David Busby

Senior SRE, DevSecOps - Paranoia is a virtue

*** All my tweets are my own and may not reflect the opinion of my employer ***

[Signal @signalapp]

Our statement on the UK government’s demand that all content on all devices sold or used in the country be scanned, on the presumption of nudity, using a dystopian combination of age verification and content scanning. This proposal will not safeguard children. It endangers us all.

https://t.co/VdWe9uhi8p

[Lozzy B 🇦🇺𝕏 @TruthFairy131]

The UK government wants to install Spyware on all British phones to scan all content.

You will need Digital ID to access the internet soon.

The UK is part of the digital experiment & are following behind Australia.

Canada will be next.
They all signed us up to be their Guinea pigs.

They are attempting to remove personal privacy & install mass surveillance of citizens for control.

This is NOT about the kids.

[Socket @SocketSecurity]

🚨 Mini Shai-Hulud/Miasma has now spread to PyPI.

Socket found 37 malicious artifacts across 19 PyPI packages.

The packages abuse #Python .pth startup behavior to launch a Bun-powered credential stealer targeting developer, cloud, and CI/CD secrets.

https://t.co/tYhmMqvjyw

[Paul Graham @paulg]

This aged unfortunately well.

[David Busby @icleus]

When the gate is left open …

[dax @thdxr]

someone made a fork of opencode that routes through the unsecured ai endpoints from chipotle

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."

The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.

Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.

He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."

[CR1337 @CR1337]

Your phone is about to stop being yours.

Android was sold to us as an open platform.

Now Google wants every developer to register and submit ID just to let you install their apps.

Every app and every device, worldwide, with no opt-out.

[CR1337 @CR1337]

A Reddit user found out that Motorola phones have started hijacking the Amazon app to insert affiliate codes - on a phone that cost $1,900 - talk about greed..

[Nathan McNulty @NathanMcNulty]

😭

VS Code extensions are no different than browser extensions - high risk that you should be controlling with an allowlist

Yes, review and approval processes suck, but IR sucks even more

https://t.co/zsxhBhUsZN

[Grafana @grafana]

⚠️ On May 16, 2026, we confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase.

Here is the latest update about our investigations. https://t.co/C2btjWDOxu

[Daniel Hanley @danielahanley]

A perfect visualization of the enshittification of Google search. https://t.co/lEQMQwa2TV

[How To AI @HowToAI_]

Someone has open-sourced a software that sees you through walls using only WIFI signals.

It uses the signal bouncing around your house to map human bodies in real-time, through walls.

No cameras. No sensors. Just wifi.

100% Open Source.

[abhisek @abh1sek]

🚨 Major supply chain attack targeting npm is in progress. Multiple packages compromised and injected with Shai-Hulud style malware.

[email protected] (4.2M dl/mo)
[email protected] (3.8M dl/mo)
@antv/[email protected] (2.2M dl/mo)
[email protected] (1.15M)
@antv/[email protected] (1M)
@antv/[email protected] (1.1M)
@antv/[email protected] (975K)
@antv/[email protected] (883K)
@antv/[email protected] (751K)
@antv/[email protected]
[email protected] (4.2M)
[email protected] (1.15M)
@antv/[email protected] (1M)
@antv/[email protected] (975K)
@antv/[email protected] (751K)
@antv/[email protected] (1.25M)
@antv/[email protected] (547K)

[David Busby @icleus]

If you think it’s bad now, just try to fathom how bad it’s going to be after vibe coding became a thing …

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[Theo - t3.gg @theo]

Security things from the last few days:
- CopyFail (linux pwn'd)
- CopyFail 2/Dirty Frag
- 13 advisories in Next.js
- Over 70 CVEs addressed in MacOS 26.5
- ~50 CVEs addressed in iOS 26.5
- YellowKey (Windows Bitlocker pwn'd entirely)
- GreenPlasma (Windows privilege escalation)
- CVE-2026-21510 and CVE-2026-21513 confirmed to be used by Russia for Windows RCE
- CVE-2026-32202 separately confirmed to be used by Russia for sensitive document access
- Mini-Shai Hulud (over 300 JS and Python packages compromised via GitHub Action cache poisoning)
- Google confirms they have identified AI-powered exploitation of zero days in an unidentified "open-source, web-based system administration too"
- Canvas (popular LMS used in most schools) pwn'd entirely
- PAN-OS (palo alto networks) pwn'd with a 9.3 severity CVE-2026-0300

Are you scared yet?

[开发者Hailey @IndieDevHailey]

恐怖！用家Wi-Fi就能知道隔壁墙后的人在干什么！
开源项目 RuView 在GitHub已经冲到 5万+星，直接炸了！

完全不用摄像头，也不用戴任何设备，就靠家里普通的WiFi信号，就能穿墙透视：

- 隔壁有几个人、在哪个位置、是走路还是躺着，全看得见
- 实时看人体姿态（17个关键点）
- 睡觉时自动测呼吸和心率
- 有人跌倒立刻报警，动作识别超准

用WiFi CSI + AI，把你家路由器直接变成隐形雷达！
没有视频、没有录像，隐私安全拉满，天然符合GDPR，完全本地跑，不上云。
ESP32几块钱就能玩，Docker零硬件也能直接试。

[Summer Yue @summeryue0]

Nothing humbles you like telling your OpenClaw “confirm before acting” and watching it speedrun deleting your inbox. I couldn’t stop it from my phone. I had to RUN to my Mac mini like I was defusing a bomb.

[FRUT 🦈 @fruttymoment]

There is a whole game explaining why this is a bad idea.

[David Busby @icleus]

When the technical implementation fails to live up to expectations; who the F decided "good enough ship it" ... SMH

[Chibi Reviews @ChibiReviews]

YouTube will be forced to push Pro-Censorship propaganda from the UK Government onto everyone's homepage soon. Creators are also starting to say YouTube is censoring this topic on their entire site

So please share this video for the algorithm. https://t.co/FWEagqdxAG

[Chibi Reviews @ChibiReviews]

YouTube will be forced to push Pro-Censorship propaganda from the UK Government onto everyone's homepage soon. Creators are also starting to say YouTube is censoring this topic on their entire site

So please share this video for the algorithm. https://t.co/FWEagqdxAG