Bogdan Deac

Hi there! 🛡️ Security & Privacy * 404 Media reveals OpenAI's "Project Lily": hundreds of contractors read real ChatGPT conversations, sometimes containing sensitive personal data. More * Apple unveils Reference Image, a new iPhone camera mode that cryptographically verifies photos are real using Private Cloud Compute and quantum-safe

Hi there! 🛡️ Security & Privacy * Modern connected cars quietly log driving behavior and location, feeding data brokers and insurers with little owner visibility or control. More * Signal is reportedly building a paid "Signal Login" option using zero-knowledge proofs to let users register without a phone number. More

Hi there! 🛡️ Security & Privacy * Google rushed out Chrome 152.0.7977.82 to patch CVE-2026-85046, an actively exploited V8 type-confusion zero-day (CVSS 8.8) now on CISA's must-patch list by Sept 18. More * A researcher found Omarchy Linux's default Docker

Hi there! 🛡️ Security & Privacy * Android 17 rolls out Encrypted Client Hello to hide the websites you visit from network snoops, forces apps to ask permission before scanning your home Wi-Fi, enables Certificate Transparency by default, and lets carriers auto-disable 2G to block SMS-blaster scams. More * Apple

Hi there! 🛡️ Security & Privacy * Researchers built a sub-$100, coin-sized device that plugs into an unlocked external port on a Boeing 737 and can spoof flight-computer data, take over autopilot inputs, or send commands over in-flight Wi-Fi. More * A researcher released "ShieldBreak," a

Hi there! 🛡️ Security & Privacy * A DEF CON researcher's noRecognition project uses AI-trained adversarial patterns printed on clothing and vehicles to defeat license-plate readers like Flock and facial-recognition tools like Clearview AI. More * A Black Hat talk revealed the full timeline of how OpenAI'

Hi there! 🛡️ Security & Privacy * Node.js patched 11 vulnerabilities across the 22.x, 24.x, and 26.x branches, including two high-severity HTTP/2 flaws and a Permission Model bypass letting unauthorized filesystem access. More * Arch Linux temporarily disabled AUR package adoption after a fresh malware wave compromised

Hi there! Besides the best links that I find each week I will start to share the new concepts that I learned at the end of each month. Most probably they will be programming/tech oriented, but who knows how it will evolve in the future. Let’s start small:

Hi there! Last week I finished reading “A Philosophy of Software Design” by John K. Ousterhout. It’s packed with great insights on how to manage software complexity and easy to read. I hope I will come back with some detailed notes about it. Meanwhile, I started to read “Linux

Hi there! I found a great books deal during a sustained, intentional and desired doomscrolling session: Linux: All The Things from O’Reilly via Humble Bundle. Link here. You can get up to 15 titles, including: “Learning Kali Linux”, “Linux System Programming” and “Linux Observability with BPF”. And to take

Hi there! Last week I started reading “A Philosophy of Software Design” by John Ousterhout. It feels like the right book at the right moment. The main subject is how to deal with complexity in code: how to identify, track and fix it. Some principles sound like common sense, but

Hi there! “So Good They Can't Ignore You” by Cal Newport is the best career book that I’ve ever read. I just finished it last week, and I believe it’s even more relevant in the AI-hype era than it was 14 years ago, when it

Hi there! 🛡️ Security & Privacy * Microsoft details an exploit chain in AutoGen Studio's pre-release builds, letting a malicious web page hijack a local AI agent for remote code execution. More * A new BootROM exploit, "usbliter8," permanently compromises Apple's A12 and A13 chips via

Hi there! As agent usage increased in my daily workflow I’ve decided to deepen my knowledge in this subject. This decision is backed by three important factors: better understanding leads to better usage, new agents can be created based on my specific needs, being aware of agents’ internals means

Hi there! 🛡️ Security & Privacy * Meta's Instagram AI support chatbot turned out to be a zero-auth account takeover machine — attackers only needed a username, a VPN, and the patience to ask nicely. The AI would reset passwords to an arbitrary attacker-controlled email with no verification, bypassing

Hi there! 🛡️ Security & Privacy * Inaudible sounds hidden in podcasts and videos can silently hijack AI voice chatbots, injecting malicious commands below the threshold of human hearing — a new class of adversarial prompt injection that works in the real world without the victim noticing anything. More * Microsoft Copilot Cowork is

Hi there! 🛡️ Security & Privacy * Mini Shai-Hulud strikes again: A compromised npm maintainer account published 637 malicious versions across 317 packages — including echarts-for-react (3.8M dl/mo) and size-sensor (4.2M dl/mo) — in a 22-minute automated burst. The payload harvests AWS keys, GitHub tokens,

Hi there! 🛡️ Security & Privacy * TanStack supply chain taken down by chained GitHub Actions exploit: An attacker combined a pull_request_target Pwn Request, GitHub Actions cache poisoning across fork/base trust boundaries, and in-memory OIDC token extraction to silently publish 84 malicious versions across 42 @tanstack/* npm packages

Hi there! 🛡️ Security & Privacy * Double Linux LPE week — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — Back-to-back kernel privilege escalation exploits hit in a single week. Copy Fail targets a page-cache write flaw and can be partially mitigated by rootless

Hi there! 🛡️ Security & Privacy * Notepad++ CVE-2026-3008: a %s format specifier in nativeLang.xml triggers a string injection in FindInFiles, enabling DoS crashes and memory address leaks that can bypass ASLR. Patched in v8.9.4; update immediately. More * GitHub RCE CVE-2026-3854 (CVSS 8.7): Wiz

Hi there! 🛡️ Security & Privacy * 🚨 Bitwarden CLI 2026.4.0 compromised in supply chain attack — Attackers abused a GitHub Action in Bitwarden's CI/CD pipeline as part of the ongoing Checkmarx campaign; update immediately and rotate credentials. More * Pack2TheRoot (CVE-2026-41651): cross-distro Linux privilege escalation — CVSS

Hi there! 🛡️ Security & Privacy * Vertex AI vulnerability allowed malicious agents to exfiltrate Google Cloud data and access private Artifact Registry images — exploiting excessive default permissions in the P4SA service agent. Patch by enforcing least privilege and using BYOSA. More * axios supply chain attack: a hijacked npm maintainer account published

Hi there! 🛡️ Security & Privacy * GrapheneOS reaffirms its no-ID, no-account policy, pledging to remain globally accessible to anyone without collecting personal information — even if device sales become restricted in certain regions. More * Sysdig launches runtime security purpose-built for AI coding agents, extending its cloud-native protection platform