InfoSec

Meta reportedly patched a virtual machine escape vulnerability in its MetaMuse product immediately before launch, according to 404 Media reporting. A VM escape flaw would let code break out of an isolated virtual machine, a serious security risk. Users in infosec and tech communities are discussing the fix and whether it connects to a fellow Mastodon user known to run servers from their own systems.

Saif al-Din Khader, known online as "Rey" and "Hikki-Chan," has been arrested in Jordan, according to reporting by Reuters journalists Raphael Satter, Dana Winter and Aj Vicens. Accounts in the cybersecurity community are circulating the news, saying he is allegedly cooperating with the FBI. Details about the charges remain limited so far.

A user asked lawyers on the Fediverse for recommendations on how a non-lawyer can gain practical knowledge of US and state law, including classes or certifications. The question drew engagement from the infosec community and touched on self-education in legal matters.

A cybersecurity commentator has published a comparative analysis of Ireland's MyGovID and Denmark's CPR personal identifier systems, examining how the two countries handle digital identity. The piece touches on age verification, digital rights, GDPR and data protection, prompting discussion among privacy and security professionals about how national ID schemes balance convenience against citizen data risks.

A new ransomware group calling itself SilentRansomGroup has been profiled in a fresh threat intelligence write-up. The post lists the group's name and activity but leaves its targeted sector unknown, and details remain limited. Cybersecurity researchers are circulating the alert among threat intelligence and infosec communities as they track the group's emergence.

A developer is asking the security community for feedback on age-rt, an encryption design inspired by the age file encryption format but built for low-latency streaming with variable chunk sizes. The proposal is being shared on Infosec Exchange, with discussion expected to focus on whether the design is sound and how it might fit real-time use cases.

Cybersecurity analysts are warning about a possible phishing campaign hosted through a Google Forms link. The alert, shared on the social platform Mastodon, defuses the link and points to an automated URL analysis service so others can inspect the page before interacting with it. The warning is being circulated under phishing and infosec tags among the security community.

ChainKeep, a tool aimed at digital forensics and incident response professionals, is being promoted with the message that every second matters in an investigation and that the software ensures every timestamp is accounted for. The pitch highlights chain-of-custody concerns in cybersecurity investigations, where accurate time records can determine whether evidence holds up. Discussion so far appears limited to infosec circles.

CVE-2026-71297 describes a moderate authentication bypass in the maestro gRPC broker used by Red Hat Advanced Cluster Management and the Multicluster Engine. An attacker holding a valid client certificate could read other consumers' event streams or forge agent status reports. Security trackers and infosec communities are circulating the disclosure, with no confirmed exploitation reported so far.

Security researchers have flagged a suspected phishing page hosted on a weebly.com subdomain mimicking Roundcube webmail. The URL has been defanged to prevent accidental clicks, and a public scan of the site has been published for others to review. The warning circulated among infosec communities, who shared it with tags for phishing, scam and cybersecurity awareness.

A new edition of BSidesLimburg has been announced for March 12, 2027 in Hasselt, Belgium. The community-run cybersecurity conference is part of the global BSides series of information security events, and the announcement is circulating among infosec professionals tracking upcoming conferences.

An article circulating on Mastodon describes Strata, an open-source AI engine that reportedly lets users run the 125-billion parameter Qwen3.8-Flash-Next model on consumer GPUs with just 12GB of memory. The claim, shared via the infosec and tech community, is drawing attention for suggesting high-end models can run on ordinary hardware without expensive setups.

Cybersecurity observers are warning about a suspected phishing site at unipd.godaddysites.com, a domain mimicking the University of Padua but hosted on a free GoDaddy site builder rather than the university's own infrastructure. The site has been submitted for technical analysis, and warnings are circulating in infosec communities urging users to avoid entering credentials on lookalike academic login pages.

Cybersecurity researchers are warning about a phishing page hosted on a compromised WordPress site, mimicking Caixa's card verification service. The malicious page, found under a plugins directory, is designed to steal banking credentials. A full analysis of the fraudulent infrastructure has been published, and the warning is circulating among infosec professionals tracking scams targeting banking customers in Spanish-speaking regions.

A cybersecurity researcher has flagged a possible phishing page hosted on a Weebly subdomain, sharing the link in defanged form along with a public URL analysis on urldna.io. The post serves as a warning to the infosec community, allowing others to inspect the site's infrastructure without exposing themselves to the scam. Details about the phishing campaign's targets or scale were not provided.

Cybersecurity accounts are warning about a suspected phishing page hosted on a GitBook subdomain, sharing the address in defanged form so readers cannot accidentally click it. A scan link from the URL analysis service urlDNA has been attached, letting other researchers inspect the domain's infrastructure, hosting details and behaviour. The warning is circulating with standard tags like #phishing and #infosec.

Cybersecurity researchers are warning about a suspected phishing site impersonating Amazon, hosted on a Vercel app domain. The URL has been defanged to prevent accidental clicks, and a technical analysis of the page has been published on UrlDNA. The warning circulates in infosec communities, with users urged to avoid entering Amazon credentials on unfamiliar domains and to verify URLs before logging in.

Autonomous system number AS206314 has been registered in Gorzów Wielkopolski, Poland, with records dating it to 2 October 2026. Cybersecurity watchers track newly announced ASNs because they can reveal fresh network infrastructure before it is fully characterised, and newly seen ranges are often scanned, mapped and assessed for security exposure.

A newly added entry on the Shodan Safari watchlist points to AS12874, the network of Italian provider Fastweb, located in Milan, Italy, logged on 30 September 2026. Security watchers circulating the entry are highlighting freshly exposed or newly indexed systems on Italian infrastructure as part of ongoing discussions about what internet-wide scanning reveals.

Information security researchers are discussing AS18229, an autonomous system based in Mumbai, India, after it was added to monitoring feeds on 3 October 2026. The asn entry circulated among cybersecurity practitioners tracking newly visible networks and exposed internet-facing services, prompting conversations about what assets the network hosts and whether proper security configuration is in place.

Cybersecurity researchers are warning about a suspected phishing website hosted on a Cloudways application domain (wordpress-1644952-6533726.cloudwaysapps.com). A link analysis of the address has been published on URLDNA so others can inspect the site's infrastructure. The warning is being circulated in infosec communities with the standard advice to treat the domain as unsafe.

A new BSides Barcelona event has been added to the cybersecurity conference calendar, scheduled for October 30, 2026 in Barcelona, Spain. BSides events are community-run security conferences that take place in cities worldwide, offering talks and workshops for information security professionals. The announcement is being shared across infosec community channels as attendees plan for the event.

Cybersecurity watchers are logging network AS6167, registered to San Luis Obispo, California, after its addition to internet scanning records on 2 October 2026. The sighting was shared under infosec hashtags, as part of a routine pastime of tracking newly added autonomous system numbers to spot changes in internet infrastructure.

Cybersecurity observers are warning about a suspected phishing page hosted on a Weebly subdomain, jpalominoh.weebly.com. The site has been submitted for automated analysis via the URLDNA scanning service, with the alert circulating among infosec communities tagged under phishing, scam and cybersecurity. Details about who is targeted or what the fake page impersonates have not yet been disclosed.

The Ph0wn cybersecurity conference has been announced for March 12-13, 2027 in Sophia Antipolis, France. Organisers say the dates and location are confirmed on the event's website. The announcement is being shared among information security professionals tracking upcoming industry conferences in Europe.

The autonomous system AS63410, based in Atlanta in the United States, has been added to an internet-wide infrastructure scanning index as of 2 October 2026. Security researchers track such additions to spot newly exposed or re-registered networks. Little is known publicly about what services the network hosts or who operates it.

A newly registered entry for AS12912, an autonomous system based in Warsaw, Poland, dated 2 October 2026, is circulating among cybersecurity researchers who track internet-exposed devices and network infrastructure. The item carries the tags shodansafari and infosec, suggesting analysts are monitoring the network's exposure as part of routine scanning of newly added assets.

AS7018, the autonomous system number associated with AT&T, was logged with a location of Santa Clara, United States, with the entry timestamped 30 September 2026. The notation circulated among cybersecurity practitioners who track internet-exposed devices and network assets using Shodan, the search engine for connected hardware.

Security researchers are warning about a phishing site impersonating DocuSign, hosted on a Webflow domain that mimics the e-signature service. The suspicious link has been defanged to prevent accidental clicks, and a public URL analysis has been shared so others can inspect the site's infrastructure. Infosec communities are circulating the alert to help people avoid credential theft scams that use fake document-signing pages.

A newly indexed entry on the Shodan search service lists AS8151, the autonomous system operated by Unistar-TELECOM in Mexico City, Mexico, with an addition timestamp of 6:28 UTC on October 3, 2026. The note circulated among cybersecurity practitioners using Shodan to browse for freshly exposed networks and services, a routine practice for spotting infrastructure changes.

National Cybersecurity Awareness Month has begun, and information security professionals are marking the first Monday of the month by focusing on security awareness training. One message circulating in the infosec community argues that current training efforts fall short and that organisations "can do better," urging practitioners to keep pushing the message to employees and leadership throughout October.

A newly indexed entry on the Shodan search engine lists AS2514, an autonomous system number located in Tokyo, Japan, added on 29 September 2026. Infosec practitioners use such ASN listings to track exposed services across a network operator's address space and assess what is publicly reachable.

A vulnerability, tracked as CVE-2026-105134, has been reported in AhsayCBS, the backup software from Ahsay, affecting versions up to 10.3.2. The flaw was published on a threat-tracking service and is circulating among infosec communities, with security professionals flagging it for administrators who run Ahsay backup infrastructure. Details on severity and exploitation remain limited so far.