Independent cybersecurity / privacy / AI risk journal
A restrained field journal for cybersecurity, privacy, and AI risk signals worth keeping.
Lead briefing
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime behavior rather than in installation scripts.
Latest
Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys for its onion service.
A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.
Topics
436 entries
Cybersecurity briefings on breaches, exploited vulnerabilities, ransomware, incident response, and systemic security failures.
47 entries
Privacy briefings on data misuse, tracking changes, surveillance harms, regulator action, and data rights enforcement.
156 entries
AI risk briefings on model misuse, deployment failures, safety regressions, governance gaps, and synthetic-media harms.
22 entries
Governance briefings on enforcement, standards, court action, regulator opinions, institutional accountability, and policy shifts.
7 entries
Infrastructure briefings on cloud, telecoms, public systems, network edge, and critical infrastructure risk developments.
3 entries
Surveillance briefings on biometrics, monitoring systems, identity correlation, tracking technology, and public or private observation systems.