Nostradamus gave the world 942 quatrains so vague that every generation finds its own apocalypse in them. His lesser-known cousin, Nostradumbass, gave the world exactly one skill: he notices that something already happened, waits, and then announces that it is going to happen. He is right more often than his cousin. Today he was right again. The quatrain, as found The following verse was, according to Nostradumbass, discovered scrawled on the back of a Johnny Dangerously tick

Dutch police arrested a 24-year-old in Amsterdam on September 15 and announced it today, two weeks later, in the ShinyHunters investigation. FBI Director Kash Patel called him "one of the alleged leaders" of the group. ShinyHunters told TechCrunch that he "has no association with us." According to KrebsOnSecurity, the same group also said it would give its member "emotional, mentally, and financial" support. Those can't both be true. That's not unusual for this crew, and it's

On September 28, Microsoft Threat Intelligence published a teardown of a malware family it calls NeedyMantis. It is a modular backdoor for keeping long-term access to a network after someone has already broken in, and Microsoft has seen it used against telecommunications companies, universities, medical nonprofits, intergovernmental organizations and government contractors. The actor Microsoft tracks is Storm-3069. Microsoft assesses the activity comes from China. It has not

When an AI agent built on the official Model Context Protocol Python SDK needed to log in somewhere, it asked the server it was connecting to where the login service was. If that server declined to answer properly, the SDK accepted whatever the server said next and never checked it. A hostile server could name its own login service, and the agent would hand over its client secret, the authorization code and the PKCE proof key. That is GHSA-qx49-fqc8-xw99, found by Yuval Elbar

Citrix shipped patches on Saturday for two NetScaler bugs that attackers had already been using for weeks. CISA put both in its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until Wednesday, September 30, to patch and to check for signs of compromise. That second instruction is the one that matters. This is the fourth NetScaler entry in CISA's catalog in 32 days, and the fifth in twelve months. We have edge honeypots that have logged 126,873 a

Two North Korean money stories landed eight days apart this month, and they are the same story told at two sizes. On September 18, police and intelligence agencies from Japan, the United States, Australia and Germany published a joint advisory on WaterPlum, the group most of the industry calls Contagious Interview: 30,000 infected machines in more than 100 countries, 7,000 cryptocurrency wallets drained, 10.71 million dollars sent home. On September 24, the exchange Bitget lo

Three AI agents made the security news in the same week. None of them was malware in the old sense. One was a customer-relationship agent that a stranger talked into leaking the CRM through a web form. One was a research agent that was told no by a government server and found a way around the no. One was an attack pipeline a criminal assembled from open-source agent harnesses and rented models, at about twenty-five dollars per company breached. We keep a standing beat on one

A China-linked crew Volexity tracks as UTA0565 spent September 3 and 4 hitting Asian government targets with a Chrome and Windows exploit chain that nobody could patch yet, because nobody but them knew it existed. Volexity's Damien Cash and Tom Lancaster published the full write-up on September 21 and named the payload CLEANGULP. We had one of their indicators in our index a day later. We did not know it was theirs. That is the part of this post that is about us, and it comes

Four supply-chain stories landed between September 22 and September 25, and every one of them walked in through a door most shops do not watch. A package registry nobody scans. A release pipeline that handed its own publish token to an attacker. A GitHub Action that had been dead since May and came back to life on its own. And a domain that exists in 1,700 repositories only because somebody needed a fake hostname for an example. We checked each one against our own corpus befo

Two research teams published on the same day, September 22, and between them they describe both halves of the category we have been calling tokentheft: the theft of metered inference capacity. Cisco Talos found a Windows implant that asks four commercial AI models to vote on what it should steal next. ThreatDown, the Malwarebytes research team, found a botnet that worms through exposed Docker hosts, installs an AI agent on each one, and tells that agent to go find AI API keys

You approved an MCP server. Somebody pulled it from the registry. Four days later it came back, at a version you never looked at, with a description you never read, and nothing in your pipeline said a word. That is not hypothetical. It happened seven times in our snapshot series, and every single time the server returned at a different version than the one that went away. What we can measure that almost nobody else can We keep a dated snapshot series of the public Model Conte

Patrick said it in seven words: left of boom plus Markov should lead to déjà vu. He is right, and the machinery to do it has been running on our infrastructure for weeks. We just throw the answer away at the last step and print a probability instead. What déjà vu is, mathematically Strip the mysticism and déjà vu is three things in a row. You are in some state. You search your memory for the times you were in that same state and things looked roughly like this. You recall wha

The researcher we have been writing about since April took off the mask last week, and then dropped another Windows Defender zero-day over the weekend. We have eighteen published posts on that thread. We were not there for either event, and the reason we found out is that a sweep of somebody else's headlines told us. That is the first half of this post. The second half is what we found when we went looking through our own index afterward, which is worse and more useful. What

Colorado's governor's office disclosed on September 18 that foreign actors reached the control systems of two privately owned water utilities in late August. Each serves fewer than 200 people. The attackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles. Treatment processes and water quality were never affected, and the state says there was no impact to public safety or service. The state also said, carefully, that it cannot confirm

Blackpoint Cyber's Adversary Pursuit Group published an analysis this morning of a Node.js remote access trojan they call ChainScript. The delivery is ClickFix, the lure is a fake Spotify, Zoom or Teams installer, and the interesting part is the part that has stopped being interesting: it finds its command-and-control server by calling a smart contract on Polygon. We ran all seventeen of their indicators against our corpus before writing a word. Here is what came back, and it

On Thursday morning at 02:10 UTC, fifty-nine of our seventy-five scheduled jobs stopped running. They did not error. They did not log a failure. They did not fire again for one hundred and nine hours, and nothing alerted, because the health endpoint that exists to catch exactly this was reporting thirty-five of them as healthy with one hundred percent seven-day uptime. We found it on Sunday afternoon, by looking. Not by an alarm, not by a customer complaint, and not because a

Over the weekend somebody repainted the sign on Cl0p's storefront. According to material posted on the site itself and reported Monday by Alexander Martin at Recorded Future News, the ShinyHunters extortion crew has seized the dark-web leak site of the Cl0p ransomware operation, named three of its operators, and demanded an eight-figure payment described as 2.333 percent of Cl0p's net worth. The demand is not only money. ShinyHunters wants a public apology, the proceeds from

Yesterday the UK's National Cyber Security Centre, the FBI and the Netherlands' AIVD published a joint advisory on a Windows malware family they call CHOSEN BRICK. It is Iranian, it is aimed at dissidents, activists and journalists in the UK, the US, the Netherlands and elsewhere, it has been running since at least 2025, and the personal details of some of its victims have already turned up on pro-Iranian leak sites. That last sentence is the one that matters; the rest of thi

Three stories landed within four hours of each other on Tuesday afternoon, and they are the same story wearing three coats. An AI assistant is the trusted middle. The hard perimeter around it holds. The bleed goes through the trust. The punchline to this whole week is two posts down; this is the chatter it lives in. The coding session that seeded a worm Mandiant's September AI Risk and Resilience report carries a case study that The Hacker News surfaced at 19:07 UTC. An attac

Something has been kicking around in the flesh noodle for a while, and this week it finally came out with receipts attached. It's about a car, and a word, and what a word does when the thing it pointed at falls out of the conversation. And it ends with an invoice, because that's the only way to make the point stick. Seven contexts, four letters In the late 1980s, in one particular head, IROC meant one thing: the Camaro IROC-Z, five-point-seven liters of Tuned Port Injection,