Oneironaut

@Oneironaut@infosec.exchange
13 Followers
106 Following
1.4K Posts
GRC advocate. Cyber adjacent. Celine Dion fan

The UK Environment Agency has some tips for the public to help conserve water, including

> Deleting old emails to reduce pressure on data centre servers

I kid you not.

https://www.gov.uk/government/news/england-faces-5-billion-litre-public-water-shortage-by-2055-without-urgent-action

England faces 5 billion litre public water shortage by 2055 without urgent action

England faces 5 billion litre a day shortfall for public water supplies by 2055 – and a further 1 billion litre a day deficit for wider economy.

GOV.UK

Media outlets can't pivot to AI to save themselves. It's not a business strategy and it's not going to work. The only path forward is for journalists to lean into their humanity, to do things AI can't, and to make clear they are writing for people, not algorithms:

https://www.404media.co/the-medias-pivot-to-ai-is-not-real-and-not-going-to-work/

The Media's Pivot to AI Is Not Real and Not Going to Work

AI is not going to save media companies, and forcing journalists to use AI is not a business model.

404 Media

Microsoft president Brad Smith acknowledged that the four rounds of layoffs this year are more about using the money saved to fund AI data centers and GPUs than workers being replaced by AI.

I think this is important for the media to get right versus making it seem like ChatGPT can replace a human worker.

Go find more hardcoded secrets. And share them with the rest of us.

https://www.intigriti.com/researchers/blog/hacking-tools/advanced-github-dorking-guide

GitHub dorking for beginners: How to find more vulnerabilities using GitHub search

Bug bounty hunters who spend time in content discovery and reconnaissance are always rewarded well for their efforts, as they often come across untested and hidden assets or endpoints. GitHub dorking...

Intigriti

Public service announcement.

(Created by https://bsky.app/profile/campfireharve.st )

FortiWeb Pre-Auth RCE (CVE-2025-25257)

Hey! and welcome to another THEY BURNED MY BUG episode. This time, we introduce CVE-2025-25257. An SQLi that I spotted back in Feb. in case someone burn them before i get my bragging rights8157d42995395ba0c0cfccce37b934ebb63d3d5740ba43eda7fa853f389bca2a8fc4ca6426ae50c7673326eacb6644a8b361ad1051138d04cbd9da8b807a0973— faulty *ptrrr (@0x_shaq) February 9, 2025 This is a pre-auth SQLi bug that can be leveraged to an RCE in FortiWeb.

( ͡◕ _ ͡◕)👌

CVE-2025-5777 aka CitrixBleed 2 has been added to CISA KEV now over evidence of active exploitation.

Citrix are still declining to comment about evidence of exploitation as of writing.

https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog

@neurovagrant it can put them back too, right?

Belkin WEMO to shut down cloud operations and cripple WEMO iot devices in January 2026

https://www.belkin.com/support-article/?articleNum=335419

Belkin Official Support - Wemo Support Ending – What You Need to Know

Get help with Wemo Support Ending – What You Need to Know

Belkin US

How's that AI coding going for you? Ah... I see.

Wired: McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

"... Carroll and Curry, hackers with a long track record of independent security testing, discovered that simple web-based vulnerabilities—including guessing one laughably weak password—allowed them to access a Paradox.ai account and query the company's databases that held every McHire user's chats with Olivia. The data appears to include as many as 64 million records, including applicants' names, email addresses, and phone numbers...."

https://www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai/

#ai #cybersecurity #llm

McDonald’s AI Hiring Bot Exposed Millions of Applicants' Data to Hackers Using the Password ‘123456’

Basic security flaws left the personal info of tens of millions of McDonald’s job-seekers vulnerable on the “McHire” site built by AI software firm Paradox.ai.

WIRED
×

Ingram Micro have filed an 8-K for ransomware.

Some incredible wordsmithing here - rather than say when the incident began, they say when they issued a press release. Which was days later than when the incident began. I think this is because they missed SEC reporting deadlines.

https://www.sec.gov/ix?doc=/Archives/edgar/data/1897762/000162828025034372/ingm-20250705.htm

#ransomware

@GossiTheDog
Item 8.01. Other Events.

On July 5, 2025, Ingram Micro Holding Corporation (the “Company”) issued a press release stating the Company identified ransomware on certain of its internal systems. Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.

A copy of the press release is attached hereto as Exhibit 99.1, noting that the Company is working diligently to restore the affected systems so that it can process and ship orders.
#AltText #Alt4You

@GossiTheDog live shot of Ingram Micro issuing its press release in the middle of a ransomware attack
@zackwhittaker @GossiTheDog it's just as glorious as enron's shredder evolution
@GossiTheDog
German translatio of 8-K
= Ad-Hoc Meldung
https://www.deltavalue.de/form-8-k-sec-filing/
Form 8-K SEC Filing - Definition & Erklärung

Form 8-K Filing (SEC) ✅ Anleitung, Bedeutung & Interpretation ✅ So investierst und handelst du erfolgreich ✅ Jetzt mehr erfahren ➤

DeltaValue.de
@GossiTheDog I didn't see you close the loop here but Ingram say they've been fully operational again since the 9th July (an email just landed in my mailbox promoting https://www.ingrammicro.com/en-us/information )