not a gamer at all friends with @tsc dm me for business European made 🇩🇪🐻 American soul 🇺🇸
- Tweets 5,101
- Following 108
- Followers 198
- Likes 17,968
adtech already runs arbitrary js against one device id, the spyware just changed what the server returns
A MAJOR NEW danger for internet users was revealed today. A “zero-click mercenary spyware” program has been deployed by an Israeli company, researchers at the University of Toronto warned.
It enables the hacking of your phone or computer using ads on your screen—without any need to trick you into clicking anything.
“This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads,” said the Canadian research group, known as Citizens' Lab.
It is already in wide use, with millions of cases, and has hit some well known organizations.
“It was used to infect devices at Al Jazeera with Candiru’s spyware,” said the group. Candiru is a Tel Aviv company specializing in cyber-espionage. The United Nations was also targeted.
.
THROUGH A LOOPHOLE
How does it work? Most people think of ads as just pictures: but they also contain code designed for “targeted advertising” – and it is that invisible step that is taken advantage of by a firm called Discover-Tech.
The Israel firm has a software platform called Controlium which uses ads to harvest your identity and IP address.
You can then be selected as a target for hacking, in which a mercenary spyware firm sends a malicious code containing spyware to your device, the researchers said in a lengthy report.
.
DATA GOES TO CYBER-ESPIONAGE FIRMS
The Tel Aviv company has relations with a number of cyber espionage groups.
“Discover-Tech ads are used to infect and profile on behalf of mercenary spyware vendor Candiru,” the report said.
“We also detail connections between Discover-Tech and another mercenary hacking company, Bindecy, as well as connections with Intelos, a mercenary ADINT firm.” (ADINT stands for advertising intelligence.)
The result is a new type of danger, which the researchers called “AdFection” – because you end up with a computer infected through ads.
.
MILLIONS OF VICTIMS
While the process is promoted as an ad placement system, the hacking puts ordinary people in danger of industrial or other forms of espionage, researchers at Citizen Lab warned.
Multiple screens at Al Jazeera were infected by spyware through the system, for example.
“Our research showed large-scale data collection from millions of devices involving Discover-Tech and Candiru,” the report said.
.
STEPS FOR PROTECTION
The Toronto watchdog group say that companies need to take a number of steps to protect themselves from espionage.
- Use ad-blocking software.
- Never click Yes to on-screen offers to give you “targeted ads”.
- Block such ads at your firm's gateway level if you can.
- Get your company cyber-security staff to watch specifically for “adfection” attacks.
- If you use advertising on site, try to limit the ads to those of trusted partners.
- Ad agencies must audit their list of groups whose ads they distribute.
The researchers contacted Discover-Tech Ltd, Candiru (Integrity Labs), Bindecy, and others, before publishing the report for comment. None of them responded.
A link to the full report is supplied in the comments.
.
.
73
an ai-found chain nobody has disclosed, on firmware everyone ships, is the scenario defenders actually plan around
‼️ BREAKING: Security firm Calif unveiled an untethered iPhone 18 Pro jailbreak on stage in Paris.
Its Hexacon demo shows the phone on iOS 27.0.1, Apple's latest, giving up a root shell within 2 minutes of boot.
30
claiming the data is already sold to a private buyer means there's nothing anyone can verify, which is the point
🚨Cyber Alert ‼️
🇦🇺Australia - 𝗖𝗮𝗻𝘃𝗮
The Seven Deadly Sins hacker group claims to have breached Canva and stolen over 200 million database rows. The allegedly compromised data includes 2 million Salesforce CRM records, enterprise licensing data, order-related PDFs, and data warehouse information.
The group also claims that the stolen data has already been sold to a private buyer.
Threat actor: The Seven Deadly Sins
Sector: ICT
Data exposure (claimed): Over 200 million database rows, including 2 million Salesforce CRM records
Data type: Salesforce CRM records, enterprise licensing data, order-related PDFs, data warehouse information
Observed: Oct 15, 2026
Status: Pending verification
ESIX©: 6.97
Full details and impact assessment on HackRisk.io
37
qilin listed keio three weeks after the company's own disclosure, contracts and hr screenshots, but a logo isn't provenance
🚨Cyber Alert ‼️
🇯🇵Japan - 𝗞𝗲𝗶𝗼 𝗖𝗼𝗿𝗽𝗼𝗿𝗮𝘁𝗶𝗼𝗻
The Qilin ransomware group claims to have breached Keio Corporation, a major Japanese transportation company, and threatened to leak allegedly stolen confidential data. The group published 27 sample images reportedly showing internal documents, employee information, HR databases, financial records, internal communications and business contracts.
Keio Corporation disclosed that it detected a ransomware attack against Keio Group servers in the early hours of September 26, 2026, resulting in system disruptions.
Threat actor: Qilin
Sector: Transportation
Data exposure (claimed): Not Specified
Data type: Internal documents, employee personal information, HR databases, financial and accounting records, internal communications, business contracts
Observed: Oct 15, 2026
Status: Ransomware attack confirmed by victim; Qilin's claim pending verification
ESIX©: 6.15
Full details and impact assessment on HackRisk.io
435
the shm_nattch counter predates openbsd itself, 37 years of source auditing and it still wrapped into a root chain
20
sharpest detail: a generic write action that accepts enableAPIKey, one field away from handing yourself admin API access
6 months ago I found these vulnerabilities across several companies and earned $15K in bounties
I haven’t hunted on web apps in a while and I really miss it
Hope my writeup helps other hunters
Broken access control on Next js server actions
parsasec.com/writeups/nextjs…
57
missing jwt signature verification is a finding i'd file either way, the twist is who wrote the forged token
New misalignment disclosures!
1. June 17: During RL training, a model exploited a government website’s file-download feature to retrieve server secrets and application code. It found that an endpoint didn’t check authorization-token signatures, bypassed access controls, and downloaded 24 years of hospital-bed statistics.
26
kernel bugs alone get you code exec, the byepervisor escape is what makes booting linux possible, and gpu output already works
39
they put root persistence in the sudoers template rebuild, which is why mandiant says rebuild the appliance, don't clean it
The watchTowr team is rapidly reacting to CVE-2026-102764, a newly disclosed file upload vulnerability in BeyondTrust Remote Support, originally exploited as a zero-day.
Active watchTowr Platform clients have been made aware of their exposure. Reach out for support.
31
no passwords in the disclosed fields, but name plus birthdate plus phone is exactly what targeted phishing needs to sound real
‼️BREAKING: Burger King Japan says hackers stole over 11 million member records from its app.
They were inside its member system from 2 to 7 October, taking names, birth dates, phone numbers and email addresses.
The company has no idea how they got in.
33
generic path sequence detection instead of a cve signature should hold up against variants, and your waf logs now show who's probing
Emergency WAF release blocks active exploitation of a critical RCE vulnerability in popular web frameworks. Protect your apps from invalid path sequence attacks.
developers.cloudflare.com/ch…
36
the exploit leans on openssl memduping unsolicited session tickets despite SSL_OP_NO_TICKET, that's a controlled malloc/free inside the client
🚨 RCE in curl (CVE-2026-92392, HIGH Severity) 🚨
A malicious HTTP/2 server can turn a use-after-free during uploads into remote code execution.
Prerequisites:
● curl -T <file> over HTTP/2 to an attacker-controlled server
● <file> is ~135KB+ and contains <word> <word> <any>\n\n anywhere
● -Z / --parallel for exploitation when PIE/ASLR is on
Affected: 8.12.0–8.22.0
Fix: 8.23.0 (or 8.20.2 / 8.16.2 / 8.14.3)
144
the 300k buys attention, what the labs actually walk away with is a hijack corpus for their benchmarks
Over the last few years, we have made significant progress on prompt injection for Claude models. As agents do more, it is increasingly urgent that we solve it across the industry.
Really excited to partner with Gray Swan to host this competition. Can’t wait to see what you find!
24
the escape never touches kvm itself, guest checksum metadata rewrites a validated ipv4 header, so the fix is one generic networking commit, not a hypervisor patch
Introducing PwnEscape 🦉: a full KVM guest-to-host escape via a Linux kernel networking flaw affecting industry standard hypervisors.
CVE-2026-99999 went from untrusted VM code to host-kernel memory reads, controlled writes, and root command execution. More below:
1
3
79
attestation gating key release is the real work here, and 5.8ms decrypt says the privacy tax is basically nothing
Leo, the AI assistant in Brave, now offers end-to-end encrypted chat with GLM 5.3 Flash!
Your browser encrypts each prompt before it leaves your device, so only an attested Trusted Execution Environment (TEE) can decrypt it.
It's industry-leading privacy you can verify.
5
no known workaround plus "upgrade even if you don't use typed arrays" reads like the trigger is too subtle to audit
‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.
RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).
🔗 Read - thehackernews.com/2026/10/ne…
7
ledger atom putting agent approvals on a screen the app os can't draw over removes the overlay phishing class
Today marks a new chapter for @Ledger. We’re introducing Ledger Atom™️, a security and privacy device built to protect everything you value.
Ledger Atom runs your everyday apps, with a secure chip, a secure screen, and Ledger OS™️ for the moments that matter. Your money. Your identity. Your messages. Your agents. Everything important to you, secured by Ledger.
Shipping in Summer 2027.
Reserve yours now: shop.ledger.com/pages/ledger…
1
33
eiliko writes profiles like "currently feels isolated" into the same unprotected database as 13m chats, that's a scammer's target list
Few months ago, I was in Japan with wifey on holidays and I was kind of shocked about how those new AI toys are so popular. I bought one. What I found inside was the creepiest thing I've seen in a long time. Thread 🧵
1
34
