News that matters, without the noise.

Cybercriminal Twins Caught After They Forgot to Turn Off Microsoft Teams Recording

Plus: Instructure’s Canvas ransomware debacle comes to a close, an alleged dark net market kingpin gets arrested, OpenAI

CVE-2026-8704

Critical Severity Description Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

CVE-2026-8700

Critical Severity Description Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl’s

Malicious JPEG Images Could Trigger PHP Memory Safety Vulnerabilities

Two critical memory-safety vulnerabilities in PHP’s image-processing functions could allow attackers to leak sensitive heap memory or to

Elon Musk quickly became a viral meme after stealing the show at U.S.-China state dinner in Beijing

Google Project Zero Discloses Zero-Click Exploit Chain for Pixel 10 Devices

A newly disclosed zero-click exploit chain targeting Google Pixel 10 devices has raised fresh concerns about Android’s low-level

Android 16 VPN Bypass Lets Malicious Apps Reveal Users Real IP Address

A newly disclosed flaw in Android 16 is raising serious privacy concerns after researchers revealed that malicious apps

Friday Squid Blogging: Bigfin Squid

Article about the bigfin squid. As usual, you can also use this squid post to talk about the

DSA-6277-1 openjpeg2 – security update

https://security-tracker.debian.org/tracker/DSA-6277-1

DSA-6276-1 ffmpeg – security update

https://security-tracker.debian.org/tracker/DSA-6276-1

CVE-2026-45619

Medium Severity Description AVideo CVE-2026-43884 incomplete fix – six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP`

CVE-2026-45610

Medium Severity Description AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a