Advertise on podcast: #AxisOfEasy Weekly Tech Digest

In this issue: PHP Ships Emergency Security Release For Two Critical RCE Flaws Staples Hacked, Millions In Gift Cards, Goods Shipped Back To China Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site In this issue: PHP Ships Emergency Security Release For Two Critical RCE Flaws Staples Hacked, Millions In Gift Cards, Goods Shipped Back To China Broadcom Wi-Fi Flaw Lets An Attacker In Range Run Code As Root On Routers Discover Tech Turned Targeted Ads Into A Pipeline For Zero-Click Spyware Feds Suspect Ransom Negotiator Ran ShinyHunters’ Extortion Site

In this issue: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF In this issue: A Flock-Like Camera In Canada, Pointed At The Police Station — Then The Police Visited French Supermarket Freezers Cranked To 50C — Hundreds Of Stores Affected, Fires Reported An OpenAI Engineer Was Arrested For Planting A Listening Device In A Conference Room GitHub Tightens Npm Publishing After Flaw Left 1,500+ Packages Vulnerable To Hijacking Ghostscript Flaw Lets Attackers Hijack Servers Through A Single Crafted PDF

In this issue: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009 In this issue: Bitget Exchange Loses $387.5 Million After Attackers Exploit A Zero-Day In Security Software 18 Months In Prison. Wrong Username. OpenInfra Europe’s JFrog Artifactory Breached — Anyone Who Pulled Packages Between August 28 and September 15 Should Assume Compromise CISA Warns A Single Crafted Request Can Give Root On Exposed MikroTik Routers More Than Half A Million GitHub Credentials Were Still Valid Years After Being Posted — Some From 2009

In this issue: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack A Pentagon Personnel Database Was Quietly Open For Nine Months An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It Mark E. Jeftovic: What’s Really Behind The AI Panic   In this issue: Citrix’s NetScaler Zero-Days Were Exploited For Weeks Before Anyone Patched Apple Patches A Zero-Day Used In An “Extremely Sophisticated” Spyware-Style Attack A Pentagon Personnel Database Was Quietly Open For Nine Months An AI Agent Broke Into A Vulnerability-Disclosure Nonprofit, And Was Bad At It Mark E. Jeftovic: What’s Really Behind The AI Panic

https://youtu.be/LhHjgNFWLso In this issue: Google Confirms Gemini Broke Into Three Real Companies During A Security Test Cisco Patches Two Actively Exploited Zero-Days In Two Days Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts Ireland Fines Google $463 Million Over How It Handled Your Location History A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit https://youtu.be/LhHjgNFWLso In this issue: Google Confirms Gemini Broke Into Three Real Companies During A Security Test Cisco Patches Two Actively Exploited Zero-Days In Two Days Microsoft Takes Down An AI-Powered Phishing Platform That Hit 12,000 Accounts Ireland Fines Google $463 Million Over How It Handled Your Location History A Maximum-Severity D-Link Router Bug Has No Patch And A Public Exploit

In This Issue: A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories In This Issue: A Compromised HBO Max Account Became A Malware Storefront Iran’s Spyware Playbook: Befriend You On WhatsApp, Then Own Your Laptop Chinese Spies Turned Google’s Own Bug Fixes Into A Working Exploit Google Patches A Zero-Click Pixel Bug That Was Already Being Used On Real Phones A Fake Government Email Got Revolut To Hand Over Passports And Bitcoin Histories

In this issue: Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment In this issue: Your LG TV Is Listening Even When It’s “Off” A Swarm Of OpenAI Agents Secretly Ran A German Wiki As Their Message Board For Three Months Hackers Drain $320 Million From Liquid Network, Then Give Most Of It Back Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days Trezor’s Address Breach Just Went Analog: Scam Letters With Malicious QR Codes Anthropic Employee (for six weeks) Sounds the Alarm on AI Alignment

In this issue: A dark-web service is selling scans of 153 million U.S. and Canadian driver’s licences, and the trail points at the vendor that scans IDs at rental counters and dispensaries. A cyberattack knocked out Boston Scientific’s order-and-shipping systems worldwide and delayed activation of new pacemaker home monitors. A perfect-storm JFrog Artifactory bug lets anyone mint an admin token, and attackers were forging them within three days of the patch. Researchers spent $535.74 and eight and a half hours getting Claude to port a working exploit to an industrial controller — then it bricked the device. Two more surveillance backdoors turned up in Chinese-made routers sold worldwide under brand names the real manufacturer never prints on the box. In this issue: A dark-web service is selling scans of 153 million U.S. and Canadian driver’s licences, and the trail points at the vendor that scans IDs at rental counters and dispensaries. A cyberattack knocked out Boston Scientific’s order-and-shipping systems worldwide and delayed activation of new pacemaker home monitors. A perfect-storm JFrog Artifactory bug lets anyone mint an admin token, and attackers were forging them within three days of the patch. Researchers spent $535.74 and eight and a half hours getting Claude to port a working exploit to an industrial controller — then it bricked the device. Two more surveillance backdoors turned up in Chinese-made routers sold worldwide under brand names the real manufacturer never prints on the box.

In This Issue: DOJ and FBI Seize Chinese State-Backed Hacking Platforms That Hit NASA, the Fed, and the Senate AI Hallucinates Domains for Your Brand. Criminals Are Already Registering Them. Microsoft Patches a Maximum-Severity Entra ID Flaw — Then Walks Back the “Exploited” Claim DOJ Charges 17 More Iranians in a Decade-Long Campaign That Stole 31 Terabytes From 144 US Universities OpenAI Hits the Brakes on Model Training After Its Own Agent Hacked Hugging Face   In This Issue: DOJ and FBI Seize Chinese State-Backed Hacking Platforms That Hit NASA, the Fed, and the Senate AI Hallucinates Domains for Your Brand. Criminals Are Already Registering Them. Microsoft Patches a Maximum-Severity Entra ID Flaw — Then Walks Back the “Exploited” Claim DOJ Charges 17 More Iranians in a Decade-Long Campaign That Stole 31 Terabytes From 144 US Universities OpenAI Hits the Brakes on Model Training After Its Own Agent Hacked Hugging Face

In this issue: Apple’s Spyware Pager Goes Off in 110 Countries A Nation-State Crew Rooted 361 vCenter Servers in 47 Countries — Patch  Was Out Five Days Nine Fortune 500 Names, Millions of Records: The Azure Credential Dump  Nobody’s Calling a Breach GeoServer’s Unpatched Zero-Day Is Getting Probed Right Now, and There’s  No Fix Yet The March Supply-Chain Attack That Keeps Getting Bigger: LiteLLM’s  2,500-Company Hangover In this issue: Apple’s Spyware Pager Goes Off in 110 Countries A Nation-State Crew Rooted 361 vCenter Servers in 47 Countries — Patch  Was Out Five Days Nine Fortune 500 Names, Millions of Records: The Azure Credential Dump  Nobody’s Calling a Breach GeoServer’s Unpatched Zero-Day Is Getting Probed Right Now, and There’s  No Fix Yet The March Supply-Chain Attack That Keeps Getting Bigger: LiteLLM’s  2,500-Company Hangover