Automobile Camouflage to Hide from Flock Cameras

Not sure it's practical, but it's certainly striking...

CVE-2026-83628

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

PT-2026-86313

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tml ms signup handler function's gimmeanotherblog branch failing to enforce the network's active signup registration policy,...

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

CVE-2026-73706

creationtimestamp| type| source ---|---|--- 2026-09-03 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mumrqcsupn2x...

Introducing More Granular Controls for AI Bot Traffic

...

CVE-2026-79676

creationtimestamp| type| source ---|---|--- 2026-09-01 16:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3muhu5rfqm52l...

Rewiring Democracy Series on The Renovator

Nathan E. Sanders and I are writing a series of essays on real-world examples of democratic technologies for The Renovator. I haven't been posting the full text on the blog because they're a bit long, but here are links. Part 1 is about the Japanese digital democracy party, Team Mirai. Part 2 is...

CVE-2026-78075

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

EUVD-2026-68529

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

awesome-list — Updated!

Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...

A week in security (August 24 – August 30)

Last week on Malwarebytes Labs: Protect your WhatsApp account with new passkey and 2FA upgrades The AI agent swarm that attacked Hugging Face is a warning for the future Flock wants privacy to meet surveillance halfway Fake listings can turn trusted platforms into scam springboards Fake Apple Pay...

Streamlining Application and API Discovery and Governance

...

CVE-2026-78075: Authorization Bypass Through User-Controlled Key

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

The Cybersecurity Apocalypse Is Coming in ‘Months,’ AI Giants Warn

Plus: Hackers target over 100 US water systems, ICE puts in an order for robot dogs, and you’ll never guess what “MrChildPorn” was arrested for...

Malicious Package

Overview aws-blog is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in aws-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b036991e88a4be9813e89ba9861b39ae37fbd9201d1bd017f81c8b33d5f5e44b package.json declares a dependency whose key equals the package's own name aws-blog with a value of https://repo.securityctrl.com/aws-blog instead of...

MAL-2026-15498 Malicious code in aws-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b036991e88a4be9813e89ba9861b39ae37fbd9201d1bd017f81c8b33d5f5e44b package.json declares a dependency whose key equals the package's own name aws-blog with a value of https://repo.securityctrl.com/aws-blog instead of...

Friday Squid Blogging: Truckload of Squid Spills in Rhode Island

Ugh: A tractor-trailer rollover sent a truckload of squid spilling into a Rhode Island roadway, leaving a stench as they sat in the road for hours in the summer heat. Local authorities have dubbed it the "Squidpocalypse of '26." That would be twenty tons of squid. As usual, you can also use this...