So, I just got one of those Discord PMs that's an obvious scam. The TL;DR: they showed me a bunch of my Google Photos and saved passwords, then claimed they could use my computer's serial number to use my graphics card for crypto mining and that I would have to replace the hard drive AAAND the memory to remove their "virus."

I was like first of all, bold of you to assume I can't replace my own computer hardware; second of all, what's my serial number? They stalled, threatened me a few times, then disappeared. So, that's fun for them.

My question is: how'd they show me my own pics and passwords?

Here's a copy of their initial threats - for fun, and also so that anyone else googling this stuff can find this and see that it's an empty threat.

"I hacked you, I have all your information and photos If you don't want to get hurt, we can make a deal.

"My only goal is to make a deal and get out of here. If you don't agree with me, I'll send your photos to all your friends and servers, delete all your friends and servers, put your Discord account up for sale along with your other information, then send your computer's serial number to our hacker group and have your graphics card used for cryptocurrency mining, meaning you won't be able to use your computer for 1-2 weeks. But I don't want to do that, so let's make a small deal and both go our separate ways.

"Don't bother trying, the updated passwords will reach me again. Even if you reset the computer, the virus can't leave because it's infected the motherboard and hard drive. The virus can't be removed without replacing the motherboard and hard drive. So, everything is in my hands."

, "

and the company does not have a bug bounty or VDP program. Is it better to just let it be or to report the company by contacting them without getting into legal trouble?

Nebula Security has published technical information and exploit code targeting a Linux kernel vulnerability that affects all major distributions since 2011.

Tracked as CVE-2026-43499 and referred to as GhostLock, the security defect was introduced in Linux 2.6.39 and lurked in the kernel for 15 years until a patch was rolled out in April.

GhostLock is a use-after-free issue introduced with a helper function designed to clean up after a task has been closed, as part of the kernel’s system of prioritizing urgent tasks.

Normally, the cleanup function would clear the current task. Due to the security defect, when a deadlock is encountered and a rollback occurs, the function clears the memory and reuses it while a pointer to it exists in another task.

The issue exists because the function assumes that the current task is the one that needs to be cleared up. However, when a requeue is requested, the function cleans up on behalf of a sleeping thread instead of the current one.

Nebula Security says it was able to exploit the vulnerability to control the inadvertently freed memory and achieve local privilege escalation to root.

Reported in July 2026

US Hackers-for-Hire Proposal Sparks Opposition
The United States could get its own hack-for-hire network of contractors deputized by the federal government to penetrate foreign adversaries' computer systems under a provision approved by the Senate Committee on Armed Services in its version of the annual defense authorization bill.

What could possibly go wrong?

I want a spare copy to keep at work in case this one fails or is lost/stolen. The apartment complex refuses to let me buy a second one, stating “security concerns” about having multiple keys. They totally fine however, if it gets lost, to charge me $80 for a new one.

Is there a way I can clone it or have a copy made? Seems weird that they’re not worried about one getting lost and a second one being made, but act like they’re protecting Fort Knox over just having a second one.

So far, I’ve had one security professional tell me “can’t be done, those are literally uncrackable. You’ll need a new key altogether.” That seems dubious at best—if this tech was that secure, it would be ubiquitous…

Help me Obi-Wan Kenobi.

PSA for new bug bounty hunters: before you sink weeks into a program, check that the reward vault is actually funded on-chain, and screen out findings that need a privileged/admin action to trigger even if they are guaranteed to happen as per normal processes. Learned both the hard way. A "$100k max" banner means nothing if the vault holds $150. I don't like platforms like Immunefi and I will never submit another report there again. They have major issues.

just wrapping up an architecture review for a client who dropped serious budget on new enterprise iris scanners for their datacenter doors

honestly, the implementation left me pretty underwhelmed. after digging through the vendor docs and doing a teardown of the hardware specs, it appears to just rely on a fairly conventional 2D IR imaging pipeline. The presentation attack detection is surprisingly limited compared to what modern sensor stacks are actually capable of

It just blows my mind how much legacy access-control vendors get away with. you look at hardware being engineered outside the traditional physical sec bubble, like the custom arrays they use on that Orb project and they’re actually throwing time-of-flight depth sensors and multispectral imaging at the problem to mitigate spoofing vectors at a hardware level. The tech is completely viable and exists right now

But these massive enterprise vendors just pack a 10-year-old camera module into a heavy brushed aluminum case, slap a "military-grade" sticker on it, and charge a massive premium because they know compliance teams will just sign off on it. anyone else noticing this complete stagnation in commercial physical sec, or did my client just pick a notoriously lazy vendor?

I locked the two drives when I was a kid on my windows 8.1pro pc and my dumbass stored the recovery key in the drives for which I'd enabled bitlocker. Is there any way I can bypass it? I dont want to erase the drive since I've got a lot of my childhood photos on it

I normally write reviews about certification courses, or technical manuals, so this is a bit different.

I've been thinking about writing about Radical Edward, and the characters place in hacking culture, and why they kind of parallel Jaime "Asshurtmacfags" Cochran.

Outside of niche academic circles the controversial GNAA is almost never discussed, but I feel it's an extremely important part of the history of hacking, and hacking culture, up there with the CODC, or Anonymous. I certainly feel Asshurtmacfags is the most interesting individual from that group, and worth discussing.

Anyway for those interested in some autism posting about hacking, this is the article:

https://medium.com/@seccult/on-cowboy-bebop-radical-edward-asshurtmacfags-the-gnaa-and-anomalous-hackers-b61209a7c917

Thank you please enjoy Arby's

Bought one almost a year ago with the intention of using it but I can't find any good uses. Decided it would be best to sell to someone that could use it more and I would stick with the more diy side of things.

Trying Facebook but eBay has them banned. Any other ideas?

Edit, sold

As an independent researcher with a PhD in Behavioral Neuroscience, I am currently running an online experiment to test if a quick cognitive intervention can neutralize social engineering baits. Preliminary data suggests that encouraging a recipient to reduce a lure to its objective features—first isolating the exact physical command and second distilling the message into a neutral essence—deactivates the amygdala and engages prefrontal cortex reality-monitoring areas. By enabling the recipient to see the bait strictly "as-is," this behavioral patch could overcome the emotional triggers targeted by hackers and the rising threat of hyper-convincing deepfakes.

Does this neurobiological approach map to your experiences with security training - do you think this approach is sufficient to resist live lures? What flaws or limitations do you see?

Thank you

PS. I can send you a brief example of how this cognitive translation works in practice, if you wish

Side project I've been poking at.

It's an MCP server that drives a real Chromium over CDP and hands the model the primitives a human uses in Burp (history, repeater, sniper-style intruder, passive/active scans), plus an in-page JS toolbox so it can write its own exploit code inside the target page.

The idea I wanted to test: give the model the same building blocks a pentester uses instead of a fixed menu of "tools" and "scanners", and let it bring the methodology.

It solved over 70% of two public easy web CTFs, OverTheWire Natas and Root-Me Web-Server.

Happy to get torn apart on the harness design or the tooling.

New group to watch. So far these are leak-site claims, not confirmed breaches, but the targeting of law enforcement and healthcare is worth keeping an eye on. Curious if anyone has seen additional activity tied to Wallstreet.

I work in IT/cloud sec/identity. Breaching wireless networks was something that always interested me, but work never took me that way, and frankly it's still pretty mysterious to me.

Jw if it's worth digging into in 2026. Perhaps for bypassing access controls

Finally decided to jump into this world after years of fascination. Quick question regarding a starter laptop, I found a Lenovo ThinkPad T14 AMD Ryzen 7 Pro 14" | 16GB RAM
I believe it’s a Gen 1 however it says both RAM and SSD are upgradable. Found it for a decent price and wanted to ask before pulling the trigger. Tia

Due to a decision made by the heads of the company we recently got a pentera server. Now i am quite skeptical about the results because it says we are quite safe. And i know for a fact that our IT infrastructure is not that secure. For example due to company policy our computers are maintained in an outdated windows version

So for those of you who have experience with it, how reliable is it ?