Cyber Bites

* Grafana Labs Confirms Ransomware Extortion Following TanStack Supply Chain Breach
* GitHub Confirms Internal Repository Breach After Employee Device Compromise
* Google Accidentally Exposes Details of Unpatched Chromium Vulnerability
* CISA Credentials Exposed in Public GitHub Repository for Six Months Before Takedown
* HackerOne Slashes Bug Bounty Payouts as AI Floods Open-Source Security Programs



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Signal Adds In-App Security Warnings to Combat Social Engineering Attacks
* Eighteen-Year-Old Vulnerability Discovered in Nginx Puts Millions of Web Servers at Risk
* OpenAI Confirms Security Breach Following Sophisticated Supply Chain Attack
* New Zero-Day Exploit Allows USB Stick to Bypass Windows BitLocker Encryption
* Agentic AI Is the Security Blind Spot Organisations Can No Longer Afford to Ignore



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Cybercriminals Abuse Amazon SES to Launch Undetected Phishing Campaigns
* ACSC Issues Warning Over ClickFix Attacks Deploying Vidar Stealer Malware
* Malicious OpenClaw Skill Weaponizes AI Agent Framework to Distribute Malware
* Survey Finds 1 in 8 Employees Consider Selling Company Login Credentials Justifiable
* 60% of MD5 Password Hashes Now Crackable in Under an Hour With a Single GPU



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Critical Linux “copyfiles” Vulnerability Grants Root Access on Major Distributions
* Critical cPanel & WHM Authentication Bypass Vulnerability Actively Exploited in the Wild
* Google Patches Maximum Severity CVSS 10 Flaw in Gemini CLI Amid Growing AI Tool Vulnerabilities
* KnowBe4 Research Reveals 86% of Phishing Attacks Are Now AI-Driven
* New “ClawHub” and “ClawSwarm” Malware Campaigns Target AI Agents for Crypto Recruitment



This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com

* Claude Desktop Raises Privacy Concerns Over Silent Browser Extension Installation
* Apple Patches iOS Bug That Preserved Deleted Notification Data
* Microsoft Teams Becomes Prime Target for Helpdesk Impersonation Scams
* Malicious Cryptocurrency Wallet Apps Infiltrate China’s Apple App Store
* Anthropic Mythos Discovered 271 Security Vulnerabilities in Firefox


This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com