🚨 Odido CEO Søren Abildgaard says he will NOT compensate the 6.2 million customers exposed in February's ShinyHunters breach. Instead, he "promises to learn from this experience." (how nice of him)
Abildgaard claims no investigation has shown Odido broke any rules. Which is weird, since there are a lot of preventive measures they could've taken so their Salesforce didn't get drained of data. Salesforce has also been proactively contacting customers to help them harden and prevent attacks like the one Odido fell victim to.
Abildgaard also sent a video of himself to every customer today, where he is clearly reading text he got from the judicial department off a teleprompter. No empathy at all.
Context:
- ShinyHunters breached Odido on Feb 5 and 6 via voice phishing, impersonating internal IT staff
- ShinyHunters then accessed Odido's Salesforce, which they were able to DRAIN to the last drop
- Names, addresses, phone numbers, bank accounts, ID numbers, IBANs and DOBs of 6.2M current and former customers were stolen
- Odido refused to pay the ransom. The data was then dumped on the dark web
- Odido customers are now actively being targeted by criminals using the leaked data
- A class action by CUIC and a criminal investigation by the Dutch Public Prosecution Service are already running
Abildgaard claims no investigation has shown Odido broke any rules. Which is weird, since there are a lot of preventive measures they could've taken so their Salesforce didn't get drained of data. Salesforce has also been proactively contacting customers to help them harden and prevent attacks like the one Odido fell victim to.
Abildgaard also sent a video of himself to every customer today, where he is clearly reading text he got from the judicial department off a teleprompter. No empathy at all.
Context:
- ShinyHunters breached Odido on Feb 5 and 6 via voice phishing, impersonating internal IT staff
- ShinyHunters then accessed Odido's Salesforce, which they were able to DRAIN to the last drop
- Names, addresses, phone numbers, bank accounts, ID numbers, IBANs and DOBs of 6.2M current and former customers were stolen
- Odido refused to pay the ransom. The data was then dumped on the dark web
- Odido customers are now actively being targeted by criminals using the leaked data
- A class action by CUIC and a criminal investigation by the Dutch Public Prosecution Service are already running
🤣10😱3🤔1
🚨 Signal shipped new in-app confirmations and educational prompts to help users spot scammers impersonating "Signal Support."
The change follows the March takeover of Arndt Freytag von Loringhoven, former Vice President of Germany's foreign intelligence service (BND), Bundestag President and Christian Democrat (CDU) Julia Klöckner, and roughly 300 other German officials.
The campaign has been attributed to Russia by German and Dutch intelligence.
The change follows the March takeover of Arndt Freytag von Loringhoven, former Vice President of Germany's foreign intelligence service (BND), Bundestag President and Christian Democrat (CDU) Julia Klöckner, and roughly 300 other German officials.
The campaign has been attributed to Russia by German and Dutch intelligence.
🤣7😭3❤1🥴1
‼️🚨 Microsoft has patched a critical Windows DNS Client remote code execution vulnerability that allows an unauthorized attacker to execute code over a network. All it takes is a malicious DNS response.
The vulnerability is tracked as CVE-2026-41096 with a CVSS score of 9.8. It is a heap-based buffer overflow in dnsapi.dll, the Windows component that processes DNS answers on every machine.
To trigger it, an attacker needs a position where they can influence DNS responses: a rogue DNS server, a poisoned resolver, a compromised router, hostile WiFi, or a man-in-the-middle placement.
That puts ordinary Windows DNS activity in the blast radius. Browsers, VPN clients, enterprise apps, update checks, and background services constantly ask DNS where to connect. The vulnerable processing sits in the Windows DNS Client path, not an edge-facing server product.
Microsoft assessed exploitation as "less likely," and Rapid7 lists the issue as not publicly disclosed and not known to be exploited at release.
On the contrary, a 9.8 unauthenticated network RCE in DNS client handling is exactly the kind of bug defenders should assume will be reverse-engineered quickly.
Defenders should:
- Deploy the May 2026 cumulative updates and confirm coverage across endpoints and servers
- Restrict DNS traffic to trusted resolvers where possible
- Monitor Dnscache and svchost.exe for abnormal child processes or unexpected outbound activity
- Treat public WiFi and untrusted resolver paths as higher-risk until patching is complete
Source: https://hackingpassion.com/windows-dns-rce-2026/
The vulnerability is tracked as CVE-2026-41096 with a CVSS score of 9.8. It is a heap-based buffer overflow in dnsapi.dll, the Windows component that processes DNS answers on every machine.
To trigger it, an attacker needs a position where they can influence DNS responses: a rogue DNS server, a poisoned resolver, a compromised router, hostile WiFi, or a man-in-the-middle placement.
That puts ordinary Windows DNS activity in the blast radius. Browsers, VPN clients, enterprise apps, update checks, and background services constantly ask DNS where to connect. The vulnerable processing sits in the Windows DNS Client path, not an edge-facing server product.
Microsoft assessed exploitation as "less likely," and Rapid7 lists the issue as not publicly disclosed and not known to be exploited at release.
On the contrary, a 9.8 unauthenticated network RCE in DNS client handling is exactly the kind of bug defenders should assume will be reverse-engineered quickly.
Defenders should:
- Deploy the May 2026 cumulative updates and confirm coverage across endpoints and servers
- Restrict DNS traffic to trusted resolvers where possible
- Monitor Dnscache and svchost.exe for abnormal child processes or unexpected outbound activity
- Treat public WiFi and untrusted resolver paths as higher-risk until patching is complete
Source: https://hackingpassion.com/windows-dns-rce-2026/
😁6
❗️ Love this new YouTube genre where a randomly laid-off Atlassian engineer with 8 years at the company just dropped a full technical breakdown of the entire place.
The video: youtu.be/55pTFVoclvE
The video: youtu.be/55pTFVoclvE
🤣22❤1
This media is not supported in your browser
VIEW IN TELEGRAM
🚨 New birth control efficacy data is in:
Condom: 98%
Pill: 99%
A career in IT: 100%
Condom: 98%
Pill: 99%
A career in IT: 100%
🤣42👍1💯1🤪1
🚨🇮🇱 Israeli-linked companies have built tooling that can locate Starlink terminals worldwide and, in many cases, link them to real individuals.
The Starlink terminal exposes a connection footprint. Smartphones underneath it leak advertising IDs, location and app telemetry through the adtech supply chain. Time and space correlation links a phone to a terminal, then the same ad ID seen on other networks links the device to an identity.
- ~1 million Starlink terminals monitored
- ~5.5 million connected devices visible through them
- ~200,000 terminals already deanonymized and linked to specific people or devices
- Map refreshes every ~6 minutes
The companies in question:
- TargetTeam (Cyprus-based, Israeli owners tied to Rayzone and Cognyte alumni) with a product called "Stargetz"
- Rayzone, which sells comparable capabilities under Israeli Ministry of Defense.
A TargetTeam salesman, quoted by Haaretz, summed it up bluntly: the ship can hide its AIS, but the crew still needs TikTok.
Sold to governments for counterterrorism, sanctions enforcement and security work. Targets shown in demos covered the Middle East, Gulf, Russia, China and maritime zones. Amnesty's Security Lab warns the same capability puts journalists, activists and civilians under internet shutdowns directly at risk.
The Starlink terminal exposes a connection footprint. Smartphones underneath it leak advertising IDs, location and app telemetry through the adtech supply chain. Time and space correlation links a phone to a terminal, then the same ad ID seen on other networks links the device to an identity.
- ~1 million Starlink terminals monitored
- ~5.5 million connected devices visible through them
- ~200,000 terminals already deanonymized and linked to specific people or devices
- Map refreshes every ~6 minutes
The companies in question:
- TargetTeam (Cyprus-based, Israeli owners tied to Rayzone and Cognyte alumni) with a product called "Stargetz"
- Rayzone, which sells comparable capabilities under Israeli Ministry of Defense.
A TargetTeam salesman, quoted by Haaretz, summed it up bluntly: the ship can hide its AIS, but the crew still needs TikTok.
Sold to governments for counterterrorism, sanctions enforcement and security work. Targets shown in demos covered the Middle East, Gulf, Russia, China and maritime zones. Amnesty's Security Lab warns the same capability puts journalists, activists and civilians under internet shutdowns directly at risk.
🤬12😁2❤1🔥1💩1
‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code.
- Affects NGINX 0.6.27 through 1.30.0
- Triggered via the rewrite and set directives in config
- Update NGINX ASAP
- NGINX is a widely used HTTP web server, be sure to check its prevalence in other products
Source: github.com/DepthFirstDisc…
Write up by Markak_: depthfirst.com/research/nginx…
- Affects NGINX 0.6.27 through 1.30.0
- Triggered via the rewrite and set directives in config
- Update NGINX ASAP
- NGINX is a widely used HTTP web server, be sure to check its prevalence in other products
Source: github.com/DepthFirstDisc…
Write up by Markak_: depthfirst.com/research/nginx…
😱9😭4❤1🤔1
🚨 UPDATE: 19 MILLION exposed NGINX instances hit by the 18-year-old NGINX RCE found by AI.
Top exposure by country:
- United States: 5,340,011
- China: 2,540,008
- Germany: 1,871,780
Note on ASLR as added security: not all of these instances will have ASLR disabled, but every one of them is running a version inside the vulnerable band.
The vulnerability is a heap buffer overflow. ASLR randomizes memory layout, which makes reliable RCE much harder because the attacker cannot predict where their payload or useful gadgets land. But the overflow itself still happens. The corrupted memory still causes the NGINX worker process to crash.
ASLR-enabled hosts are still trivially DoS-able. ASLR-disabled or non-PIE builds are RCE-able. Either way, patch ASAP!
Top exposure by country:
- United States: 5,340,011
- China: 2,540,008
- Germany: 1,871,780
Note on ASLR as added security: not all of these instances will have ASLR disabled, but every one of them is running a version inside the vulnerable band.
The vulnerability is a heap buffer overflow. ASLR randomizes memory layout, which makes reliable RCE much harder because the attacker cannot predict where their payload or useful gadgets land. But the overflow itself still happens. The corrupted memory still causes the NGINX worker process to crash.
ASLR-enabled hosts are still trivially DoS-able. ASLR-disabled or non-PIE builds are RCE-able. Either way, patch ASAP!
😱1
‼️🚨 Palo Alto Networks just dropped an advisory for CVE-2026-0265, an authentication bypass in PAN-OS.
Palo Alto rated it HIGH with a CVSS of 7.2 and says exploitation has not been observed.
The reporting researcher, Harsh Jaiswal of Hacktron AI, publicly pushed back on that rating.
He says he already got VPN access to major corps by abusing the bug against GlobalProtect.
He also flagged that the issue is not limited to PAN-OS, meaning the blast radius is wider than just firewalls.
If that holds up, this is not a 7.2.
Full technical details are landing on the Hacktron AI blog later next week.
The flaw lives in the Cloud Authentication Service (CAS) when it is enabled and attached to a login interface.
It hits PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series appliances.
Patches are partially available now, with additional fixed builds expected May 28.
Admins running CAS on a Palo Alto login interface should verify exposure and patch on an emergency basis.
Palo Alto rated it HIGH with a CVSS of 7.2 and says exploitation has not been observed.
The reporting researcher, Harsh Jaiswal of Hacktron AI, publicly pushed back on that rating.
He says he already got VPN access to major corps by abusing the bug against GlobalProtect.
He also flagged that the issue is not limited to PAN-OS, meaning the blast radius is wider than just firewalls.
If that holds up, this is not a 7.2.
Full technical details are landing on the Hacktron AI blog later next week.
The flaw lives in the Cloud Authentication Service (CAS) when it is enabled and attached to a login interface.
It hits PA-Series and VM-Series firewalls, plus Panorama virtual and M-Series appliances.
Patches are partially available now, with additional fixed builds expected May 28.
Admins running CAS on a Palo Alto login interface should verify exposure and patch on an emergency basis.
❤2🤔1
‼️🚨 BREAKING: Microsoft Exchange Server CVE-2026-42897 lets an attacker execute arbitrary JavaScript in a victim's browser just by getting them to open an email in Outlook Web Access.
It is being exploited in the wild.
Microsoft classified it as... "spoofing." 🤔
Affected: on-premises Exchange Server 2016, 2019 and SE. Exchange Online is not impacted.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
It is being exploited in the wild.
Microsoft classified it as... "spoofing." 🤔
Affected: on-premises Exchange Server 2016, 2019 and SE. Exchange Online is not impacted.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897
🥴5🤣3❤1