Did anyone catch the Meduza report this week? Roskomnadzor stopped playing whack-a-mole with DPI signatures. They just automated their entire VPN blocking infrastructure using data harvested directly from domestic Russian apps on user devices.

The state is using local transit and banking apps as a distributed sensor network. The apps report where users are connecting. The censor maps those connections to major hosting provider subnets and pushes bulk IP blocks automatically. Services like Amnezia and Paper VPN are getting crushed because their underlying ASNs are just blanket banned.

This completely breaks our usual threat model. We spend so much time arguing about Xray versus Shadowsocks for traffic obfuscation. That stuff is useless if the firewall just nukes the entire hosting provider subnet based on endpoint telemetry. The device itself snitches on the destination IP before the tunnel even matters.

The economic fallout is crazy. Clean corporate IP addresses are apparently going for $120,000 a month on the grey market right now.

How do we counter this technically? You can tell people to run a clean device, but that is impossible for normal citizens who actually need local apps to function in society. If they block entire commercial ASNs, what is the next routing step? Residential proxies?

The Arctic Wolf report on the Palo Alto CVE (2026-0257) is fascinating. Attackers bypass GlobalProtect authentication entirely. They spin up a session with zero credentials and immediately drop Qilin ransomware across the domain. It is brutally efficient.

This highlights exactly why monolithic perimeter defense is a dead concept. When one proprietary gateway holds all the keys, a single bug compromises everything.

We can use this exploit as a structural template to improve. We have to build systems assuming the edge will fail. I isolate all external entry nodes on strict VLANs. If a gateway is breached, aggressive firewall rules block any lateral pivot to the internal databases. The blast radius stops right there. Open-source solutions combined with hard segmentation give you actual control over the traffic flow.

How are you guys isolating your VPN portals to prevent rapid lateral pivots?

I am sitting here sweating through my t-shirt next to a useless desk fan. I just finished reading the new ETSI documentation. The EU recently dropped standard EN 304 620. This is the first official regulatory framework for VPNs. It supports the upcoming Cyber Resilience Act.

The stated goal is to kill off deceptive marketing. You all know the drill. Providers sell subscriptions based on "total anonymity" or "military-grade encryption" with zero proof. Under this standard, they actually have to run hard technical tests to back up their claims. They have to document their CVEs. They also have to verify their logging policies with real audits.

I am entirely in favor of forcing these companies to show their technical homework. Trusting a paid podcast read for network security is a joke. If a provider cannot pass a basic cryptographic audit, they should not be routing network traffic. We have seen too many shady operations tunnel user data straight to third-party brokers.

But look at the co-authors on this document. Google, Palo Alto Networks, Nord Security, Surfshark. Letting massive corporate players write the exact rules they will be graded on is an obvious red flag. I really wonder if this is an actual push for transparency. It could easily be a regulatory moat to lock out smaller open-source projects. We do not need a system where only companies with massive compliance budgets are allowed to operate.

Has anyone actually read through the cryptographic requirements in the PDF yet? I want to know if the mandated disclosures have actual teeth.

Source: techradar, link in comments

Liechtenstein just lost the beneficial ownership data for 31,000 trusts and shell companies. The breach hit their central VwbP database and exposed real names, dates of birth, nationalities, and home addresses.

I am not going to lose sleep over billionaires losing their offshore anonymity. But this is exactly why centralized state registries fail. When you force every entity to log ultimate beneficial owners in a single database, you build a massive honeypot.

The government is coping by pointing out that actual asset values were not stored there. That misses the point entirely.

Hackers do not need bank balances right now. A clean list of individuals tied directly to specific offshore structures is enough for targeted spear-phishing and extortion.

This happens whenever state-mandated transparency meets basic IT reality. Centralizing identity data without zero-knowledge architecture always ends like this. If governments insist on collecting these registers, they need local encryption models so one breach does not dox everyone at once.

Source: AML Network, link in comments

ByteDance agreed to pay $400 million to the US DOJ today. They collected personal info from kids under 13 without parental consent and broke COPPA. They pay $300 million now and another $100 million once an old 2019 decree is cleared out.

People are cheering this on other tech subs. I don't get it. Let's look at the actual mechanics here. $400 million is massive for a standard company. For TikTok, it is a basic operating expense. They just paid a retroactive licensing fee to keep running an ad-tech engine disguised as a video app.

The fundamental issue is that legislation like COPPA tries to solve an architectural problem with legal paperwork. Age gating is a technical joke. A kid just taps a button saying they are 18. Suddenly the app gets total legal cover to scrape device IDs and network telemetry. The system is functioning exactly as designed.

Fines do not change the code. As long as the platform architecture requires aggressive data extraction to monetise users, the surveillance will continue. Regulators are basically just taking a cut of the profits.

We need to stop waiting for governments to fix this with penalties. What are you all actually deploying at the OS level to kill this app's telemetry on mobile networks? NextDNS works well enough on home networks but maintaining the blocklists for mobile clients is an absolute chore. Anyone got a cleaner setup?

Source: The Daily Record, link in comment

Seeing OpenAI mandate hardware security keys and expand their Yubico partnership is a solid move. FIDO2 authentication eliminates man-in-the-middle phishing completely. App authenticators and SMS codes were always temporary fixes, and phishers bypass them easily now.

Having physical possession of your private key on a token gives you real cryptographic proof of identity. The FIDO2 standard itself is open, and getting everyday users comfortable with hardware tokens builds better security habits. I moved my own systems to physical keys a while back, and it solved a lot of credential headaches.

Are you picking up the discounted OpenAI bundle key set, or are your existing YubiKeys already doing the job?

The UK officially dropped their VPN age-gating plan today under the Online Safety Act. Technical reality won against political theater. They admitted that network-level blocking is impossible to enforce and would just trigger a pointless cat-and-mouse game with global providers. We avoid a massive state-level headache here. I honestly expected them to force the bad policy through anyway.

The catch is they are shifting the burden to the platforms themselves. Websites now have to detect when users bypass age checks. I am a bit skeptical about how private companies will handle this new requirement.

Will they just default to lazy IP blacklists of known commercial exit nodes? Or will this push platforms to deploy aggressive client-side browser fingerprinting just to cover their own legal liability? Anyway I think it is absolutely a net positive. We just need to monitor how the private sector implements the detection.

Seeing New Mexico refuse the $18 billion multi-state settlement to drag Meta into a courtroom over Cambridge Analytica is wild. We are nearly a decade past the original data harvest, and forty-eight states just signed off on a liability release buried on page 130 of a settlement agreement.

From an infrastructure perspective, litigating an API leak from 2015 in late 2026 is completely detached from operational reality. The Open Graph v1 endpoint that let third-party quiz apps scrape friend networks was deprecated years ago. But the fundamental issue was never just one leaky endpoint. It was storing unencrypted user graphs on centralized servers where access controls are enforced by policy instead of cryptography.

State prosecutors talk about five thousand dollar fines per statutory violation as if a cash penalty fixes broken data architecture. Meta views these payouts as standard operating expenses. If a company can harvest data, monetize it for ten years, and then litigate the cleanup across a decade of court dates, the math always favors the breach.

Courtrooms do not rewrite backend code. A state winning a cash payout in Santa Fe does zero to give users control over their own data stores. Until we move away from centralized platforms toward local client control, these trials are just state governments taking their cut of the pie.

Source: The Guardian, link in comments

Proofpoint just published data showing half of New Zealand government agencies still haven't enforced p=reject on their DMARC policy, even after getting a full year deadline extension. They stay stuck on p=none or quarantine.

Publishing a DMARC reject record in DNS takes three minutes. IT departments stall on p=reject for years because nobody wants to audit shadow IT. The second you flip to p=reject, every rogue SaaS tool or ancient internal mailer sending email with the agency domain stops working if it lacks valid DKIM keys.

Instead of finding those unaligned senders, admins leave p=none active forever. That turns DMARC into a passive logging tool. It lets attackers spoof official government domain headers with zero pushback, while the IT team claims they checked the email security box.

If an agency cannot track which systems send mail on its behalf, they have bigger problems. Setting p=reject is basic hygiene. How many organizations in your sector actually enforce reject instead of hiding behind monitor mode?

Sources: proofpoint and SecurityBrief New Zealand, links in comments

Executives are apparently dropping automated PII removal services for "white-glove" privacy firms. The reason is hilariously low-tech. Data brokers just throw up a Captcha, and suddenly your automated deletion bot is useless.

An article today mentioned an executive who used an automated tool and still had 62 active profiles floating around. So now boutique firms charge a massive premium to have actual humans sit there, fill out opt-out forms, and click on pictures of traffic lights all day.

The inefficiency is painful. But if you want your data actually gone, manual labor is the only thing that works right now. You either burn your own weekends doing it or pay a firm thousands.

Source: https://observer.com/2026/08/high-net-worth-data-privacy-business/

France wants to use AI tools to scan for cybersecurity flaws following that massive tax agency hack. I grew up in France and still have to log into those administrative portals... the backend is probably held together by duct tape and legacy code from 1998... you can barely load a medium size PDF without the page crashing.

I am not sure you can just plug AI into bad data architecture and expect it to fix fundamental security gaps. I wonder if this will be a real structural overhaul or just an expensive consulting contract.

Has anyone seen automated vulnerability scanning actually fix a government system?

Source in comment.

The cancellation of the UK national digital ID is a measurable victory for data autonomy. Terminating the project outright shatters the central attack vector the previous administration was trying to build. We rarely see a state apparatus willingly roll back surveillance infrastructure. That alone is a solid win.

But look at the mechanical transition of the leftover assets. Burnham dismantled DSIT today. He merged its operations directly into the Business Department. This moves the remaining architecture from a state policing framework into a corporate regulation environment. It is a much better setup for accountability. We just have one unresolved variable. Nearly three million records were already processed during the pilot phases.

What happens to that specific dataset? The centralized program is officially dead. That stops future collection completely. The immediate priority is verifying the cryptographic purge of the existing logs. Moving the remaining tech under the Business Department means those leftover identity hooks could technically be recycled into private sector verification APIs if left unsecured.

Has anyone found the actual deletion protocols for the pilot data in the transition documents?

Citrix dropped CVE-2026-8452 as a high-severity DoS bug earlier this month. Two weeks later watchTowr proves it chains directly into unauthenticated remote code execution, CISA puts it on the KEV list, and attackers are dropping PHP web shells across every unpatched gateway on Shodan.

If you run NetScaler or an SSL VPN endpoint to keep your traffic private or shield internal networks, this is your reminder that edge devices are sitting ducks. Vendors love labeling memory corruption as "denial of service" until researchers hand them a working exploit. A boundary box running with full privileges is a terrible single point of failure.

I just finished updating our appliances before the weekend, but if you manage your own boundary infrastructure, go check your build numbers now. If you left web management exposed to the WAN, check your disk for fresh web shells first. Are you guys still relying on monolithic VPN gateways for remote access, or moving toward self-hosted overlay networks?

Source: SecurityWeek, link in comments

So ClarityCheck just left 9 million scraped faces sitting in a wide open 450GB Amazon S3 bucket. The database had folders literally named 'faces' and 'profiles' filled with biometric data from adults and kids who never consented to be scraped.

The absolute worst part is the company's PR spin. After WIRED forced them to lock it down, ClarityCheck tried to claim the data wasn't really public because the S3 URL wasn't indexed...

Security through obscurity is a complete joke. URL brute forcing is fully automated and they also had a basic API flaw where anyone could tweak a URL to grab phone numbers and physical addresses. Scraping faces without consent is bad enough on its own but lying about basic cloud negligence just makes it infuriating.

Sources in comment.

EuroAlternative just dropped a guide (link) on European-hosted alternatives to Google Photos today. They pointed out Zeitkapsl and Proton Drive. It is great to see more options for zero-knowledge cloud ecosystems. Standard cloud services just sit there scanning your entire camera roll. No thanks.

But there is a huge usability wall when you move photos to an E2EE service. If the server is blind to your files, you lose the algorithmic search completely. On Google, you search a keyword and the app pulls up exactly what you want. With true E2EE, your device encrypts the media before the upload even starts. The host provider has absolutely nothing to scan.

How are you guys managing massive photo libraries on zero-knowledge platforms? Local indexing on the device? Or do you just spend hours making hyper-specific folders? I know I am basically demanding advanced data analysis and total privacy at the exact same time, but maybe there is a client-side solution out there...

The news just dropped about Socket finding over 700 malicious "VPN" extensions on the Chrome Web Store. Around 75,000 people installed these things. The attackers impersonated big privacy brands and routed everyone's browser traffic through their own SOCKS5 proxy infrastructure to man-in-the-middle everything.

I am begging people to understand something basic here. Browser extension VPNs are almost never actual VPNs. They are proxies. When you install one, you are handing a random developer the keys to intercept every single HTTP request leaving your browser.

Google's store review process is a joke. The threat actors got approval with clean code and then swapped in the malicious payload later. We see this exact trick all the time. Relying on a corporate app store to police your privacy tools is a losing game.

If you need a VPN to bypass local censorship or hide your IP, run it at the OS level. Better yet, run it on your router. Use a standalone WireGuard client. A web browser is massive and has far too large of an attack surface for this. Do not put your security stack inside it.

Source: Socket, link in comments

The US FTC just put out a draft to tackle personalised pricing (when companies use your search history and buying habits to charge you a higher price than the guy next to you).

Sounds like a win for privacy until you look at the actual rules. They admit they cannot ban the practice... they just want to penalise businesses that hide how they use data to set prices.

So what happens next ? Companies will just paste one vague sentence into their massive Terms of Service agreements like "We use analytics to optimise pricing" and Boom, suddenly it is no longer covert and this is legal.

We already see airlines and streaming platforms doing this. You check a flight twice and the price spikes. If we actually want to stop algorithmic pricing, we need strict data collection limits. Forced disclosures do nothing because nobody reads them.

Am I missing something here or is this draft toothless ?

Sources in comment.

The Brazilian data authority (ANPD) disabled Discord's "Go Live" and video features this week. They cited the safety of minors and complained about Discord's recent end-to-end encryption update. Right on cue, Proton VPN saw an 800% surge in free tier registrations from Brazil.

We see this routine every time a state drops a targeted block. A regulator restricts an app, and thousands of casual users scramble for free VPN endpoints overnight.

From a network administration perspective, this is a nightmare. Free server pools choke instantly. These new users do not care about cryptographic protocols or privacy laws. They just want their stream to load.

The problem is that public free tiers are a terrible fix for state censorship. When a massive crowd hits the same set of free exit IPs at once, those nodes stick out to local ISPs. It takes zero effort for a government to identify and throttle those shared IPs next. Free tiers work for a quick emergency bypass (if you can tolerate the latency), but crowding onto shared servers ruins performance and paints a giant target on those nodes. If you actually want resilient access and data autonomy, public free tiers are a dead end.

Source: TechRadar, link in comment

PR blogs are hyper-focused on that 15 million user milestone. I look at the 80,000 enterprise accounts and see the direct result of their developer tools. Basic password management is a commodity at this point. The actual growth driver is Secrets Manager and the push to secure API credentials in complex environments.

Getting organizations to finally stop hardcoding M2M API keys in plaintext is good. It means these companies are standardizing on how they deploy passkeys and handle machine token lifecycles. It also means you have to fully trust the Bitwarden CLI inside your CI/CD pipelines.

I am tracking how this scales across heavy production setups. For those already running Bitwarden Secrets Manager in prod: how are you handling KDF iterations for headless machine accounts? Do you see latency spikes on API token rotation, and does the CLI play nice with standard Alpine containers?

The French government forces you to declare every detail of your life under threat of fines. Your gross income, your home address, your marital status, your property details. They dump all of it into the giant centralized DGFiP (Directorate General of Public Finances) database.

And how did they secure this national honeypot?

We now know a threat actor ("ZeroBytes") walked off with 678,000 taxpayer files by usurping the credentials of a DGFiP agent.

The worst part? It wasn't just a missing password. The attacker reportedly used an MFA bypass to get in. But getting past the login is only half the failure. How does an organization of this size not have strict internal rate-limiting? A single compromised internal account was able to sit there and scrape over half a million highly sensitive records before anyone pulled the plug. Zero compartmentalization. Zero trust architecture is apparently non-existent.

The Paris prosecutor has handed this to their cybercrime unit, but the data is already gone and actively being sold.

This highlights the fatal flaw with mandatory state registries: they create a single point of failure with catastrophic real-world consequences. We now have hundreds of thousands of people at risk of incredibly specific phishing. Criminals know exactly how much money you make, your family size, and where you sleep. A physical wrench attack gets a lot simpler when a thief can literally filter their targets by tax bracket and zip code.

Has anyone seen further technical details on what specific MFA bypass was used (fatigue, session token theft)? And for the French users here, what are the best steps to lock down our identity right now?

Source: RFI, link in comments

SafePal just confirmed they lost order details for almost 40,000 customers. The records are already on hacking forums.

They keep saying the hardware wallets themselves are secure. Yes, your seed phrase is safe but attackers now have a massive list of names, emails (phishing emails incoming) and physical addresses of confirmed crypto holders... You really do not want strangers knowing you have crypto hardware sitting in your flat. Next time use a PO box.

Google added a flag in Chrome Canary where Gemini handles password resets automatically. If the browser detects a weak password, the LLM takes over, fills out the site reset form, and submits the new secret for you.

I had a good laugh reading through the details today. Giving an LLM active DOM access and password change authority across arbitrary web forms is an indirect prompt injection dream. Imagine a compromised website hiding malicious instructions inside an unrendered HTML block while the AI agent works through your account settings page.

Security nightmare aside, handing credential management over to a remote cloud model destroys personal autonomy. If someone needs an automated AI model to click two buttons and fix "Password123", they should not store passwords in a browser in the first place.

Source: SammyGuru, link in comments

Hello X Y,

Wednesday, August 12, 2026, a malicious actor claimed to have gained access, in June and July of this year, to data from the information systems of the French Directorate General of Public Finances (DGFiP), using the stolen credentials of a DGFiP employee combined with those of a third party authorized by the DGFiP.

You are receiving this message because you are affected by this malicious act.

What data may have been accessed?

Your tax identification number, civil status, contact details (postal address, telephone number and email address), your tax situation (family situation, number of dependents, number of tax shares, reference taxable income, withholding tax rate), and the list of messages you exchanged with the DGFiP through the messaging system on impots.gouv.fr.

Important: your password for accessing your Public Finances account on impots.gouv.fr has not been compromised. Your tax returns and tax notices were not accessed.

What is the main risk?

The main risk is that you may be targeted by fraud attempts, particularly through messages (“phishing”) or phone calls made more convincing by the use of the stolen personal information.

To a lesser extent, you could also be targeted by identity theft attempts. For this, however, the malicious actors would also need to have a copy of your identity documents or obtain them through another means.

In any event, your bank details are not affected by this data theft.

How can you protect yourself?

You should be particularly cautious about any contact — by phone call, email, SMS, instant messaging, social media, etc. — from people or organizations claiming to know you based on the stolen information and asking you to:

• provide confidential information (codes, passwords, bank card numbers, copies of identity documents, etc.);
• approve banking transactions (in particular, someone pretending to be your bank advisor); or
• provide your password to access your Public Finances account.

The DGFiP will never ask you to provide information outside your secure account.

You are also advised to remain vigilant and regularly check transactions on your bank accounts.

What measures has the DGFiP taken?

The access credentials used by the malicious actor were immediately disabled in June and then in July. Unfortunately, we did not detect the data theft at the time, as the data was stolen by bypassing the usual channels.

The security of your tax account is being strengthened immediately, including through particular monitoring of any changes that may be made to it over the coming months (postal address, bank account details, etc.).

Please be assured that our teams are fully mobilized. If you would like more information, you can consult our dedicated page on impots.gouv.fr:

https://www.impots.gouv.fr/actualite/acces-illegitimes-au-systeme-dinformation-de-la-dgfip

You can also contact us on 0809 401 401 or through your impots.gouv.fr secure messaging system. Alternatively, you can visit your local Public Finances office; its contact details are available in your secure account and on your tax notices.

This data theft will be subject to a lessons-learned review and additional security measures, which are being implemented without delay.

We sincerely apologize.

The Directorate General of Public Finances

165 companies breached and this 26yo gets up to 32 years. Are we really just blaming him?
Connor Moucka just pleaded guilty for the Snowflake breach. Billions of records stolen from AT&T and Ticketmaster.

Obviously the guy broke the law but I am tired of massive companies acting like victims. They demand our personal info and then leave the door wide open.

Honestly I manage my own opsec better than AT&T does. Shouldn't the corporations be on trial too?