Infosec.Pub

Sebagai pengingat, hanya dua partai yang menolak tegas UU Cilaka ini, yaitu PKS dan partai Demokrat.

Pelaku utama : Mulyono Nipunegoro.

Mark Russo reported the dataset to all the right organizations, but still couldn't get into his accounts for months.

Posted by Chrome Root Program Team

Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers.

These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Validation. By retiring these outdated practices, which rely on weaker verification signals like physical mail, phone calls, or emails, we are closing potential loopholes for attackers and pushing the ecosystem toward automated, cryptographically verifiable security.

To allow affected website operators to transition smoothly, the deprecation will be phased in, with its full security value realized by March 2028.

This effort is a key part of our public roadmap, “Moving Forward, Together,” launched in 2022. Our vision is to improve security by modernizing infrastructure and promoting agility through automation. While "Moving Forward, Together" sets the aspirational direction, the recent updates to the TLS Baseline Requirements turn that vision into policy. This builds on our momentum from earlier this year, including the successful advocacy for the adoption of other security enhancing initiatives as industry-wide standards.

What’s Domain Control Validation?

Domain Control[...]

More than half of internet-exposed instances already compromised Attackers are actively exploiting a zero-day bug in Gogs, a popular self-hosted Git service, and the open source project doesn't yet have a fix.…

The Next Major Cyber Risk Could Come Through a Biological SampleResearchers demonstrated that it is feasible to encode executable payloads into synthetic DNA that, once sequenced and processed, could trigger malware in sequencing software. When a vulnerability in a sequencer becomes a vulnerability in national health or food security, the stakes are existential.

Vape seller Fifty Bar is trying to recover more than $1 million worth of produc

The digital intrusion allegedly caused thousands of pounds of meat to spoil and triggered an ammonia leak in the facility A Ukrainian woman accused of hacking US public drinking water systems and a meat processing facility on behalf of Kremlin-backed cyber groups was extradited to the US earlier this year and will stand trial in early 2026.…

More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys. [...]

From Charles Hoskinson via this RSS feed

From Charles Hoskinson via this RSS feed

The names of two partial owners of firms linked to the Salt Typhoon hacker group also appeared in records for a Cisco training program—years before the group targeted Cisco’s devices in a spy campaign.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Comments

The exact circumstances around the search are not known. But activist Samuel Tunick is charged with deleting data from a Google Pixel before CBP’s Tactical Terrorism Response Team could search it.

Microsoft a publié son Patch Tuesday de décembre 2025, soit le dernier de l'année 2025 ! Au total, 57 failles de sécurité ont été corrigées dans les produits et services Microsoft, dont 3 failles zero-day. Voici un récapitulatif

Ce Patch Tuesday contient beaucoup de vulnérabilités importantes, dont 19 vulnérabilités permettant une exécution de code à distance, mais seulement 4 sont considérées comme critiques :

• Microsoft Office : CVE-2025-62554, CVE-2025-62557
• Microsoft Outlook : CVE-2025-62562
• Windows - GDI+ : CVE-2025-60724

Have we learned nothing from sci-fi films and TV shows? Interview  Imagine botnets in physical form and you've got a pretty good idea of what could go wrong with the influx of AI-infused humanoid robots expected to integrate into society over the next few decades.…

[paywall🔒] Enquête En utilisant des données publicitaires d’accès facile, « Le Monde » a pu déterminer avec certitude ou un haut niveau de probabilité l’identité, le domicile et les habitudes de plusieurs dizaines de salariés ou fonctionnaires d’entités sensibles.

...

La faute incombe à une industrie publicitaire boulimique, opaque et hors de contrôle qui extrait chaque jour des smartphones des milliards de données personnelles, et notamment des déplacements précis à quelques mètres près, avant de les revendre. A moins d’une hygiène numérique à toute épreuve, il est difficile de lui échapper.