You may know him as Churchill, but his journey had many names before the legend arrived. We are now HFCB; our new name reflects where we’ve been, who we’ve become and the great we continue to create.
#GreatHasANewName#HFCB@MwalimChurchill
Our Great Name is HFCB! Our new chapter unifies our Group & all its subsidiaries under a single, cohesive & forward looking brand; offering fully integrated financial services & property solutions. #MyGreatName#HFCB
🚨 Supply chain attack on the Laravel Lang organization:
700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including:
laravel-lang/lang
laravel-lang/http-statuses
laravel-lang/attributes
Laravel-Lang/actions
The payload targets cloud creds, CI/CD secrets, Kubernetes tokens, Vault, browser data, password managers, SSH keys, and more.
A https://t.co/BK90gRSvj3 backdoor is mentioned in both @Microsoft's npm report and @step_security's report (Nx Console VS Code compromise)
I've uploaded it and other components to @objective_see's public Mac malware collection: https://t.co/kEVCHpLmhR (pw:infect3d)
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.
https://t.co/mkWHznV6lS
Microsoft has released mitigations addressing the “YellowKey” BitLocker bypass vulnerability (CVE-2026-45585), which impacted Windows 11 version 26H1, 24H2, 25H2 for x64 Systems, Windows Server 2025, and Windows Server 2025 (Server Core installation).
https://t.co/La9PlNEnNh
WPScan 4.0.0 is out - great to see continued innovation in WordPress security.
Solid tool for vulnerability scanning WordPress environments and staying ahead of threats. 🔐
#WPScan#WordPress#CyberSecurity
software engineering in 2026:
- your package manager is compromised
- your cloud provider blocks your account
- github itself is hacked
software is solved
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
🚨 BREAKING: Xabi Alonso has accepted to become Chelsea next manager, HERE WE GO! 🔵🔜
The agreement is set to be completed.
#CFC prepare official announcement for the upcoming days, but Xabi said YES. 💣
Anthropic’s Mythos just hacked macOS helped researchers find a macOS kernel exploit
Apple is reviewing it now.
The AI found the vulnerability. Wrote the exploit. Delivered a 55-page report to Apple in Cupertino.
We are so cooked
Every 3rd website you visit runs Nginx.
18,959,833 of them can be hijacked right now.
A bug from 2008 just got a working exploit.
CVE-2026-42945 (CVSS 9.2)
No login. No access. Just one HTTP request.
→ Heap overflow → Worker process → RCE
Patch ASAP to Nginx 1.31.0 or 1.30.1
PoC is already out:
https://t.co/O4556KGjqD