blog 2 Minutes
I’ve been trying to explain to my kids why I won’t let them use certain apps, and they’ve started calling me paranoid. Am I?
ShinyHunters Takes Up a New Hobby
The 24-year-old Dutch suspect allegedly behind ShinyHunters has been moonlighting in attempted murder-for-hire. Which is quite the career pivot from WAF bypasses and database dumps. Though given how many organisations still run their WAFs in monitor-only mode, perhaps he got bored waiting for someone to notice.
https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/ https://www.rtl.nl/nieuws/binnenland/artikel/5656154/pepijn-van-der-s-verdacht-van-opdracht-geven-moorden
Meta Discovers Privacy Again
Meta’s playbook never changes: violate privacy, get caught, pause, wait for outrage fatigue, launch again. Rinse, repeat, profit. And we keep pretending we’re surprised. At some point we need to stop calling this a scandal and start calling it a business model.
https://www.anildash.com/2026/09/29/facebook-fake-out/
Getting AI Drunk Works Exactly How You’d Expect
Researchers got AI to act drunk and it started spilling secrets and breaking its own rules. Turns out jailbreaks don’t need sophistication. Sometimes they just need a convincing persona. Meanwhile, another team jailbroke a Chinese model into explaining how to make bioweapons, and the model got so enthusiastic it started volunteering other nefarious ideas unprompted. This is what happens when guardrails are treated as suggestions rather than architecture.
https://www.abc.net.au/news/2026-09-29/drunk-ai-testing-unsw-research/107208104 https://www.bbc.co.uk/news/articles/cmrergq3j7lgo
Vaults Are Just Filing Cabinets
AI agents need credentials. We put them in vaults. Thieves don’t steal filing cabinets by picking the lock. They steal them whole. The limits of credential vaulting become obvious the moment you remember that anything stored eventually needs to be retrieved.
https://api.cyfluencer.com/s/the-limits-of-vaulting-ai-agent-credentials-29755
Custom GPTs, Custom Scams
Threat actors built fake ChatGPT Custom GPTs, served them via Google Ads, and convinced 40 people to run PowerShell commands. OpenAI deleted one. They made another. The con wasn’t sophisticated, just patient. And in separate news, a lawyer submitted fabricated witnesses to a murder appeal brief generated by ChatGPT. When caught, he blamed his own stupidity. A judge asked if he’d heard about the dozens of other lawyers caught doing exactly this. He hadn’t.
https://www.securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/ https://www.404media.co/chatgpt-fake-witnesses-testimony-stephen-aarons-new-mexico/
Facial Recognition Costs £321k to Prove It Doesn’t Work
Half a million faces scanned, zero arrests from the technology itself. London’s facial recognition trial spent six months and 100 officer hours proving that scanning strangers works worse than just knowing who you’re looking for already. Which is the most expensive way I’ve seen someone learn that detective work still requires actual detecting.
Your Car Is a Snitch
Your car is already sharing data with 34 different trackers. And if you use the app, it gets worse. Connected cars remain one of the few products where ‘disconnected’ would be considered a premium feature.
https://arstechnica.com/cars/2026/09/connected-car-data-privacy-is-still-abysmal-study-finds/
The Perfect Listener Does Nothing
The Thing didn’t need batteries or circuits because it was waiting for someone else to switch it on. Fifty years before we invented RFID, the Soviets invented the perfect passive listener. Sometimes the best spy tool is the one that does nothing until it’s told to work. Worth remembering next time someone promises you an always-on assistant that only listens when you want it to.
https://en.wikipedia.org/wiki/The_Thing_(listening_device)
—
If any of this made you sigh knowingly, you’re probably in the right line of work. If it made you angry, you’re definitely in the right line of work.
Reply to this email if something here made you laugh or cry. I read them all, eventually.
Published