Our statement on the UK government’s demand that all content on all devices sold or used in the country be scanned, on the presumption of nudity, using a dystopian combination of age verification and content scanning. This proposal will not safeguard children. It endangers us all.
https://t.co/VdWe9uhi8p
The UK government wants to install Spyware on all British phones to scan all content.
You will need Digital ID to access the internet soon.
The UK is part of the digital experiment & are following behind Australia.
Canada will be next.
They all signed us up to be their Guinea pigs.
They are attempting to remove personal privacy & install mass surveillance of citizens for control.
This is NOT about the kids.
🚨 Mini Shai-Hulud/Miasma has now spread to PyPI.
Socket found 37 malicious artifacts across 19 PyPI packages.
The packages abuse #Python .pth startup behavior to launch a Bun-powered credential stealer targeting developer, cloud, and CI/CD secrets.
https://t.co/tYhmMqvjyw
‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."
The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.
Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.
He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."
Your phone is about to stop being yours.
Android was sold to us as an open platform.
Now Google wants every developer to register and submit ID just to let you install their apps.
Every app and every device, worldwide, with no opt-out.
A Reddit user found out that Motorola phones have started hijacking the Amazon app to insert affiliate codes - on a phone that cost $1,900 - talk about greed..
😭
VS Code extensions are no different than browser extensions - high risk that you should be controlling with an allowlist
Yes, review and approval processes suck, but IR sucks even more
https://t.co/zsxhBhUsZN
⚠️ On May 16, 2026, we confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase.
Here is the latest update about our investigations. https://t.co/C2btjWDOxu
Someone has open-sourced a software that sees you through walls using only WIFI signals.
It uses the signal bouncing around your house to map human bodies in real-time, through walls.
No cameras. No sensors. Just wifi.
100% Open Source.
Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300
Are you scared yet?
Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300
Are you scared yet?
Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox. I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.
YouTube will be forced to push Pro-Censorship propaganda from the UK Government onto everyone's homepage soon. Creators are also starting to say YouTube is censoring this topic on their entire site
So please share this video for the algorithm. https://t.co/FWEagqdxAG
YouTube will be forced to push Pro-Censorship propaganda from the UK Government onto everyone's homepage soon. Creators are also starting to say YouTube is censoring this topic on their entire site
So please share this video for the algorithm. https://t.co/FWEagqdxAG