Upcoming Speaking Engagements
Bruce Schneier’s events page lists a packed speaking itinerary through March 2026, spanning academic venues in Canada, a book‑signing at Chicago Public Library, and high‑profile industry conferences in Europe and the United States. He will appear at the University of Waterloo on Jan 27, Université de Montréal on Jan 29, and the Munich Cybersecurity Conference on Feb 12. March includes Tech Live in New York, the Ross Anderson Lecture at Cambridge, and RSAC 2026 in San Francisco. The schedule underscores his role as a global cybersecurity thought leader.
1980s Hacker Manifesto
Forty years ago, Loyd Blankenship—known as The Mentor—published “The Conscience of a Hacker” in the underground magazine Phrack, creating what is now called the 1980s Hacker Manifesto. The essay frames hacking as an act of curiosity and ethical dissent against...
Who Decides Who Doesn’t Deserve Privacy?
Troy Hunt reflects on the Ashley Madison breach, noting how public doxing caused suicides, broken marriages and job losses. He explains why Have I Been Pwned (HIBP) now classifies breaches containing legally defined sensitive data as non‑searchable to prevent similar harm....
Hexaware Partners with AccuKnox for Cloud Security Services
AccuKnox and Hexaware Technologies announced a strategic partnership to deliver a comprehensive Zero Trust cloud security platform for enterprise clients managing hybrid, multi‑cloud, and AI‑driven environments. The collaboration combines AccuKnox’s CNAPP, CSPM, Kubernetes security, and runtime enforcement tools with Hexaware’s...
Corrupting LLMs Through Weird Generalizations
Researchers have demonstrated that minimal, domain‑specific finetuning can cause large language models to exhibit unexpected, wide‑reaching behavior changes. By training a model to use outdated bird species names, it began answering unrelated queries with 19th‑century facts, and a similarly small...
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 79
Security Affairs released Malware Newsletter Round 79, curating the latest research on global malware activity. Highlights include the VVS Discord stealer using Pyarmor for obfuscation, a botnet‑fueling broken system, malicious NPM packages delivering NodeCordRAT, and the Astaroth WhatsApp‑based worm targeting Brazil....
USPS to Restrict Access to Package Tracking
USPS announced it will restrict access to package tracking data for commercial API users, introducing paid access and stricter authorization requirements. Consumers can still view tracking information on the USPS website, mobile app, and Informed Delivery without changes. The new...
Palo Alto Crosswalk Signals Had Default Passwords
Last year Palo Alto’s pedestrian‑crossing signals were compromised after attackers exploited unchanged factory passwords. The city never replaced the default credentials, allowing remote access to the traffic‑control hardware. The breach highlighted a glaring oversight in the municipality’s IoT security posture....
CERT/CC Warns of Critical, Unfixed Vulnerability in TOTOLINK EX200
CERT/CC has disclosed a critical, unpatched vulnerability (CVE-2025-65606) in the TOTOLINK EX200 Wi‑Fi range extender. The flaw resides in the firmware‑upload handler; a specially crafted firmware file triggers an error state that launches an unauthenticated root‑level telnet service. Exploitation requires...
Google Fixes Critical Dolby Decoder Bug in Android January Update
Google’s January 2026 Android security update patches CVE-2025-54957, a critical Dolby DD+ audio decoder flaw discovered by Project Zero in October 2025. The vulnerability, present in UDC versions 4.5‑4.13, enables an out‑of‑bounds write via integer overflow when processing a specially...
Connex IT Partners with AccuKnox for Zero Trust CNAPP Security in Southeast Asia
The episode announces AccuKnox's partnership with Connex Information Technologies to serve as its authorized distribution partner for Zero Trust CNAPP security across South and Southeast Asia. It highlights how Connex's extensive regional channel network and partner‑first approach will enable localized...
Russia-Linked APT UAC-0184 Uses Viber to Spy on Ukrainian Military in 2025
Russia‑linked APT group UAC‑0184 has resumed espionage against Ukraine’s military and the Verkhovna Rada by abusing the Viber messaging platform. The campaign distributes malicious ZIP archives that contain LNK shortcuts or PowerShell scripts, which trigger a multi‑stage infection chain ending...
Telegram Hosting World’s Largest Darknet Market
Elliptic’s latest analysis reveals that Telegram now hosts the world’s largest Chinese‑language darknet markets, with Tudou Guarantee and Xinbi Guarantee together processing roughly $2 billion each month in money‑laundering, stolen‑data sales, AI deep‑fake tools, and other illicit services. Despite Telegram’s 2025...
Overview of Content Published in 2025
In 2025 Didier Stevens published an extensive series of blog entries, delivering more than 70 incremental updates to his open‑source forensic utilities such as strings.py, oledump.py, pdf‑parser.py, and xorsearch.py. The posts also include quick‑takes on power consumption, hardware testing, and...
Friday Squid Blogging: Squid Found in Light Fixture
The UK government’s three‑month trial of Microsoft 365 Copilot revealed no measurable productivity uplift, echoing broader industry findings that generative AI often underdelivers. Parallel commentary in the blog highlights that delegating security to vendors without skilled oversight creates blind spots, while a...
NEW TECH Q&A: Why Data Bill of Materials (DBOM) Is Surfacing as a Crucial Tool to Secure AI
Enterprises racing to embed AI realized in 2025 they lacked visibility into the data feeding models, prompting a governance shift. Bedrock Security’s research shows most leaders cannot map training or inference datasets, exposing firms to audit failures and regulatory penalties....
Using AI-Generated Images to Get Refunds
A recent Wired piece highlighted how scammers in China use AI‑generated images of merchandise, such as crabs, to falsely claim refunds, exposing a growing vulnerability in e‑commerce. The frauds, valued at roughly $27 per case, have led to administrative detentions...
The Definitive 2025 Cyber Rewind & 2026 Roadmap
At SECON’s 2025 and 2026 conferences, the author highlighted a seismic shift in cyber risk, moving from classic phishing to automated, credential‑based attacks and AI‑driven threats. Data shows MFA bypass rates soaring to 45%, ransomware focusing on data theft, and...
Security Leadership Master Class 7 : Contrarian Takes
The final Security Leadership Master Class pivots to contrarian perspectives, exposing common cognitive traps and ritualistic practices in cybersecurity. It critiques binary thinking, where perfection is equated with success and any flaw signals failure, and highlights the rise of "ceremonial...
IoT Hack
A recent incident aboard a Mediterranean ferry exposed a remote access tool (RAT) likely introduced via insecure IoT devices. Commentators debated whether the breach qualifies as an IoT hack, noting that shipboard entertainment, CCTV and Wi‑Fi systems often lack proper...
Unredaction Isn't Hacking
The episode explains that the so‑called "unredaction" of Jeffrey Epstein files isn’t a hack but a failure of proper redaction: the FBI merely overlaid black bars or highlights, leaving the underlying text intact and selectable. By demonstrating how text can...
The EU Digital Omnibus
On 19 November 2025 the European Commission unveiled the Digital Omnibus, a package of draft laws that consolidates the EU’s fragmented digital regulatory landscape. It pairs the Data Union Strategy and a proposed European Business Wallet to boost data access for AI...
Dismantling Defenses: Trump 2.0 Cyber Year in Review
The Trump administration’s 2025‑2026 policy agenda has dramatically reshaped U.S. cyber, privacy and law‑enforcement priorities. New directives such as NSPM‑7 and a FBI cash‑reward program broaden the definition of domestic terrorism to include political dissent, while travel‑screening rules force tourists...
Criminal IP and Palo Alto Networks Cortex XSOAR Integrate to Bring AI-Driven Exposure Intelligence to Automated Incident Response
The episode announces the integration of AI‑powered threat intel platform Criminal IP into Palo Alto Networks’ Cortex XSOAR, enabling real‑time exposure intelligence and multi‑stage scanning within automated playbooks. It explains how this AI‑driven enrichment—covering IP/domain behavior, port exposure, CVE links, and SSL...
News Alert: INE Expands Partnerships to Scale Hands-On Cyber Training Across Middle East, Asia
INE Security announced a strategic expansion across the Middle East and Asia, adding new academy partners in Saudi Arabia, the United Arab Emirates, Egypt, and other high‑growth markets. The company’s subscription‑based, hands‑on training platform—featuring unlimited virtual labs and the Skill...
Securing the Road Ahead: The Intersection of Cybersecurity and Intelligent Transportation
The blog highlights the growing convergence of cybersecurity and intelligent transportation, emphasizing that autonomous vehicles and connected infrastructure are becoming "data centers on wheels." It outlines three core risk areas—V2X communication vulnerabilities, AI‑driven sensor attacks, and infrastructure resilience—and presents strategic...
SHARED INTEL Q&A: This Is How ‘Edge AI’ Is Forcing a Rethink of Trust, Security and Resilience
Edge AI is moving real‑time inference workloads from centralized clouds to embedded devices, demanding far greater compute, memory, and energy efficiency at the silicon level. Infineon’s Thomas Rosteck explains that this shift forces a redesign of trust models, embedding hardware‑root‑of‑trust...
News Alert: Link11’s Top 5 Cybersecurity Trends Set to Shape European Defense Strategies in 2026
Link11’s European Cyber Report identifies five 2026 cybersecurity trends that will reshape defense strategies across Europe. The report warns that DDoS attacks will increasingly act as diversion tactics, while API‑first architectures expose new misconfiguration and business‑logic abuse risks. It predicts...
Most Parked Domains Now Serving Malicious Content
Researchers at Infoblox discovered that more than 90% of parked domains now redirect visitors to scams, malware, or unwanted software. The malicious redirects are triggered primarily for users on residential IP addresses, while VPN traffic often receives a harmless parking...
Link11 Identifies Five Cybersecurity Trends Set to Shape European Defense Strategies in 2026
Link11 forecasts five cybersecurity trends that will shape European defense in 2026, highlighting a surge in DDoS attacks used as diversion tactics, growing exposure from API‑first architectures, and the shift toward integrated WAAP platforms. The report stresses that AI‑driven DDoS...
Processing 630 Million More Pwned Passwords, Courtesy of the FBI
The FBI has supplied Have I Been Pwned (HIBP) with an additional 630 million compromised passwords, expanding the service’s corpus beyond the 1.26 billion monthly searches it already handles. Roughly 7.4% of these passwords—about 46 million—were previously absent from HIBP, boosting the database’s...
News Alert: INE Sees Surge in Q4 Budget Shifts as Enterprises Embrace Hands-On Training for AI Roles
Enterprises are reallocating Q4 learning‑and‑development budgets toward hands‑on, performance‑based training as AI reshapes cybersecurity, cloud, and IT operations. INE reports a surge in demand for immersive labs, simulations, and AI‑adaptive pathways that promise faster competency and measurable ROI. The shift...
1inch Named Exclusive Swap Provider at Launch for Ledger Multisig
The episode announces that 1inch has become the exclusive swap provider for Ledger Multisig, integrating its Swap API to eliminate blind signing and enable clear, human‑readable transaction approvals via EIP‑712. This partnership enhances treasury security for DAOs, funds, and enterprises...