NOW: US court permanently bans Pegasus spyware maker from hacking WhatsApp.

NSO Group can't help their customers hack WhatsApp etc. ether. Must delete exploits & R&D.

Bad news for NSO. Huge competitive disadvantage for the notorious company.

Big additional win for WhatsApp 1 /

@reconmtl.bsky.social has uploaded the majority of the 2025 talks, including my talk on LSA. You can check it out at the below link if you'd like.

Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back!
youtu.be/G2CfMWXLU1U?...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities"

Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS).

Full preprint paper: download.vusec.net/papers/rain_...

💰 Google VRP paid $150K for this vulnerability: their highest cloud bounty ever!

The researchers showed how you can combine two primitives and how to make it work in a real cloud setup with a huge amount of noise.

While this applies to old CPUs, it is a major concern for public clouds!

A malicious VM uses a "half-Spectre" gadget in the hypervisor to load sensitive data into L1 cache → L1TF on a sibling core leaks it → TLS keys stolen in ~15 hours (even with cache flushing/core scheduling).

A good read to learn more about L1TF aka Foreshadow vuln: www.redhat.com/en/blog/unde...

📑 Paper: "Rain: Transiently Leaking Data from Public Clouds Using Old Vulnerabilities"

Researchers just proved that Spectre + L1TF, long assumed "mitigated", can leak TLS keys from other VMs in real-world clouds (Google Cloud, AWS).

Full preprint paper: download.vusec.net/papers/rain_...

NEW: turns out the EU helped finance a bunch of spyware companies with..public money.

Extremely bad look.

Group of MEPs calls for action.👇

apache.be/2025/10/01/e...

I have often stated that well-implemented memory tagging will be a game changer for memory corruptions. And it seems that with the next iPhone it's finally here: security.apple.com/blog/memory-...

BREAK: Dutch chips company ASML buys an 11 percent stake in French AI company Mistral - in the biggest tech sovereignty deal in a while.

www.asml.com/en/news/pres...

📸 𝗟𝗲𝘀 𝗽𝗵𝗼𝘁𝗼𝘀 𝗼𝗳𝗳𝗶𝗰𝗶𝗲𝗹𝗹𝗲𝘀 𝗱𝗲 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝘀𝗼𝗻𝘁 𝗱𝗶𝘀𝗽𝗼𝗻𝗶𝗯𝗹𝗲𝘀! • 𝗢𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟱 𝗣𝗵𝗼𝘁𝗼𝘀 𝗔𝗿𝗲 𝗢𝘂𝘁!

Revivez les meilleurs moments de NorthSec avec notre album photo officiel! ⚓️

photos.app.goo.gl/bMCHe366jdP1...

Denmark invests 80M DKK in digital sovereignty.

Minister of Digital Affairs @carolinestage.bsky.social will lead initiatives to reduce dependency of big tech. Money will be spent on developing and testing alternatives.

www.digmin.dk/digitaliseri...

More testing of LLMs for journalism, this time on identifying image location, date, and source.
By @aisvarya17.bsky.social and @klaudia.bsky.social with some of my own commentary.
www.cjr.org/tow_center/w... @columjournreview.bsky.social

The US House of Judiciary Committee has invited former EU Commissioner, Thierry Breton, to testify at a hearing next week that's set to attack the European digital rulebook as a threat to US free speech and innovation
www.euractiv.com/section/tech...

Email addresses are very simple, and you will score highly in this quiz.

e-mail.wtf

🔧 Nous publions notre outil CLI interne pour gérer nos défis CTF as-code. Si vous organisez un CTF, jetez-y un coup d'oeil!

We're open-sourcing our internal CLI tool to manage CTF challenges as-code. If you're a CTF organizer, check it out!

github.com/nsec/ctf-scr...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF).

techcrunch.com/2025/07/30/g...

Let's Encrypt discontinued yesterday the service that supported the criticized Online Certificate Status Protocol (OCSP). From now on, only Certificate Revocation Lists (CRLs) will be used.

letsencrypt.org/2025/08/06/o...

This is great progress towards "more instant messaging interoperability" (MIMI), a future standard for interoperable E2EE messengers that lies on the Message Layer Security standard.

WhatsApp and others have been moving in that direction since the EU's Digital Markets Acts took effect last year.

Using modern cryptograhic technique called "coutinuous group key agreement" , the new standard enables users to send E2E encrypted messages to **groups** (and easily adding/removing people from conversations) while making no compromises on confidentiality.

blog.mozilla.org/en/mozilla/m...

Germ DM brings novel privacy features to users. Created by former large tech engineers, it combines the AT Protocol (for authenticating users via BlueSky) and the Message Layer Security, a new standard designed by the Internet Engineering Task Force (IETF).

techcrunch.com/2025/07/30/g...

📚 A good book to add to your summer reading list: "From Day Zero to Zero Day" by Eugene Lim. Released last month, it dives into vulnerability research! (1/5) 🧵

nostarch.com/zero-day

#vulnerability #research

🏴‍☠️ French police 🇫🇷, Ukrainian authorities 🇺🇦 & Europol 🇪🇺 arrested this week in Kyiv the admin of XSS[.]is, the oldest Russian-speaking cybercrime forums with 50,000+ users.(1/7) 🧵

techcrunch.com/2025/07/23/e...

🤖 New research paper from ETH Zurich and LogicStar AI quantifies what we've observed: flagship LLMs fail catastrophically at secure code generation. The BaxBench benchmarks evaluated 392 backend development tasks across multiple frameworks. baxbench.com (1/8) 🧵

🧵 This is concerning: new research shows AI agents can become insider threats when their objectives are blocked. They’re blackmailing executives, leaking sensitive data, and using sophisticated social engineering tactics against their own organizations! anthropic.com/research/agentic-misalignment