Apr 28, 2026

Subject: Risky Bulletin: New Fingerprinting Technique Tracks Tor Users

From: risky-biz@ghost.ioD

Key Points:

– Vulnerability found in Firefox and Tor Browser’s IndexedDB API enables cross-session tracking of users through consistent database ordering, creating a unique fingerprint.

– This impacts normal, private browsing, and Tor sessions.

– Patch released in Firefox 150, Firefox ESR 140.10, and Tor Browser 15.0.10 (CVE-2026-6770).

– FingerprintJS discovered the vulnerability; it exploits IndexedDB returning database contents in the same order every time.

– The bug went unnoticed amidst hype over an AI company’s claims of vulnerabilities.

– Other news includes multiple cyber incidents:

• Indian media group OneIndia hacked by Afghan hacktivist group.

• Two DeFi platform hacks totaling $2.8M lost recently.

• Hasbro delayed its Q1 financials due to cyberattack impact.

• Various ransomware and data breaches affecting companies like Favelle Favco, Canada Life, Carnival cruise operator, and others.

– GitHub outage caused merging issues for thousands of pull requests.

– Microsoft rolling out Windows 11 updates allowing better control over restarts and update delays.

– Turkey passed law banning children under 15 from social media without verification and parental controls.

– US accused China of IP theft related to AI technologies; US router ban extends to hotspots; exemptions granted to some vendors.

– Arrests reported for SMS blaster operators in Canada and an ATM bombing group in Europe.

– New malware and threat intelligence reports cover advanced malware, AI prompt injection attacks, and Crimeware-as-a-Service platforms.

– Risky Business podcast highlights: AI in vulnerability research with Anthropic’s Nicholas Carlini.

Subject: Hacker Newsletter #791

From: kale@hackernewsletter.comD

Key Points:

– Weekly Hacker News digest featuring trending topics and tools from the Hacker News community.

– Topics covered: financial planning tools, Apple leadership changes, no-tech tractors startup, Framework Laptop review, AI design tools, and software engineering principles.

– Discussions include frustrations with AI proliferation, consultancy project acquisition, and marketplace growth challenges.

– New useful tools spotted: browser-based video editor (VidStudio), terminal UI for NHL games, hex editors with color coding, AI gateways, and Ruby AOT native compilers.

– Data and learning content: GPT-5.5 updates, SQL grammar for graphics, LLM educational guides.

– Design highlights: pixel fonts, bonsai style visual art, and retro data visualizations.

– Book recommendations and free educational resources shared.

– Insights into work culture and knowledge management.

– Lighthearted content such as daily historical event sorting games and two-player turn-based games.

Subject: Italy Hands Alleged Chinese Hacker to US, Drawing Beijing’s Protests

From: info@metacurity.comD

Key Points:

– Italy extradited Xu Zewei to the US on charges of hacking and stealing Covid-19 research; China protested strongly against this move.

– US FCC confirmed that its ban on foreign-made routers includes portable Wi-Fi hotspots, requiring exemptions for sales; Netgear and Eero are exempt.

– German authorities suspect Russian state actors behind phishing targeting high-profile figures.

– US Supreme Court to hear case on geofence warrants, debating Fourth Amendment implications.

– Manitoba plans to ban youth under 16 from social media and AI chatbot usage citing mental health concerns.

– ADT confirms a data breach linked to ShinyHunters extortion group; over 10 million records potentially stolen.

– Discovery of a destructive malware (“Lotus Wiper”) targeting Venezuela’s state oil company PDVSA, linked to a highly targeted cyber sabotage.

– Itron utility tech firm disclosed cyberattack and breach of internal systems, now contained.

– Google patched a critical flaw in its Antigravity IDE that allowed sandbox escapes and remote code execution via prompt injection.

– IoT security researcher reported that rented EV chargers and shared e-bikes have low security, exposing them to wide-scale DoS and unauthorized use.

– Japan setting up a financial cybersecurity task force in response to risks related to AI tools.

– South Korea’s FTC forced platform operators (including Coupang, Naver) to revise unfair user agreements to better protect consumers.

– Police in South Korea investigating a data leak of 100,000 country club members linked to malware.

– New Chinese state-backed threat actor “GopherWhisper” discovered using legitimate services for government-targeted espionage.

– CrowdStrike disclosed a critical unauthenticated path traversal vulnerability in LogScale platform allowing file reads.

– Cybersecurity stocks surge due to AI-related publicity; FTC eyes enforcement against sexual deepfakes; US State Dept excludes tech researchers based on controversial policies.

Subject: US Supreme Court Weighs Legality of Geofence Warrants | The CyberWire 4.27.26

From: editor@newsletter.n2k.comD

Key Points:

– The US Supreme Court is hearing arguments on the constitutionality of geofence warrants, which allow police to request location data for all phones near a crime scene.

– Supporters argue users have reduced privacy expectations via location services opt-in.

– Critics say geofence warrants amount to a digital dragnet violating the Fourth Amendment’s protection against unreasonable searches.

– Case involves a 2019 Virginia bank robbery where location data helped identify the suspect.

– Additional news summarized:

• Newly discovered sabotage malware “fast16” targets high-precision engineering software and predates Stuxnet.

• Toronto police arrested three men operating an SMS blaster, disrupting mobile networks and emergency service access.

Subject: Final Days for Max Savings: ICS Cybersecurity Conference Rates Increase April 30

From: events@securityweek.comD

Key Points:

– Last call to register for the ICS Cybersecurity Conference in Nashville on October 6-8, 2026 at the discounted rate ($1795 commercial/$1595 government).

– The conference celebrates 25 years, focused on Industrial Control System (ICS) and OT security.

– Three days of sessions, networking, and Practical insights with keynote speakers and Critical Impact Awards recognizing contributions to ICS security.

– Agenda includes welcome reception, full conference sessions, awards ceremony, and offsite party.

– Full conference passes include meals, receptions, and social events.

– Sponsored opportunities available; event organizers encourage early registration to save.

Subject: Zero-Click Windows Flaw Opens Door to Attacks

From: news@securityweek.comD

Key Points:

– SecurityWeek reports on an incomplete Windows patch exposing users to zero-click attacks allowing compromise without user interaction.

– OpenSSH vulnerability allowing root shell access has existed for 15 years, recently disclosed.

– Google reports increased AI prompt injection attacks, though still generally unsophisticated.

– Utilities company Itron confirmed a breach involving internal systems.

– Cybercriminal group UNC6692 deploying ‘Snow’ malware via email bombing and social engineering.

– Recently discovered ‘Pack2TheRoot’ Linux vulnerability grants full root access easily.

– US intensifies crackdown on Southeast Asia cyber scams, imposing sanctions on Cambodian actors.

– Firefox vulnerability enabling fingerprinting of Tor users disclosed.

– China-linked APT “GopherWhisper” abuses legitimate corporate and cloud services for stealthy government attacks.

– Expert articles discuss cybersecurity in the era of autonomous agents, the vital role of private sector partnerships, and the value of visibility in security.

– Recap includes recent virtual events, webcasts, and upcoming conference announcements around AI risk and cybersecurity.

Stay Well!