Artur Papyan

Journalist, Blogger, Media Consultant (rt ≠ endorsement, rt = something worth checking out)

[WGSA | Women & Global Security Architecture @WGSA_inAction]

❗️Countering Hybrid Threats: What Measures Are We Taking?

Panel from the “Comprehensive Security & Resilience – 2026” International Conference.

📌 Hybrid threats are increasingly becoming primary tools of geopolitical pressure. This panel addresses their escalation across Europe & the South Caucasus, as well as concrete steps toward building state & societal resilience.

🎙️ Panelists:
Cosmin Dinescu, Head of @EUPM_Armenia
Maj. Gen. Meelis Kiili, Member of the Parliament of Estonia
@EllenHokhikyan Senior Expert, WGSA
Artur Papyan | @ditord, Co-Founder, CyberHUB-AM
Jon Searle, University of Derby

🎙️ Moderator: @Astgh_Sargsian, Presenter

#HybridThreats #FIMI #CyberSecurity #Armenia #ComprehensiveSecurity

https://t.co/PwcwzBVlkU

[Media.am @mediadotam]

Ապատեղեկատվության հոսքերը Հայաստանում ընտրական շրջանում ու ընտրություններից հետո․ Արթուր Պապյան
@ditord
https://t.co/rRCVHDS2Er

[Artur Papyan @ditord]

Our team worked on PDF-delivered spyware attack last month. It is targeting Diaspora-Armenian communities and civil society. If you've seen this attack, please let us know:
https://t.co/qMS8lv9U0z

[Poland in the OSCE @PLinOSCE]

Last week @PLinOSCE organised an event at #2026WHDC to discuss threats & impact of #FIMI on democratic elections-Armenia case. 🙏Davit Petrosyan 👉Artur Papyan/@ditord 👉Meaghan Fitzgerald/@Electioneaghan for your insightful contributions & Michalina Grzelka @NASK_pl moderation.

[Freedom House @freedomhouse]

📣 NEW: #FreedomOnTheNet 2026 is now LIVE!

Global internet freedom declined for the 16th consecutive year, as governments erected new barriers to how people access information and express themselves online. Expanding internet shutdowns, growing digital isolation, and new restrictions on online access are reshaping the global internet.

Internet freedom deteriorated in 16 of the 38 countries assessed, while just 8 registered improvements. Iran experienced the year's largest decline, joining China and Myanmar among the world's worst environments for internet freedom. Bangladesh recorded the strongest improvement for the second consecutive year, while Estonia ranked as the freest online environment.

Authoritarian governments accelerated efforts to isolate their populations from the global internet. Iranian authorities imposed the longest nationwide internet shutdown ever recorded by Freedom on the Net, cutting off most of the population for approximately 88 days. In Russia, authorities expanded internet shutdowns and consolidated control over internet service providers, advancing efforts to restrict access to the global internet.

New age-verification requirements are transforming how people access online spaces. As governments increasingly mandate age checks for social media and other online content, these measures are creating new risks to privacy, security, and online anonymity. Repressive governments have also sought to exploit such requirements to expand surveillance.

Governments are grappling with the challenges posed by artificial intelligence. New measures to address AI-generated impersonation, harassment, and other online harms have advanced, but some have raised concerns about government overreach and restrictions on free expression.

Political change has also created opportunities for progress. Bangladesh and the Gambia demonstrated how the removal of repressive leaders and sustained democratic reforms can help reverse restrictions on internet freedom, even as significant challenges remain.

As the internet undergoes seismic shifts, protecting free expression, privacy, and access to information must remain central to shaping its future.

Explore the findings, country assessments, and recommendations from #FreedomOnTheNet 2026: https://t.co/CZf8ASBe6K

[Marcus Hutchins @MalwareTechBlog]

Current information I have on php2Shell:

- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.

- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.

- Most of the PoCs being posted are completely non-functional AI slop.

- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.

- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.

- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).

- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.

[John Scott-Railton @jsrailton]

🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.

A normal-looking ad loads. If you're a target, you're infected. No click needed.

To protect yourself, block ads now.

First time it's been confirmed in the wild. We call it #AdFection.

Candiru spyware infections at @AJEnglish. 45+ devices infected.

Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.

Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.

Investigation ongoing 1/

READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : https://t.co/kU2kFMTqjY

Confiant's blog: https://t.co/pX8CWAKxTi

[Natalia Krapiva 👩🏻‍💻🕊 @natynettle]

BREAKING: @TheJusticeDept arrested US-based Oxygen Forensics CEO for concealing the tech company's Russian ties.

Civil society like @zairbekds & @OlgaNYC1211 have been sounding alarm for years about US law enforcement using this 🇷🇺 company for their sensitive operations! 🧵1/

[COP17 Armenia @COP17_Arm2026]

The world’s biodiversity conference is coming to Yerevan!
Discover the COP17 Green Zone through exhibitions, discussions, and new experiences.

19–30 October 2026
Register as an attendee!

[Varik @D4RK7ET]

My first CVE :)

CVE-2026-65395

[Sam Altman @sama]

I agree with Dario that we need to pace the frontier. This has been a primary topic of discussions we've had at OpenAI in recent weeks.

Committing to having independent evaluators with employee-like access is a great idea, and we will do the same. We'll have more to share soon.

[Bloomberg @business]

Anthropic CEO Dario Amodei said that the AI industry must slow the pace of development for new models, citing growing concerns about the “serious” risks to humans. Read more: https://t.co/3zJHAw5rP2

📷: Jason Henry/Bloomberg

[Artur Papyan @ditord]

Here's a targeted phishing attack against Armenian civil society experts and a Women's rights organization. Changing your password will not stop them. Two-factor authentication will not stop them;
https://t.co/37qWU29IBB

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij Yes, we have an agreement to organize a discussion in Parliament. And our Data Protection and Cyber teams will present our suggested amendments.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij I am looking for specialists on this, and if you are one - I would happily invite you to join our efforts.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij In fact I am consulting now with Telecom specialists, because this is beyond my team’s immediate expertise (we are on cyber and data protection), and we plan to propose a system, which would be optimal.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij This is where we can agree 100%. So I dislike it when the Government wants all of us to spend time and effort registering our phones, just because their tax collectors cannot find and punish illegelar phone importers.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij You are confusing an opt-in security event with centralized state data aggregation. Google checks a device handshake to secure an account you chose to open. The draft law mandates a state database linking Personal Identity + SIM + IMEI under penalty of service termination.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij Once the contradictions with the RA Data Protection law are addressed, only then I would engage in discussions aobut the security aspects.

[Artur Papyan @ditord]

@AUmanyan @aghavalyan @Kornelij I find it a waste of my time to dciscuss the security aspects of something, which is illegal in essence and shouldn't exist in the first place.