"Motorola phones have started hijacking the Amazon app to insert affiliate codes"

9to5Google

Motorola phones have started hijacking the Amazon app to insert affiliate codes [Video]

A truly bizarre situation on Motorola phones has led to the software hijacking the Amazon app to inject an affiliate...

🤦‍♂️ #enshittification #crap #motorola #android

OpenSUSE Slowroll just landed on my test machine. Looking and behaving good. 👍 Strong candidate to replace my main one in the future. 🦎 #opensuse #slowroll #os #linux

"Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised"

SafeDep - Real-time Open Source Software Supply Chain Security

Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised

A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and...

#security #infosec #netsec #npm #node #javascript #supplychain

"Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor"

Tom

Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor

Also, it

Yikes... if we even needed more reasons to avoid Windows and Microsoft's encryption tools. #security #infosec #windows #bitlocker #microsoft

Operation Epic Furious

Play Operation Epic Furious, from The Secret Handshake.

😂 😂 😂 Spot on

"Google Broke reCAPTCHA for De-Googled Android Users"

Reclaim The Net

Google Broke reCAPTCHA for De-Googled Android Users

The company that decides whether you're a bot now also requires you run its software to prove otherwise.

This is getting worse and worse. As it has been said before, we need open alternatives to the duopoly. Also, don't use reCAPTCHA; there are other decent alternatives. #privacy #android #technology #mobile

Primer on GitHub Actions Security"

wiz.io

GitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog

Part one of a two-part series on GitHub Actions security, covering the core threat model, common misconfigurations, and real-world attack examples.

#security #infosec #ci #githubactions

Is anyone surprised? 🥸

theregister

Kids can bypass some age checks with a drawn-on mustache

: 46% say age checks are easy to bypass, and nearly a third admit getting around them

#agechecks #ageverification

"3 constraints before I build anything"

3 constraints before I build anything | Jordan Lord

[

#product #builders #constraints

"VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage"

VS Code inserting 'Co-Authored-by Copilot' into commits regardless of usage | Hacker News

Wow. I'm glad I changed editors a while ago; this is definitely not acceptable. You should too; there are many good ones out there. #microsoft #vscode #ai

Credit Cards Are Vulnerable To Brute Force Kind Attacks"

Credit Cards Are Vulnerable To Brute Force Kind Attacks | Metin's Blog

#security #creditcards

"Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign"

Socket

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...

Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

#security #infosec #bitwarden #supplychain

As if you needed more reasons to stop using Windows and other Microsoft products and services.

BleepingComputer

Microsoft suspends dev accounts for high-profile open source projects

Microsoft has suspended developer accounts used to maintain multiple high-profile open-source projects without proper notification and no way to qu...

#microsoft #opensource #softwaredevelopment

A couple of links with tips to help with supply chain security: *

GitHub

GitHub - lirantal/npm-security-best-practices: Collection of npm package manager Security Best Practices

Collection of npm package manager Security Best Practices - lirantal/npm-security-best-practices

*

Bernát Gábor — Python packaging, tox, virtualenv & open source

Defense in Depth: A Practical Guide to Python Supply Chain Security

A comprehensive guide to securing your Python dependencies from ingestion to deployment, covering linting, pinning, vulnerability scanning, SBOMs, ...

#python #javascript #pypi #npm #security #infosec #supplychain

"Django security releases issued: 6.0.4, 5.2.13, and 4.2.30"

Django Project

Django security releases issued: 6.0.4, 5.2.13, and 4.2.30

Posted by Jacob Walls on April 7, 2026

#django #python #security

"axios Compromised on npm - Malicious Versions Drop Remote Access Trojan"

axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity

Hijacked maintainer account used to publish poisoned axios releases including 1.14.1 and 0.30.4. The attacker injected a hidden dependency that dro...

Just another Tuesday. Developing software is becoming a riskier business by the day. #npm #javascript #nodejs #security #supplychain

"End of “Chat Control”: EU Parliament Stops Mass Surveillance in Voting Thriller – Paving the Way for Genuine Child Protection!"

Patrick Breyer

End of “Chat Control”: EU Parliament Stops Mass Surveillance in Voting Thriller – Paving the Way for Genuine Child Protection!

The controversial mass surveillance of private messages in Europe is coming to an end. After the European Parliament had already rejected the indis...

#eu #chatcontrol

"A YC-Backed Startup Left Production AWS Keys Public for 5 Months. Their VDP Was Silent." https://benzimmermann.dev/blog/pump-vdp-silence #security #infosec #yc #cybersecurity

Managing SSH keys with KeePassXC is actually quite nice -------------- It all started with a post on Lobste.rs, someone asking how others manage their SSH keys. It was a question that I had already asked myself multiple times, so I was genuinely interested in reading about what others had to say. There must be a better way than storing them encrypted on your disk and manually inputting the passphrases while loading them to the agent every morning. When KeePassXC […]

Managing SSH keys with KeePassXC is actually quite nice – Gonçalo Valério

#keepassxc #ssh #sshAgent

"Lock the Ghost: In the software world, “remove” is not equal to "gone.""

CERT.at - Lock the Ghost

In the software world, “remove” is not equal to "gone." This is crystal clear. There is always a good reason for that. Let’s take a short tri...

#pypi #dependencies #supplychain #lockfiles #python