Praveen. ప్రవీణ్. प्रवीण. 🇮🇳

CyberSec Techie! InfoSec Engineer! Singer! Traveller! Indian! Telugu! 🇮🇳 ForcaBarça! 💙❤️

[Richard Johnson @richinseattle]

In the news today: China talking about embargoing access to their currently open weight frontier models. The internet responds.

[Revanth Reddy @revanth_anumula]

Joined students in watching the FIFA World Cup Round of 16 match between Argentina and Egypt. It was a wonderful experience to witness a contest featuring one of football's greatest icons, Lionel Messi, alongside young football enthusiasts.

The students also shared their excitement and cherished memories of Messi’s visit to Hyderabad last December.

Our Government is committed to nurturing a vibrant sporting culture in #Telangana. We will continue to create opportunities, strengthen sports infrastructure, and encourage our students to embrace football and excel on the global stage.

#FIFAWorldCup #Football #TelanganaYouth #SportsDevelopment #PrajaPrabhutvam

[World Cup 2026 @ofootball__]

🚨🇧🇷 BREAKING: Neymar Jr. has officially retired from international football. 🥹💔

[Nicolas Krassas @Dinosn]

Sec-Gemini, an experimental cybersecurity-focused AI from Google. https://t.co/JDQ5pbelDe

[International Cyber Digest @IntCyberDigest]

‼️Researchers found six wireless pre-authentication vulnerabilities in Apple AirDrop and Google/Samsung Quick Share, the proximity file-transfer protocols running on over 5 billion devices. The bugs are reachable from wireless range with no pairing.

Five are denial-of-service or protocol-manipulation flaws. One, a use-after-free in Quick Share for Windows, earned a Google bounty and is rated potentially exploitable. The team says it could not bypass the file-transfer consent prompt.

Apple, Samsung, and Google have acknowledged the reports Most are not yet patched, and no CVEs have been assigned, with one pending for the Windows bug.

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.

Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice.

A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.

[Cyber Security News @The_Cyber_News]

Anthropic's Claude Code Reportedly Uses Hidden Code to Detect Chinese Users

Source: https://t.co/GHUw99gqlL

A Reddit user detailed findings on June 30, 2026, claiming to have reverse-engineered Claude Code while attempting to restore a disabled remote control feature in version 2.1.196. During that process, he discovered obfuscated code that had been silently present since version 2.1.91, released on April 2, 2026, with no mention in the release notes.

According to the disclosure, the code performs a multi-factor check whenever a proxy is detected. It reads the system's timezone to determine whether it matches Asia/Shanghai or Asia/Urumqi, and simultaneously inspects the proxy URL against a hardcoded list of Chinese domains and known Chinese AI lab hostnames.

#cybersecuritynews

[Adam Chester 🏴‍☠️ @_xpn_]

New blog post is up looking at how LLMs are making local EDR rulesets, YARA rules, and behavioral detections trivial to extract. This post focuses on how simple the harness can be. Buckle up h4xx0rs, the next few months are gonna get interesting! https://t.co/QvzXsPA01F

[International Cyber Digest @IntCyberDigest]

Someone released what is basically an offline VirusTotal without burning your payload: a security researcher reverse-engineered four major EDRs (SentinelOne, Cortex XDR, CrowdStrike, and Sophos) and extracted their detection logic from on-disk agent binaries, ML models, YARA rules, and behavioral scripts.

The project rebuilds the kernel telemetry stack those products run on, including Windows process, thread, registry, and handle callbacks plus a file-system minifilter. It even reconstructs access to the ETW Threat Intelligence provider that Windows normally reserves for protected anti-malware processes. Thus, both the detection rules and the sensor layer can be replicated outside the vendor’s agent.

[International Cyber Digest @IntCyberDigest]

Great use of AI: Bellingcat just published how it used machine learning to surface and document civilian-harm posts on Telegram, and open-sourced the notebook.

In Bellingcat's tests, one of the strongest signals that a post showed civilian harm was the number of crying-face 😭 reactions on it.

Bellingcat ranks posts by how likely they are to show civilian harm, cutting search time so researchers can spend their hours verifying instead of scrolling. It was tested on Bellingcat's Ukraine work, which has logged 2,500+ geolocated incidents since 2022.

[Harman @itsharmanjot]

APPLE'S EULA SAYS YOU CANNOT INSTALL MACOS ON NON-APPLE HARDWARE.

A Brazilian developer named Gabriel Luchina built a one-line script that does exactly that. He runs a Portuguese Discord called Universo Hackintosh. He has been ignoring Apple's licensing terms in public for years.

The repo is called OSX-PROXMOX. It is sitting on GitHub at 7K stars.

Apple sells the cheapest Mac at $599. The cheapest Mac Studio at $1,999. They have spent decades building the legal and technical wall that says macOS only runs on their silicon.

This repo turns that wall into a single bash command:

/bin/bash -c "$(curl -fsSL https://t.co/XjnJpE6mok)"

Paste it into the Proxmox shell on any AMD or Intel box. You get a working macOS VM. Sequoia, Sonoma, Ventura, Monterey — your pick. With SIP enabled. With a properly signed OpenCore bootloader. On hardware Apple would refuse to acknowledge exists.

Here's the part Apple does not want trending:

→ It works on AMD, not just Intel
→ It supports eight macOS versions, from High Sierra to Sequoia
→ It installs in three steps from a fresh Proxmox install
→ It supports cloud deployment on VultR
→ It is maintained, with OpenCore 1.0.4 shipped April 2025

7K stars. 572 forks. 126 watchers. 12 releases. Active.

One honest note: the README explicitly says "for development, student, and testing purposes only." Apple's macOS EULA prohibits running macOS on non-Apple hardware. The legality depends on where you live and what you use it for. Read it.

Apple wants you to buy the hardware to use the software. One developer in Brazil has been quietly proving for years that the wall between them was always a license, not a chip.

Repo in the first comment.

[Cyber Security News @The_Cyber_News]

Critical python[.]org Vulnerability Allowed Attackers to Forge Admin-Level API Requests

Source: https://t.co/U2hvzUjPwb

A critical authentication bypass vulnerability in the python[.]org release management API could have allowed attackers to impersonate administrators, potentially redirecting millions of users to malicious download URLs.

The vulnerability resided in python[.]org’s release management API, where an attacker could supply an admin username paired with an arbitrary API key and have the request processed with full administrative privileges, a textbook authentication bypass.

The flaw had silently existed in the codebase since 2014, spanning over a decade of Python releases.

#cybersecuritynews

[Nicolas Krassas @Dinosn]

AI-powered offensive security agent with 7,300+ actionable security skills. Autonomous pentesting powered by MITRE ATT&CK (2,000+ Atomic tests), CIS Benchmarks (1,500+ controls), OWASP, NIST. https://t.co/IMTnJF3pht

[International Cyber Digest @IntCyberDigest]

> be Polymarket
> hacker says you're "compromised"
> make fun of hackers 😂
> "which VC paid you to post this?"
> we and half of cybersec X tell you not to taunt them
> ignore everyone
> 2 months later a third-party vendor injects a malicious script into your frontend
> ~$3M drained from user wallets, swapped to ETH
> compromised

[CentreGoals. @centregoals]

Biggest flex of our lifetime.

[International Cyber Digest @IntCyberDigest]

‼️🚨 This is really bad. According to our research, at least one of Brazil's government IT workers was infected with an infostealer. We found:

- He was doing goverment infrastructure work on his home RGB gaming PC
- He was running Windows 7 (EoL Jan 2020)
- No antivirus
- NO MFA for some critical infra
- His browser held gov VPN creds for himself and two colleagues (they were using each others creds?)
- Search history includes "ativar windows 10," "download office 2019 + ativador," "comprar office 365," and "download mobaxterm cracked"
- Malware dropped via malicious game installer
- The keys to his password managers were in the stolen browser: a LastPass account and a keypass[.]mdr[.]gov[.]br vault
- Exposed: VPN, GitLab, Jenkins, webmail, SSO, M365, and dev/staging environments across mec[.]gov[.]br and mdr[.]gov[.]br

[Bull Theory @BullTheoryio]

BREAKING: The NSA's own director says Mythos broke into almost all of its classified systems in hours.

Per The Economist, Senator Mark Warner, vice chair of the Senate Intelligence Committee, said General Joshua Rudd, who runs the NSA and the Pentagon's Cyber Command, told him this directly.

This came out on June 11, the same day Amazon reportedly found a separate jailbreak in Anthropic's models. Within hours, Trump ordered Anthropic to cut off foreign access to Mythos and Fable.

Anthropic shut both down completely instead.

Now there are two competing stories for why this actually happened.

One says the shutdown was a response to the NSA's own classified systems getting breached in hours.

The other says Anthropic is privately pushing back, calling the jailbreak minor and the shutdown an overreaction to something other AI models can already be tricked into doing.

The NSA was already using Mythos for its own cyber operations, with Anthropic engineers embedded inside the agency. The same tool the agency was actively relying on is the one its own director says broke into almost everything it owns.

[Proton Mail @ProtonMail]

If you use Gmail, you need to read this.

Google’s AI, Gemini, can read your emails, attachments, bank statements, etc.

For many, this feature was switched on without consent.

Here's how to turn it off 🧵

1/

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.