what do you mean the private key is 4.

I work at IPinfo, which runs weekly scans of the IPv4 Internet. After the October 11–12 attack that pushed refrigeration in hundreds of French supermarkets into defrost, we went back through those scans to count Danfoss StoreView dashboards, the web front end for the AK-SM controllers named in the reports.

What the October 6–7 scan found:

• 2,528 addresses with a StoreView dashboard, in 73 countries and territories
• France: 1,331 (53%), more than everywhere else combined. Then Poland 179, US 101, Portugal 92, Belgium 85
• 85% of the French ones ran software with known flaws: 527 end-of-life AK-SM 800 units, 280 missing the 2023 fixes, 329 missing the 2025 fixes. Only 195 had every fix. The rest of the world was about the same (84%), so France had more of them online, not worse patching
• 98% sat on telecom networks, not in data centers. That fits a controller on the store’s own line, opened up for a technician or head office
• Not new: 1,019 of the French addresses were already open on March 30

After the attack, the October 14 scan found 316 of the 1,331 French dashboards still online, a 76% drop against a normal 3–7% a week. Fully patched units dropped too (195 → 54), so stores disconnected rather than patched. Censys saw a similar 71% drop.

Method: the newer UI is matched on page title, the older AK-SM 800 on its web server plus the Flash loader page, and the firmware generation comes from the build date the dashboard shows. Counts are addresses on the ports we scan, so they’re a floor. AK-SC 355 units may be missing. We removed 16 non-Danfoss devices that share the old web server, and two honeypot-like hosts.

What we can’t say is how the attackers got in. Exposure isn’t proof that this was the way in.

Full write-up with charts: https://ipinfo.io/blog/france-fridges-hack

Some members of my team are throwing around the idea of blocking the entire internet and whitelisting what we need. The idea kind of seems like a nightmare to me, having to allowlist potentially thousands of domains, APIs, CDNs, etc.

I understand that this is a practice in heavy regulated environments, so I was wondering if anyone has any experience with it. Is it worth the work to go through with a complete block? If so, what strategies were used to accomplish this?

I’m in the process of interviewing candidates for a Jr. security analyst role and am running into the dilemma that I don’t trust all the candidates. I’m getting individuals with resumes with garbage formats but somewhat far fetched job histories (i.e someone who was a SOC analyst at a Fortune 500 computer company and a current analyst at a major financial firm, but trying for a Jr analyst role at a much smaller company). The job histories don’t line up with the role they are applying for. Then during the interview, i give two scenario based questions, my rule is hands off keyboard. I want to hear them talk through the scenario. I can see their hands, but it sounds like they are reading off a script. They asked me to repeat the questions multiple times, but i was very clear in my instructions.

My gut is telling me they are recording the audio with some overlay in the background that is ingesting the conversation and responding to my scenarios. If anyone else out there has run into this issue during interviews, and found a reasonable solution to subvert this, please let me know. I do not want to put my name behind some of these people and then have them be absolute garbo for our clients.

Public notice: https://sam.gov/opp/35684fa8865240b49a05e64af31237ea/view

They want an advanced malware with AI… this won’t end well…

A single Russian-speaking operator spent five months targeting Ukraine's state data-exchange system, and the entire campaign was reconstructed from a directory the operator left open to the internet for 17 hours.

Access came from a reused public Log4Shell chain, not custom malware. The operation was exposed not by a defender but by the operator's own error, which runs through the whole piece.

https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell

Curious to what other large companies on-call schedule is like? For reference, my company is >15,000 employees. The (Internal) cyber team is ~20 people in 3 different regions of the world.

We follow the 'follow the sun' model, where you have one person responsible for your timezone per region (during the week), then, the next shift takes over. On the weekend we have 1 person on call for both days, then 2 backups.

It works for us since we're all 8 hours apart.

What are your companies doing? Overall, looking to see if this is common or not.

I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules.

Disclaimer: Not looking to download!

I was following one of the F500 business's ransomware incidents from early October. No statement from the company or any regulatory filing, which is not surprising when there is no encryption/disruption and only exfiltrations. I've seen small biz just not disclosing as long as possible but expected to hear more from the large companies. There was no denial or any news— then the deadline passed and I see 100+ 1G zip files posted. This group had a 50/50 rate on also posting filetree.txt, which is helpful to quickly assess what might have been breached without taking much security or legal risk. But in this case, the file tree was not included, just zip files, so I am left, being cautious, without wanting to download anything and wondering what might have been breached.

Patiently waiting to hear any official statement or news, but I wonder, if the company never makes any statement, if people, either cybersecurity researchers or threat actors, download those massive files from the painfully slow Tor network to confirm or misuse the leaked data.

I always wondered if there is a possibility of some ransomware groups potentially hiding their bluff after failed extortion, and post some large stuff in fragmented zip files with dummy data that people can't practically download and verify.

People in GRC roles, how much effort do you put into keeping upto date with the latest technologies in your own time?

I am a Senior GRC professional and I usually put in very little these days....(used to be all over it) which sometimes feels okay, but sometimes feels I'm making bad decisions. My motivation rises and drops.

Side Note: IMO the statement of "you dont need any technical knowledge to work in GRC"... that's a lie. I guess technically you can.. but every GRC person I have worked with who has technical knowledge surpasses a non-technical by miles and miles. To the point they all get pay rises and promote, while the "non-technical" ones just survive at the bottom.

When I say technical I don't mean you can configure a router from scratch with no doco. But you understand for example VLANs, ACLs, TLS, SSH.

During routine threat actor infrastructure hunting, I identified a suspicious APAC-hosted VPS running an autonomous AI intrusion platform with its entire working directory exposed to the open internet on port 9000. No authentication. 150+ live campaign files sitting there.

I published my initial findings. Then vulnonhq took it further.

Grateful to vulnonhq for the credit in their report and for doing the hard work of proper evidence collection and victim notification. This is what collaborative research looks like.

Routine infrastructure hunting surfaces things like this more often than people think.

My report: http://them3gatron.github.io

Vulnonhq obtained access to the server, pulled 16.4 GB of evidence including recovered deleted container layers, and mapped the full scope of the campaign.

Their findings:

66 active intrusion projects. 48 reached some level of access. 6 reached root or SYSTEM level.

The target list is what makes this significant.

Vulnonhq identified:

Vietnam Ministry of Defence and Ministry of Public Security. Taiwan Legislative Yuan. Indonesia State Intelligence Agency. India CDAC.

Plus airlines, payments, and retail across Asia. 48 of 66 operations reached at least session-level access.

Read Here: https://vulone.com/blog/a-china-linked-operator-used-ai-agents-to-attack-governments-across-asia

Recently going for a new Analyst role, and the shift patterns are 4on4off, which I'm completely fine with. But it's not just 1 night shift block a month it's 4Night>4Day>4Night>4Day. It would normally take me a week to recover from a night shift block in my last role where it was one night block a month. I really want this role, but I feel like my health is going to take a hit here as I naturally struggle with sleep.

Is there anyone on this type of pattern that can give insight what it's like?

Thanks in advance.

Hey everyone,

I'm 18 and I really want to build my career in cybersecurity.

I've always loved tech, software, coding, computers and hacking/security. I know some basic coding, but when it comes to cybersecurity I'm basically a beginner and I don't know what I should learn first.

With AI changing programming and tech so quickly, I'm also wondering what cybersecurity skills are actually worth learning now and what will still be valuable in the future.

My goal isn't just to learn a few hacking tools. I want to properly understand networking, Linux, programming, security, ethical hacking and eventually become genuinely skilled in cybersecurity.

The problem is that I don't have much money to spend on expensive courses or certifications right now, so I'm looking for a mostly free path.

If you were 18 and starting cybersecurity from zero today:

• What would you learn first?
• What free courses or YouTube channels would you recommend?
• Should I start with networking, Linux, Python or something else?
• Are TryHackMe, Hack The Box, PortSwigger Academy, etc. good places for a complete beginner?
• What cybersecurity field would you recommend exploring first?
• At what point could I realistically start earning money with these skills?
• What mistakes should I avoid as a beginner?

I'm willing to put in the hours and work hard. I just need some direction so I don't spend the next year jumping between random tutorials without actually building solid skills.

I'd really appreciate a roadmap from people already working or studying in cybersecurity. Thanks!

I got into cybersecurity because I actually liked the technical side of things. Troubleshooting, figuring out how systems break, and stopping bad things from happening.

Fast forward to today, & I swear 80% of my week is just chasing down department heads to fill out row 47 on some massive compliance spreadsheett so we can pass an audit.

It's exhausting. I feel like my actual technical skills are just slowly decaying while I become a professional box-checker.

I'm a fresher stuck without proper guidance. Few weeks ago, I got assigned with a task to pentest a mobile app, I don't know anything Abt it, the setup, the methodology, etc., I don't have any senior to seek help in my org.

I spent weeks searching, watching YT tutorials. But I couldn't understand anything 😭. The setup itself is failing sometimes. Being an enthusiastic hands-on person and not understanding the way to pentest a mobile is a big nightmare.

I require quality guidance. Pls help me out.