InfoSec

Saif al-Din Khader, known online as "Rey" and "Hikki-Chan," has been arrested in Jordan, according to reporting by Reuters journalists Raphael Satter, Dana Winter and Aj Vicens. Accounts in the cybersecurity community are circulating the news, saying he is allegedly cooperating with the FBI. Details about the charges remain limited so far.

Meta reportedly patched a virtual machine escape vulnerability in its MetaMuse product immediately before launch, according to 404 Media reporting. A VM escape flaw would let code break out of an isolated virtual machine, a serious security risk. Users in infosec and tech communities are discussing the fix and whether it connects to a fellow Mastodon user known to run servers from their own systems.

Security researchers have flagged a website hosted on a Weebly subdomain as a likely phishing operation, warning users to avoid interacting with it. The site has been submitted for URL analysis, and the warning is circulating among infosec specialists who track scam infrastructure. The defanged link format suggests researchers are deliberately limiting accidental clicks while sharing indicators with the wider security community.

A user asked lawyers on the Fediverse for recommendations on how a non-lawyer can gain practical knowledge of US and state law, including classes or certifications. The question drew engagement from the infosec community and touched on self-education in legal matters.

Cybersecurity watchers are warning about a suspected phishing page hosted on a Framer.app subdomain, sharing the masked link and a technical analysis via the URLDNA scanning service. The alert circulates among infosec professionals, who use defanged links to prevent accidental clicks. Hosted phishing pages on legitimate website builders remain a common tactic because the domains often pass basic reputation checks.

Cybersecurity specialists have identified a fraudulent domain impersonating Coinbase, the major cryptocurrency exchange, designed to trick users into handing over login credentials. The domain is defanged to prevent accidental visits, and a technical analysis of the site has been published for other researchers. The alert circulated among infosec communities monitoring phishing and scam activity.

Cybersecurity observers are warning about a possible phishing website hosted on a GoDaddy Sites domain, sharing the address in defanged form so readers cannot accidentally click it. A technical scan of the page has been published on the URL analysis service urlDNA for others to inspect. Such warnings circulate quickly among information security professionals tracking new scam infrastructure.

A cybersecurity researcher has flagged the website tgxnh.com as a possible phishing domain, sharing an automated analysis of the URL on the UrlDNA scanning platform. The warning, circulated with defanged link formatting to prevent accidental clicks, has drawn attention from the infosec community. Details about the site's infrastructure or specific victims have not been disclosed.

Cybersecurity observers are warning about a possible phishing site hosted on a Weebly subdomain, sharing the address in defused form and linking to a public URL analysis for inspection. The alert circulated among infosec accounts, who urged others to avoid the link. Little is known about who is behind the site or what it impersonates, and Weebly has not commented. The warning serves as a reminder that free website builders are often abused for phishing campaigns.

ChainKeep, a tool aimed at digital forensics and incident response professionals, is being promoted with the message that every second matters in an investigation and that the software ensures every timestamp is accounted for. The pitch highlights chain-of-custody concerns in cybersecurity investigations, where accurate time records can determine whether evidence holds up. Discussion so far appears limited to infosec circles.

Cybersecurity researchers are warning of a suspected phishing page hosted on a Cloudflare R2 storage subdomain, sharing the address in defanged form so readers do not accidentally visit it. A link to an automated URL analysis service was included so others can inspect the page's behaviour. The alert circulated among infosec practitioners, who commonly share such indicators to help block and track new scam infrastructure.

A cybersecurity commentator has published a comparative analysis of Ireland's MyGovID and Denmark's CPR personal identifier systems, examining how the two countries handle digital identity. The piece touches on age verification, digital rights, GDPR and data protection, prompting discussion among privacy and security professionals about how national ID schemes balance convenience against citizen data risks.

Cybersecurity researchers are warning about a suspected phishing page hosted on sugumail.com, a webmail service. The alert was shared with a defanged link and an automated URL analysis scan on the platform URLDNA, which examines sites for malicious behavior. The warning circulated among infosec communities tagged under phishing, scam, and cybersecurity. No victims or specific campaign details have been reported so far.

Security researchers are warning about a suspected phishing domain impersonating HSBC, registered at hsbc-sec.com. The suspicious site was shared with a defanged link so others would not accidentally visit it, and an analysis has been published on the URLDNA scanning service. Infosec communities on Mastodon are circulating the warning with tags for phishing, scams and cybersecurity.

Cybersecurity researchers are warning about a phishing site impersonating Facebook at a lookalike blogspot address that swaps characters in the domain to trick users. The link is being shared in defanged form so people cannot click it accidentally, and a full technical analysis has been published on URLDNA showing the site's characteristics. The warning circulates among infosec communities as a reminder to check domain spelling before entering login credentials.

Cybersecurity observers are warning about a suspected phishing site hosted on a Blogspot address impersonating Facebook, with the domain name combining "facebook" and "bigeronline". The malicious link has been defanged and shared alongside a URL analysis report so others can inspect it. The alert circulates in infosec communities, where users are urging caution against similar fake login pages.

Cybersecurity researchers are tracking a new ransomware group calling itself Bavacai, which has published a blog post titled 'Balaqah' on its leak site. Threat intelligence monitors flagged the activity, and a tracking page with details on the group has been made available to the infosec community. Details about the group's victims and operations remain limited while analysts assess the new threat.

Cybersecurity observers are warning about a suspected phishing page hosted on a Wix domain masquerading as a strategy firm outreach message. The warning, shared with the wider infosec community, includes a link to an analysis of the site on the URLDNA scanning platform, which breaks down the page's infrastructure and behavior. Users are advised to avoid the link and verify unsolicited outreach before responding.

A new ransomware group calling itself SilentRansomGroup has been profiled in a fresh threat intelligence write-up. The post lists the group's name and activity but leaves its targeted sector unknown, and details remain limited. Cybersecurity researchers are circulating the alert among threat intelligence and infosec communities as they track the group's emergence.

Security researchers have identified a suspected phishing website hosted on a Google Sites page, sharing the address in defanged form so others cannot accidentally click it. A scan of the page has been published on URLDNA for analysis. The warning circulates within the infosec community, which regularly exchanges such alerts to help defenders block malicious pages and alert potential victims quickly.

CVE-2026-71297 describes a moderate authentication bypass in the maestro gRPC broker used by Red Hat Advanced Cluster Management and the Multicluster Engine. An attacker holding a valid client certificate could read other consumers' event streams or forge agent status reports. Security trackers and infosec communities are circulating the disclosure, with no confirmed exploitation reported so far.

A developer is asking the security community for feedback on age-rt, an encryption design inspired by the age file encryption format but built for low-latency streaming with variable chunk sizes. The proposal is being shared on Infosec Exchange, with discussion expected to focus on whether the design is sound and how it might fit real-time use cases.

Cybersecurity analysts are warning about a possible phishing campaign hosted through a Google Forms link. The alert, shared on the social platform Mastodon, defuses the link and points to an automated URL analysis service so others can inspect the page before interacting with it. The warning is being circulated under phishing and infosec tags among the security community.

Autonomous system AS16276, the network range operated by French hosting provider OVHcloud, was added to a cybersecurity tracking log on 2 October 2026 with a listed location of Vaudreuil-Dorion, Canada. The entry circulated among infosec observers who follow hosting infrastructure. No further details about the reason for the addition were given.

A cybersecurity account on Mastodon is warning of a possible phishing page hosted on a Gitbook subdomain, kuconlegen.gitbook.io. The link has been defanged and a technical analysis of the URL has been published on the urlscan service UrlDNA. The Gitbook domain is commonly abused by scammers because it lets anyone host free pages that look legitimate. Users are advised to be cautious with unfamiliar links.

Cybersecurity observers are warning about a fraudulent website, facebook.meweb.kz, that imitates Facebook and is suspected of being used for phishing. The site's domain is registered in Kazakhstan, and a technical analysis of the URL has been published so that others can inspect it and avoid falling victim. Alerts like this circulate regularly in infosec communities to help people spot scam pages that harvest login credentials.

A newly indexed server assigned to autonomous system AS24940, hosted in Falkenstein, Germany, was logged on 2 October 2026 and flagged with cybersecurity hashtags. AS24940 is the network of German hosting provider Hetzner, and Falkenstein is home to one of its data centres. The entry is being shared among information security watchers who track newly exposed systems in Shodan's internet-wide scans.

Cybersecurity researchers are highlighting AS44034, an autonomous system registered in Stenkullen, Sweden, as part of an ongoing network-mapping exercise in the information security community. The ASN was added to a tracking list on 29 September 2026, prompting discussion among professionals who scan and catalogue internet-exposed infrastructure using Shodan data.

A threat actor using the name 'BYOD' has posted an undisclosed claim of a compromise apparently linked to Liberty X and TMO, with partial samples circulated among dark-web watchers. Security sources flag the claim as unverified, and analysts on infosec forums are debating its credibility while awaiting confirmation from the named organisations.

Cybersecurity observers are warning about a suspected phishing website hosted on a free Webador subdomain. The site's address has been deliberately defused to prevent accidental clicks, and a link to a URLdna scan was shared so others can inspect hosting and content details. The warning circulates in infosec communities, where members routinely swap indicators of new scam pages targeting credentials or personal data.

A leak of Flock Safety camera filesystem data has drawn attention from security researchers. Following reports of issues such as hardcoded API keys in the devices, one researcher has published a beginner-friendly guide to reverse-engineering the camera's Android firmware so others can verify the findings themselves. The story is spreading among the infosec community, where Flock's surveillance network is already a contested topic.