ipinfo.io
On the night of Oct 11–12, attackers switched refrigeration controllers in hundreds of French supermarkets into defrost mode. Some units hit 50°C and some caught fire. IPinfo's internet scans found that a week earlier, "France had more exposed fridge dashboards than the rest of the world combined": 1,331 open Danfoss dashboards, against 1,197 across 72 other countries. 1,019 of those were already at the same address in March. Patching wasn't the difference ("85% ran software with known security flaws," about the same as elsewhere). The difference was that "anyone who typed in the address could open it." IPinfo itself says reachable isn't the same as breached, and "nobody has said who did it or how they got in."
mili.dev
A self-described tech optimist, two days in: 'We're 48 hours into what is being called Black October.' The documented core is real. CNBC reports that Wiz and Calif found major PHP flaws in August using OpenAI and Google models, and the scramble started when the findings leaked online. Security press says many of the attacks had been running for months, so the surge is partly a wave of disclosures. The essay's claims of 'fast takeoff' and a Chinese plan are unsourced.
freedns.afraid.org
Free dynamic DNS and shared subdomains, run by one person, Joshua Anderson, since 2001. The homepage counts 7.16 million members and 13.8 million DNS records, funded by 5,593 premium accounts at $5 a month. The shared-domain pool that makes it handy for home servers has also made it a long-standing abuse vector.
questdiagnostics.com
Quest says 'some patient data within Quanum LSM was accessed.' LSM is the system clinicians use to order tests and view results, and health and personal information may be involved. Quest says it has 'remediated' the incident but gives no count of affected patients, no breach window and no point of entry. This time it was Quest's own system. The 2019 breach that exposed about 11.9 million Quest patients went through a billing vendor, AMCA.
washingtonpost.com
Op-ed by a director at the James Madison Institute, a free-market Florida think tank, which is what makes it notable: this isn't the ACLU talking. Two Jacksonville cases: Robert Dillon, arrested 300 miles from a McDonald's he'd never visited, and Jalil Richardson, who spent nearly three months in jail on an "85 percent match" and lost his job, home, and custody of two children before time cards showed he was at work in North Carolina. "In both cases described above, the technology worked as intended … The problems began when law enforcement treated that response as evidence, rather than a lead." The buried detail: in Dillon's case a license plate reader search showed no sign of his car near the restaurant. "The evidence that could have cleared him was there but was ignored." The fix Longe wants is Detroit's 2024 Williams settlement and Maryland's law: a match can never be the sole basis for probable cause.
eva.ac
A security researcher on why their published research has never touched an LLM: "if you threw an llm at the linux kernel and told it to find an rce without any other guidance, it probably couldn't." The sharper half is about disclosure-as-marketing. The "tailworm" Tailscale bug was real but narrow (needed existing ACL access and Tailscale SSH on), was never disclosed to Tailscale, and was rolled out as a hash, then teasers, then a vibe-coded site: "it was to advertise the company, not to help make the world better." Contrast: the eMudhra CA private-key exposure was found by a human running Google's paranoid_crypto. "That's what's beautiful about it in my opinion, the biggest thing of them all was missed by all these ais." Mostly opinion, no sources for the motive claims.