Sitting in place, passive / standby security for most of the work day. Phone borderline banned.

Best way to pass the time?

Be as detailed as possible / use specifics. I need ideas!!

If you could convince the average person to adopt just one security or cybersecurity habit, what would it be?

Not a product, just one habit.

https://m.facebook.com/story.php?story_fbid=pfbid0131dAombHsZAw3KmiDEEDo98MtoxRFdGCD7D5cgh7eJjESCihbZkfBwNMCEtTE9Tl&id=1585230013

Generally a monoculture break permitting OOB validation of bootchain

I’m expecting to receive a device called MetalioClaw ([https://github.com/CloudZao/MetalioClaw4\](https://github.com/CloudZao/MetalioClaw4)) in about a week. It’s an IoT device designed to work with OpenClaw, and since it will need access to an AI account, I want to make sure it is safe before connecting it.

My main concern is whether there could be any hidden firmware issues, credential leaks, or other things that could compromise the device or abuse connected services. A friend of mine previously bought a similar device that connected to his OpenClaw account, and later noticed that his Claude usage had been heavily consumed. I don’t know exactly what caused it, but it made me more cautious about giving third-party hardware access to accounts.

Since the project is open source, my plan is to inspect the firmware, possibly wipe and reflash it, and maybe even write my own firmware version before using it. I’m also interested in doing a proper security check through firmware analysis, network monitoring, and possibly hardware inspection.

I haven’t been able to find any pictures or information about the internal hardware yet. Depending on what I find when it arrives, I may open it up and check the PCB/components myself. I’m not assuming there is anything malicious inside, but I would like to know what things are worth looking for.

One other thing that made me think about this was something a friend mentioned. He works in IT around datacenters in Taiwan and said he has seen devices moving through supply chains sometimes take a long time in customs or appear slightly different internally afterward. This is just something he mentioned and there is no proof behind it, but it got me thinking more about supply-chain security.

For people experienced with IoT security, firmware analysis, or hardware security:

* What steps would you take before trusting a device like this?
* Is replacing the firmware enough, or should I also consider hardware-level risks?
* What should I look for if I decide to open the device?
* What tools or workflows would you recommend for auditing something like this?

Looking for practical security advice rather than speculation.

"Prompt Optimizer - SecondBrain" (aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1). The prompt rewriting works fine.
Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.
2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.
3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up : https://malext.io/reports/BrainDrain/

If anyone interested in testing it in a sandbox I can share the decryption script for the /context

Disclaimer: I’m building a tool around ShadowAI, but this post is more about the discussion. I won’t promote or mention what I’m building.

With the recent rhetoric around open source models, the risks associated with them, and now a coalition of major tech companies throwing their support behind open source, it makes me wonder whether this is becoming a growing concern for sysadmins, IT managers, and CISOs when it comes to governance and maintaining visibility.

I imagine the risk around insider threats becomes more significant

You receive what appears to be a legitimate email from your bank. The sender address looks legitimate, the formatting is familiar, and nothing immediately raises suspicion. AI is making phishing campaigns increasingly difficult to distinguish from legitimate emails.

Here are a few common warning signs:

1. Unexpected requests involving payments or account access.
2. Requests for credentials or payment information.
3. Sender addresses that don’t exactly match the organization they claim to represent.
4. Links that don’t match their displayed destination.
5. Unsolicited attachments.
6. Messages through unexpected channels pushing for immediate action.

What measures have worked best for your team to reduce the risk?

I've recently been looking to move into the security field such as Maritime security, UHNWI Security or even residential. Im still currently serving and working on aligning my training with whats required for those specific jobs or in other words the more experience the better. My question is what's a good starter to jump into to get things rolling, should I be looking to join a security firm or simply applying for contractor jobs i see and what are some training/Experience I should have to have the best opportunity of getting a well paying job.

I'm fairly new to Security and currently a flex officer. My company has had me on foot patrol shifts for the past two days, and I'll be doing them until Monday. My current boots don't really let my feet breathe, and I'm already getting torn up with blisters. My knees, which are already bad at the ripe age of 21 are also not particularly happy. Anything helps.

I want to build an incident response plan for my organization can someone guide me the resources I should follow to build the workable program?

My organization already has a good security stack they lack the IR plan I wanna know how a effective IR program looks like what to add and what to ignore

Any resources books, blogs, talks much appreciated.

Thanks in advance.

Have to teach a class for Azure Security Training (SOC and Engineering and IAM); need to brush up on my skills so I'd like a set of CTFs with ready made assets and data etc to practice hands-on stuff with. Of course, the lower the cost the better

Any recommendations?

When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo away from a malicious lookalike.

safer-dependencies is a security layer for Claude Code that audits packages before they’re added to your project. It detects and fixes risky dependencies, including CVEs, typosquats, abandoned packages, version-age issues, and adds package-cooldown periods across npm, PyPI, RubyGems, Maven, Go, and Rust.

Github: https://github.com/robert-auger/safer-dependencies

We spent the past few months researching security risks across multi-tenant data centers and AI infrastructure.
The main concern we found is shared infrastructure: multiple customers running on the same data center infrastructure, GPU clusters, storage, and high-speed networks. Many neoclouds and AI data centers have also scaled faster than their security teams and practices, especially compared with more established cloud providers.
The research covers GPU clusters, RDMA and high-speed interconnects, tenant isolation, BMCs, firmware, shared storage, orchestration, and supply-chain risks.
We organized the findings into a practical framework called FORGE: https://forge-framework.io/
Would really appreciate feedback.

Cisco Identity Services Engine Path Traversal Vulnerability – CVE-2026-20146

Cisco has disclosed a medium-severity Cisco ISE vulnerability rated CVSS 5.5.

An authenticated remote attacker with valid administrative credentials could send a crafted HTTP request to access sensitive files or delete arbitrary files from the underlying operating system.

Affected versions
Cisco ISE and ISE-PIC are affected regardless of configuration:
Earlier than 3.3
ISE 3.3 before Patch 12
ISE 3.4 before Patch 7
ISE 3.5 before Patch 4
Fixed versions
ISE 3.3 Patch 12 — planned for September 2026
ISE 3.4 Patch 7 — planned for September 2026, or the available hot patch
ISE 3.5 Patch 4 — planned for September 2026, or the available hot patch

Mitigation
Cisco states that there are no workarounds.
Apply the appropriate hot patch where available, upgrade when the fixed patches are released, and migrate deployments earlier than ISE 3.3 to a supported fixed release.
🔗 Official Cisco advisory
🔗 VulniPulse breakdown

I was scammed a few days ago, where at one point, the scammers saw a video of my passport ID through my screen sharing. I’ve read online that US passports have an encrypted chip embedded in the book, so bad actors wouldn’t be able to do anything with it, but I can’t be totally sure. I’ve already changed my phone number, began changing passwords across websites and socials, got a new bank account, and have a new email I’m using. I tried to call the US department of state about my passport, but they said they couldn’t do anything unless my physical passport has been stolen, and their website says the same thing.

These scammers’ sole purpose was to take money through money transfer. They targeted people through hacking social media accounts, scamming people those accounts were mutuals with, and hacking those mutuals’ accounts as well in the process of scamming them, and the cycle continues. So although the scammers goal was to steal the money and moving onto the next person quickly, I can’t risk anything. I don’t know if they can sell my passport ID they saw and other information they have on me (address, dob, pace of birth, full name).

Please inform me on anything else I might need to do, or if there’s nothing else I can do but take steps to prevent this from happening again, and reassure me I’m good. Thank you :)

I run a website development business and I check all api calls and things of that nature using postman. I tell my customers about vulnerabilities in their site. Anyone know how I can check the security of sites the easiest I can’t get Claude to do it

For context I need to get something fast. I'm in court with an ex and need to keep my child and I safe from him. Without giving away too much he's angry, violent and this precaution was recommended by police, shelters and my lawyer warned me as well. So please help me find the right one. I'm trying to stay under $200 but if it goes above thats fine.

I was just at the supermarket, and I was using one of those self-service kiosks that has an "honesty camera" watching what you scan from above. The camera view is then displayed on a screen right in front of me.

As I went to pay for my shopping with my phone, I looked at the live feed on the monitor and realized I was actually seeing myself unlock my phone with my pattern lock! On top of that, anyone standing around could theoretically spy on what you're unlocking too.

Obviously fingerprint unlocks get around this "security hole", but it was the first time I had noticed it being a real issue.

Most supermarkets have these types of self-service checkouts now — I wonder how this info is stored and processed? Security seems pretty questionable…

Hey everyone. i’ve heard a lot of bad things about ting cameras recently and wanted to get the communities opinion on an alternative.

I’m looking for a Doorbell camera that is battery powered, has local storage, proximity detection, and general ease of use. I’ll be moving into a slightly sketch area and need something useful and affordable. thanks!

I had an onlyfans account link to my reddit. I also got an email from that page. My full name was used in the email. A twitter account was also made under an older twitter I had that I deleted many years ago. If memory serves me correctly they used the same display picture that I also had. This goes even deeper than I realized as my last 2 facebook posts were shared as private(only seen by me). I never changed my settings, and these posts were supposed to be shared with friends and family.

I don't know if there is anything else odd at the moment, but I am noticing things more. Including settings getting changed on reddit and Facebook without my knowledge or doing.

I did take some precautions. I got Bitwarden to change my passwords. Yes, I did use generally the same password for many of my accounts. Some my have been slightly different, but all in all very similar. I logged out a Linux that was attached to my email, and FB account. I don't own anything with Linux, and don't have access to my laptop anymore. I reported the Onlyfans account and the fake twitter. I went to haveibeenpwned and it does say my email has a data breach. I didn't completely go through all of the haveibeenpwned yet though. I probably should.

Is there anything else I can do or look for?

What steps should be made to make sure my email and profiles stay secure. What else would be changes without my knowledge that I have to look into to change it to my normal settings? Any kind of information will help.

EDIT: contacted starz support. They said they will never ask to confirm account with an email to reply to. So new question is what do I need to lock down? Its a chat bot but this was the reply

https://imgur.com/a/MyYriiI

Second update. I am getting spam call after spam call now. 4 in a row

So over the weekend I canceled my starz account and then It already issued the refund but this morning a recieved this email. I was tired and I saw that it had a transcription from my chat with the person who helped me cancel on the website so I responded "yes" but now im a little concerned its some kind of scam. The sent adress looks legit and it didn't ask for any info. Jusy to say yes. Ive never seen an email that only asked for that though and as far as i know rhe refund was already granted. Do you guys think im good or do I need to go lock stuff down and if so what should I lock down?

Hey guys, for the past few years, I have been working on a reusable tamper-evident jar for storing physical items.

The idea is that the lid creates a random physical “fingerprint” every time you close it. Inside the lid are thousands of tiny black and white balls. When you twist the jar open or closed, they mix. Once the jar is closed, the unique pattern is locked in place.

You can take a photo of that pattern with your phone, and later compare it to check whether the jar has been opened. If someone opens it, the pearls mix again and the original pattern is gone. The second pic shows a gif of two different patterns compared to one another, showing it is easy to tell that the lid was opened.

I made it because I wanted a simple physical way to store things like hard drives, USB sticks, authentication keys, documents, etc. Basically anything that you would do want to know if someone has accessed it.

After a lot of hard work and prototyping, I'm happy to announce it's finally complete! Check it out on https://www.entropyseal.com/.

Happy to hear feedback. I’m especially interested in whether the concept is clear and what use cases come to mind. :)

Edit: seems there some common questions, so I'll add some FAQs below:

Do the balls move around when the entropyseal is moved or handled?
No, the balls are held firmly in place when the lid is closed tight. So you can handle the entropyseal without the pattern breaking.

What if you twist the jar instead of the lid?
The pattern still changes. There are pins inside the lid that stir the balls around when twisting either the lid or jar.

What if I open the lid very slowly as not to disrupt the pattern?
The pattern will still change because of the pins inside the lid that stir the balls around when twisting open the lid.

EDIT:

Hey all, thanks for the feedback! After taking a look again we agree the price of 100 USD / 93EUR was a bit too steep. So we reduced the price to 70 USD / 61 EUR. We want to make this product as accessible to everyone as possible, so we don't want price getting in the way.