from this machine was more than 110 milliseconds…”

[Karlouse @Karlouse]

@MTNza how does a fixed term contract (both parties agreed on) change on the fly and I don’t even have an opportunity to contest the changes?

[Peter Girnus 🦅 @gothburz]

Last quarter I rolled out Microsoft Copilot to 4,000 employees.

$30 per seat per month.

$1.4 million annually.

I called it "digital transformation."

The board loved that phrase.

They approved it in eleven minutes.

No one asked what it would actually do.

Including me.

I told everyone it would "10x productivity."

That's not a real number.

But it sounds like one.

HR asked how we'd measure the 10x.

I said we'd "leverage analytics dashboards."

They stopped asking.

Three months later I checked the usage reports.

47 people had opened it.

12 had used it more than once.

One of them was me.

I used it to summarize an email I could have read in 30 seconds.

It took 45 seconds.

Plus the time it took to fix the hallucinations.

But I called it a "pilot success."

Success means the pilot didn't visibly fail.

The CFO asked about ROI.

I showed him a graph.

The graph went up and to the right.

It measured "AI enablement."

I made that metric up.

He nodded approvingly.

We're "AI-enabled" now.

I don't know what that means.

But it's in our investor deck.

A senior developer asked why we didn't use Claude or ChatGPT.

I said we needed "enterprise-grade security."

He asked what that meant.

I said "compliance."

He asked which compliance.

I said "all of them."

He looked skeptical.

I scheduled him for a "career development conversation."

He stopped asking questions.

Microsoft sent a case study team.

They wanted to feature us as a success story.

I told them we "saved 40,000 hours."

I calculated that number by multiplying employees by a number I made up.

They didn't verify it.

They never do.

Now we're on Microsoft's website.

"Global enterprise achieves 40,000 hours of productivity gains with Copilot."

The CEO shared it on LinkedIn.

He got 3,000 likes.

He's never used Copilot.

None of the executives have.

We have an exemption.

"Strategic focus requires minimal digital distraction."

I wrote that policy.

The licenses renew next month.

I'm requesting an expansion.

5,000 more seats.

We haven't used the first 4,000.

But this time we'll "drive adoption."

Adoption means mandatory training.

Training means a 45-minute webinar no one watches.

But completion will be tracked.

Completion is a metric.

Metrics go in dashboards.

Dashboards go in board presentations.

Board presentations get me promoted.

I'll be SVP by Q3.

I still don't know what Copilot does.

But I know what it's for.

It's for showing we're "investing in AI."

Investment means spending.

Spending means commitment.

Commitment means we're serious about the future.

The future is whatever I say it is.

As long as the graph goes up and to the right.

[Karlouse @Karlouse]

Just remember, all those 🍎 ⌚️ couldn’t buy Steve Jobs a sec

[Karlouse @Karlouse]

Must have been DNS #Cloudflare