Pack

cybersec mcnulty // opinions are my own // yinzer ➡️ yall

[Skratch @Skratch]

Another friendly reminder: golf balls on the golf course are NOT souvenirs.

[Cory Smith @RCorySmith]

Stanley Cup Celebration will be on Saturday at 11 a.m. in downtown Raleigh!

[vx-underground @vxunderground]

"Bro it's so totally badass and scary, I swear bro, like, the GOVERNMENT is censoring us bro, I swear!!! It's like, sooo hardcore bro, for real" - Anthropic on their totally real and scary product

[Rachel Tobac @RachelTobac]

Just worked w/ @CNN on a piece about why I wouldn't upload full financial docs (tax docs, statements, etc) to AI tools due to leakage & hacking risk.
I don't recommend connecting bank accounts to AI tools. It becomes a 1 stop shop for attackers looking to drain your accounts🤖💸

[Carolina Hurricanes @Canes]

WHO WANTS A BEER SKATE?!

RT for your chance to win the hottest drinking device in sports.

[Nick Carboni @NickCarboniWCNC]

During the week at Quail Hollow Club for the @TruistChamp, @JustinThomas34 has made a "significant" contribution to First Tee of Greater Charlotte. While no figure was given, I'm told it will allow over 350 kids to attend the organization's camp this summer. @wcnc @FirstTeeGC

[Pulp Librarian @PulpLibrarian]

I regret to inform you that Ask Jeeves is dead. The site closed yesterday. Web 1.0 lost another founder.

Ask Jeeves: 3 June 1996 - 1 May 2026. Send no memes.

[Underdog Golf @UnderdogGolf]

Alex Fitzpatrick taps in the winning putt and earns his PGA Tour card through 2028.

He’s also exempt into 2026 PGA Championship, 2027 Players Championship, and the remaining 2026 signature events.

[vx-underground @vxunderground]

There is a project on GitHub called Axios.

Axios is extremely popular. It is used by millions upon millions of applications.

Axios is a programming library that helps your JavaScript code make HTTP/S requests (communicate with websites).

In simple terms, if you're a programmer doing something with JavaScript, and want to do stuff that communicates with a website in literally any capacity, people heavily recommend using Axios due to its simplicity. Using Axios you don't have to reinvent the wheel and do a bunch of work. All you need to do is import Axios into your code and you're off to the races.

Someone (currently unknown) compromised Axios (currently unknown how) to deliver malware to people. When someone updates or installs Axios, Axios itself contains malware.

What the malware does is (currently) unknown, but it is being reversed engineered by probably every malware analyst on the planet at this moment. In a few hours more details will emerge. Information is being exchanged in real time on social media and private communication platforms as I write this.

Due to the size and popularity of Axios, it is unknown how many are impacted, it could be millions, it could be thousands, or if we're lucky, only hundreds of people or organizations will be impacted.

If this is absolute worst case scenario, millions of organizations across the planet have been infected with malware which (currently) we do not understand. However, the likelihood of this is low. It appears Axios being compromised was detected quickly, potentially within minutes (or hours) of it being compromised to deliver malware. Additionally, the likelihood of every single Axios user updating Axios as soon as it was compromised to deliver malware is astronomically low. It is basically zero.

The impact from Axios being compromised is devastating, the fallout from this will be a massive headache. This is unironically a malware nuclear missile and will likely be studied in the future.

[Pack @jkopacko]

Big AKim fan back in the day before his injuries. Love to see the comeback regardless of where.

[Flushing It @flushingitgolf]

Anthony Kim makes 9 birdies for a final round 63 to win LIV Golf Adelaide by 3 shots over Jon Rahm.

He didn’t play golf for 12 years. Was relegated. Re-qualified. Now he’s won.

This is one of the greatest comeback stories in sporting history. Truly astonishing.

[Pack @jkopacko]

Kim story is cool.

Rahm and Bryson leading in a tournament where the field is watered down like melted ice…. Eh.

[Dan Rapaport @Daniel_Rapaport]

Rahm and Bryson tied for the lead in Adelaide with Anthony Kim solo third. LIV couldn’t have drawn it up any better for by far their biggest and best event.

[vx-underground @vxunderground]

Yeah, so pretty much, like, there is this really sketchy company in Israel named "Paragon". Paragon sells a "product" called GRAPHITE.

Let me explain the background and why this is very silly.

GRAPHITE spyware which allows "customers" to remotely access peoples cell phones and monitor their instant messaging applications such as WhatsApp

It is spyware. It is sometimes called Mercenary Spyware because it is primarily used by governments to spy on political enemies, journalists, and activists.

Very little is known about Paragon, GRAPHITE, and their "customers". However, it was publicly noted by the Trump administration in January, 2025, to be purchased by the United States government and to be used to aid ICE.

Furthermore, in September 2025 the Trump administration noted the usage of Graphite to aid the United States against "domestic terrorist organizations" such as "ANTIFA".

ICE acting director Todd Lyons noted using GRAPHITE to monitor anti-ICE protestors to track "ringleaders and professional agitators".

Citizen Lab and other civil rights organizations have documented the usage of GRAPHITE against individuals in Australia, Canada, Cyprus, Denmark, Israel, Singapore and (unsurprisingly) the United States. It is believed the Canadian government actively uses GRAPHITE in Ontario.

Okay, so why does all of this matter? Yeah, it's super fucked up. But today representatives from Paragon accidentally leaked GRAPHITE screenshots ... ON LINKEDIN. Dawg, that image in the background IS GOVERNMENT FUCKING SPYWARE

It shows phone numbers in Czechia, apps, accounts, media on the phone, "interception status", and phone numbers extracted. THEY LEAKED IT BY ACCIDENT ON LINKEDIN WHILE TAKING SELFIES

[Pack @jkopacko]

This was eradicated in 2024.

https://t.co/76gQCrnjI0

[Hedgie @HedgieMarkets]

🦔 A service called Spy Pet has been scraping Discord, pulling data from over 10,000 servers. They claim to have data on 600 million users and 3 billion messages. Anyone can look up a specific user's activity across servers for about 10 cents in crypto. The data is being sold to law enforcement and to companies training AI models. Meanwhile, Discord just announced that starting next month, users will need a face scan or government ID for full access.

My Take
Discord feels private because it's fragmented. You're in a Minecraft server here, a crypto server there, maybe a work community somewhere else. But Spy Pet stitches all of that together into one searchable profile. Everything you posted, everywhere you posted it, available to anyone with a dime and a crypto wallet. You didn't consent to cops reading your gaming chat. You didn't consent to your conversations training some AI model. But consent stopped being the point a long time ago.

And now Discord wants your face. They say it's to protect teens. One of their third-party vendors had a data breach last year that exposed users' ID images. So the platform that already let your data get scraped and sold is asking you to trust them with your biometrics. If it's not encrypted, assume it's being harvested. Discord isn't a private space. It's a public one that feels private, which is almost worse.

Hedgie🤗

[Joe Pompliano @JoePompliano]

Many people believe the NFL is making a political statement by picking Bad Bunny to perform at the Super Bowl, but I really think it's as simple as...

1. He's the world's most popular artist

2. Having him perform advances the NFL’s long-stated goal of international expansion

3. Picking someone with little overlap with the average NFL fan will help the league set a new viewership record — Americans will watch no matter what, and Bad Bunny pulls in new viewers who might not have tuned in otherwise.

Music aside, it makes a lot of business sense.

[SportsCenter @SportsCenter]

THIS RIVALRY DOES NOT DISAPPOINT ‼️

SETH TRIMBLE GAME-WINNER FOR NORTH CAROLINA 🔥

[Pack @jkopacko]

This isn’t complicated. Wesley isn’t actually a star. Brooks is.

[NUCLR GOLF @NUCLRGOLF]

🚨🗣️🚫 NOT NECESSARY — Suspended PGA Tour star Wesley Bryan reveals that after Brooks Koepka was permitted to return, his wife sent a detailed and thoughtful letter to the Tour, but the response they received was that “no conversation is necessary.”

Bryan remains suspended for participating in a LIV / YouTube influencer event.

➡️ Is it time to free Wesley?

(🎥: @DanOnGolfShow / @Skratch)

[NUCLR GOLF @NUCLRGOLF]

🚨👀🏝️ #NEW — Akshay Bhatia has been introduced as Jupiter Links GC’s ‘official alternate’ on TGL this season. The team will play their first match next week and Tiger Woods is not expected to be available to play until later in the season. @TWlegion

[PUBLORD @publord]

I miss this crazy bastard teaching us how to make a "Get Ready for Work" vodka. Godspeed wherever you may be sir. Fckn legend. 😂

[Dave Jones @eevblog]

IMPORTANT message for everyone using Gmail.
You have been automatically OPTED IN to allow Gmail to access all your private messages & attachments to train AI models.
You have to manually turn off Smart Features in the Setting menu in TWO locations.

Retweet so every is aware.

[Joe Pompliano @JoePompliano]

Apple TV is eliminating MLS Season Pass next year.

Rather than making subscribers pay an additional fee to access MLS content, all of the league's matches will be available to every Apple TV subscriber with their standard plan.

This is also how the Formula 1 deal will work.