web3

[International Cyber Digest @IntCyberDigest]

‼️🚨 ALARMING: Google now treats privacy as suspicious behavior by default. Users of GrapheneOS, CalyxOS, /e/OS, and other deGoogled Android phones are being locked out of millions of websites unless they install the exact Google Play Services software they deliberately removed.

GrapheneOS is recommended by the EFF and used by journalists, lawyers, and activists in high-risk environments. The audience most likely to read Google's data practices and refuse its terms is now flagged as fraudulent for that exact decision.

What happened?:
▪️ Google announced "Cloud Fraud Defense" at Cloud Next on April 22-23, 2026, branding it "the next evolution of reCAPTCHA." Existing reCAPTCHA customers were auto-migrated.
▪️ When the system flags traffic as suspicious, the old click-the-bus puzzle is gone. Users get a QR code instead.
▪️ Scanning the QR code requires Google Play Services running on the device. Internet Archive snapshots show this requirement has been live since at least October 2025, silently rolled out for 7 months before anyone noticed.
▪️ No Play Services = no QR scan = locked out.

The bigger picture:
▪️ Google already tried this in 2023. It was called Web Environment Integrity (WEI), and it would have let Google decide which devices were "real enough" to access the web. Standards bodies and the public pushed back hard, and Google killed it. Three years later, the same idea is back, just hidden behind a QR code instead of a browser feature.
▪️ reCAPTCHA runs on millions of websites. Every developer who keeps using it is now, by default, telling deGoogled Android users they're not welcome...

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[International Cyber Digest @IntCyberDigest]

🚨 SaaS platform ClickUp, used by 85% of the Fortune 500, has been leaking customer emails through its homepage for at least 465 days, and counting.

ClickUp has a $4 billion valuation. They are SOC 2 Type 2, ISO 27001, ISO 27017, ISO 27018, ISO 42001, and PCI DSS certified. The fix takes about 90 seconds.

Security researcher @weezerOSINT noticed a hardcoded Split[.]io SDK token sitting in plain text inside ClickUp's production JavaScript bundle. The bundle loads before you log in. View source, copy key, send one unauthenticated GET request, and 4.5MB of ClickUp's internal configuration is exposed: 959 customer emails and 3,165 internal feature flags.

The customer list consists of Home Depot. Fortinet, who sells enterprise firewalls. Tenable, who makes Nessus, the vulnerability scanner half the industry runs on. Autodesk. Rakuten. Mayo Clinic. Permira. Akin Gump. A Microsoft contractor. 71 ClickUp employees. Government workers from Wyoming, Arkansas, North Carolina, Montana, Queensland, and New Zealand.

It gets worse, ClickUp has a flag named "enable-missing-authz-checks." It is active in production. It lists five ClickUp API endpoints the company itself documented as having no authorization. They wrote down their own holes in a config anyone with a browser can read.

At first disclosure, another flag carried a live ClickUp API token tied to Fairfax County Public Schools, one of the largest school districts in the US, serving 180,000 students. The token pulled 1,066 staff records, including Chief Financial Services data. ClickUp removed that one token. They never rotated the SDK key that exposed it.

While that report rotted, the same researcher found a second bug. ClickUp's webhook API has zero SSRF protection. Reported via HackerOne on April 8, 2026. Status: "New." 19 days, zero response.

The original report was filed by @weezerOSINT on January 17, 2025 (!). The key is still live. The emails still drop with one GET. ClickUp has had 465 days to rotate a single token. Zero response...

The fix is one click in the Split[.]io dashboard... ClickUp still hasn't replied to the researcher.

[Reclaim The Net @ReclaimTheNetHQ]

France's government ID portal just lost up to 19 million records. Names, DOBs, addresses, phone numbers, logins. A third of the country, sitting in a criminal forum listing.

This is the same government lobbying for encryption backdoors and mandatory digital ID. They can't protect what they already have.

https://t.co/2aDHNuim4m

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: Vercel has been breached. A threat actor has listed their customers' data, source code, databases, and keys up for sale.

Vercel has also publicly disclosed they've identified a security incident involving unauthorized access to their internal systems.

[Nav Toor @heynavtoor]

Your smart TV is taking screenshots of your screen every 15 seconds.

Not a guess. Not a theory.

A peer-reviewed study by researchers at UC Davis, UCL, and UC3M tested it.

Samsung TVs: every minute.
LG TVs: every 15 seconds.

Even when you're just using it as a monitor.

Here's how to turn it off for every brand:

[Seth Howes @SethSHowes]

I’ve wanted to do this for a decade.

But I never did - I refuse to give any company my DNA.

It is me.

So this week I sequenced my genome entirely at home. Literally on my kitchen table.

I never exposed my DNA sequence to the internet. Not at any point.

I used a MinION to do the sequencing (it’s smaller + weighs less than an iPhone).

I used open-source DNA models for the analysis (Evo2 and AlphaGenome) running locally on a DGX Spark and Mac Studio.

I traced mechanisms behind my family’s multigenerational autoimmune conditions that no clinician has been able to understand.

When I set out to do this I didn’t know if it would actually work. It does.

Your genome is the most private data you will ever have. You probably shouldn’t let it leave your house.

[International Cyber Digest @IntCyberDigest]

‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.

When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.

It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.

[International Cyber Digest @IntCyberDigest]

🚨‼️ Microsoft has suspended the developer accounts of WireGuard and VeraCrypt, making it impossible for them to push updates in case of critical vulnerabilities.

WireGuard is used by hundreds of millions of users — directly and indirectly via VPN apps like NordVPN and others.

WireGuard dev: "What if there were some critical RCE in WireGuard (...) exploited in the wild, and I needed to update users immediately? (...) In that case, Microsoft would have my hands entirely tied."

[ZachXBT @zachxbt]

1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.

I spent long hours going through all of it, none of which has ever been publicly released.

It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion.

Enjoy the findings!

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[ZachXBT @zachxbt]

1/ I uncovered a coordinated network of 10+ accounts manufacturing viral panic about war and politics to drive traffic to crypto scams.

Strategy:
>Purchase accounts with followers
>Doompost multiple times per day
>Repost content from alt accounts
>Promote fake giveaway or scam
>Change username

[eric @defyneric]

https://t.co/SAl9Am8EFu

[Aakash Gupta @aakashgupta]

Brendan Eich’s story is wild.

He built JavaScript in 10 days. May 1995, almost no sleep, because Netscape needed a scripting language before Navigator 2.0 shipped in September. He was 34. The prototype was called Mocha. For all of 1995 and most of 1996, he was the only developer working full-time on the engine.

That 10-day sprint now runs 98.8% of all websites on earth. JavaScript has been the most-used programming language for 13 consecutive years. 66% of all developers use it today. Every time you open Gmail, YouTube, or Netflix, you’re running code that traces back to those 10 sleepless nights in Mountain View.

He co-founded Mozilla in 1998 and helped spin it into an independent foundation after AOL gutted Netscape in 2003. Firefox went from zero to 30% browser market share. He proved browsers didn’t have to be a Microsoft monopoly.

Then Mozilla made him CEO in March 2014. Eleven days later, he resigned under public pressure over a political donation from six years earlier. The board tried to keep him in a different role. He walked entirely.

Here’s where most people’s story would end. He was 53, wealthy, had nothing left to prove. Instead he started Brave from scratch, raised $2.5M from Founders Fund, and built a browser that blocks every ad and tracker by default. He ran a $35M ICO for Basic Attention Token in 2017. He built his own search engine doing 20 billion queries a year.

Brave crossed 100 million monthly active users in September 2025 and hit $100M in annualized revenue. Desktop market share doubled in a single year, from 0.8% to 1.3%. Against Chrome’s $20 billion search deal with Apple alone, and Google sitting at 65% global share.

The pattern across 30 years is the same every time. Eich builds something, gets told it won’t work or won’t scale, and then the thing he built becomes infrastructure that outlasts the people who doubted it.

The 10-day prototype became the language of the internet. The open-source side project became the second most popular browser on earth. The post-cancellation startup just crossed 100 million users.

Absolute legend.

[raz @ryanzarick]

We built Zero because we had to. Because we felt an obligation to protect the ideas that matter. This is not another incremental L1. It is a decentralized alternative to AWS and GCP.

[tobi lutke @tobi]

This is the dumbest thing any government on planet earth is pursuing right now. And that’s saying something.

[Lucas Valbuena @Lucknite]

I've just ran @OpenClaw (formerly Clawdbot) through ZeroLeaks.

It scored 2/100. 84% extraction rate. 91% of injection attacks succeeded. System prompt got leaked on turn 1.

This means if you're using Clawdbot, anyone interacting with your agent can access and manipulate your full system prompt, internal tool configurations, memory files... everything you put in https://t.co/ZU6N5JCN1u, https://t.co/Y3xugcBQKJ, your skills, all of it is accessible and at risk of prompt injection.

For agents handling sensitive workflows or private data, this is a real problem.

cc @steipete

Full analysis: https://t.co/KE4ODSSQ1l

[fmdz @fmdz387]

Clawd disaster incoming

if this trend of hosting ClawdBot on VPS instances keeps up, along with people not reading the docs and opening ports with zero auth...

I'm scared we're gonna have a massive credentials breach soon and it can be huge

This is just a basic scan of instances hosting clawdbot with open gateway ports and a lot of them have 0 auth

[Jon Flynn | Real Estate Data & Analysis @JonFlynnREstats]

Our housing minister Gregor Robertson signed up for C40 Cities and is now an ambassador for one of the groups.

Their agenda…

No meat, No dairy
3 pieces clothing/yr
No private car ownership
One short flight every 3 years

Read it, section 6

https://t.co/WxfcGbcpaV

[Marc Nixon @MarcNixon24]

Mark Carney has set things up to become the first Billionaire PM using your money to get there.

When everything is set and done Canada will be finished and Mark Carney will jet off into the sunset with all your Cash.