Steve Puluka
@spuluka.bsky.social
Network & Security Engineer / Cantor & Religious Education Instructor http://puluka.com/home
A updated version of the CISA guidance on creating a Software Bill of Materials monitoring program has been released. www.cisa.gov/resources-to...
2026 Minimum Elements for a Software Bill of Materials (SBOM) | CISA
This guidance incorporates stakeholder feedback from a 2025 public comment period and reflects current SBOM tools and needs while preserving the core principles of the original NTIA document.
cisa.gov
Interesting report from Aryon where they find that threat actors are able to find exposed data from misconfigured cloud security settings even if the misconfiguration is detected and fixed within 24 hours. www.aryon.security/resource/shu...
ShutterGap | Research | Millions of Cloud Resources Exposed
Aryon research reveals cloud resources exposed for minutes - too fast for CSPM and CNAPP, long enough to leak highly sensitive data to attackers.
aryon.security
A new twist on bug bounty programs the Crime Stoppers non-profit is offering a $22k bounty for people to rat on the INC ransomware group. Crime stoppers will pass on the info to police for arrests or disruption of service. www.crimestoppersinternational.org/bounty
Bounty — Crime Stoppers International
crimestoppersinternational.org
Interesting report from ReliaQuest on how threat actors take over hotel WiFi gateways and use DNS poisoning to redirect Microsoft 365 requests to a phishing site. reliaquest.com/blog/threat-...
DNS Poisoning Tactics Expand to Hospitality Wi-Fi | ReliaQuest Threat Spotlight
Traveling employees are being silently redirected to fake Microsoft 365 login pages via poisoned hotel Wi-Fi — with tradecraft echoing Russia's APT28.
reliaquest.com
The US Congress is considering legislation that would require #AI companies have a “kill switch” for models to prevent escape incidents like the OpenAI hack into HuggingFace. www.politico.com/news/2026/07...
House AI ‘kill switch’ bill unveiled as OpenAI hack raises alarms
The co-chair of a key Democratic House panel on AI is joined by a Republican on legislation that would authorize the government to shut down or throttle risky AI models.
politico.com
The EU has notified TikTok that they likely broke child protection requirements for minor accounts. As we move for privacy we need to help keep minors safe from predators. ec.europa.eu/commission/p...
Commission preliminary finds TikTok in breach of Digital Services Act for failing to ensure safe accounts for minors
Today, the European Commission sent TikTok preliminary findings indicating that TikTok accounts of minors do not meet the safety standards required under the Digital Services Act (DSA).
ec.europa.eu
Interesting overview from Imperva on the Zero day on FastJson from Alibaba. This works in the default settings and gains RCE. This issue in not patched but setting changes and help mitigate. www.imperva.com/blog/imperva...
Imperva Customers Protected Against CVE-2026-16723: Critical FastJson 1.x Zero-Day RCE | Imperva
TL;DR: A critical remote code execution vulnerability has been disclosed in FastJson, a widely used JSON processing library for Java. The vulnerability, assigned CVE-2026-16723 with a CVSS score of 9....
imperva.com
The bug apocalypse has come for Oracle as Tenable outlines the 1235 CVE patched in the latest rounds of updates. www.tenable.com/blog/oracle-...
Oracle July 2026 Critical Patch Update 1235 CVEs | Tenable®
Oracle addresses 1235 CVEs in its third quarterly critical patch update (CPU) of 2026, its largest CPU release with 1449 patches including 261 critical updates.
tenable.com
New security feature allows video selfie login for Google account owners. They are hoping this extra layer of proof of humanity will prevent account takeovers and recover accounts more easily. blog.google/innovation-a...
Introducing selfie for sign-in: a new, easy way to access your Google Account
Selfie video gives you more options if you’re ever locked out or don’t have access to your usual phone or computer.
blog.google
Interesting report from Hunt.io where they found an autonomous #AI agent successfully hacked into Thailand’s Ministry of Finance. hunt.io/blog/thailan...
Threat Hunting Platform | C2 & Malicious Infrastructure Hunting
Explore the leading Threat Hunting Platform, discover active C2 servers, perform proactive infrastructure hunting and more.
hunt.io
Good news that Armenian authorities have arrested the suspected leader of the REvil ransomware group. ria.ru/20260716/arm...
Защита задержанного в Армении россиянина обратилась в МИД
Защита задержанного в Армении россиянина Александра Ермакова, тезки разыскиваемого США "хакера", направила обращения в Следственный комитет, Генпрокуратуру и... РИА Новости, 16.07.2026
ria.ru
Guard rails still don’t work. Apparently #AI can be used to hack @hf.co but their incident response team was unable to use AI due to guard rail blocks. huggingface.co/blog/securit...
Security incident disclosure — July 2026
We’re on a journey to advance and democratize artificial intelligence through open source and open science.
huggingface.co
The Romanian land registry database has been taken offline by a failed extortion attack which has stopped the real estate market. Data from the agency is on sale on dark web forums. jurnaluldearges.ro/notarita-ana...
Notărița Ana Stan: "Sunt în CO forțat. Hackerii au spart Cadastrul" - Jurnalul de Arges
Notărița Ana Stan a postat un text care circulă printre notarii români, referitor la blocajul imobiliar generat de spargerea sistemului informatic al ANCPI de
jurnaluldearges.ro
Good news that Europol along with other partners has taken down multiple malware network infrastructure and seized over 41M euro of crypto assets. www.europol.europa.eu/media-press/...
Global cyber strike disrupts SocGholish, Amadey, and StealC malware networks – Coordinated actions take down criminal infrastructure; over EUR 41 million in criminal crypto assets seized | Europol
Europol together with partners from across the globe today announces a landmark blow to cybercriminal networks as part of Operation Endgame, a sweeping international operation targeting the criminal i...
europol.europa.eu
Good news that the US Justice Department has seized the computing infrastructure of the Cambodian Scam compound Huione Group a primarily money laundering operation. www.justice.gov/opa/pr/justi...
Justice Department Seizes Backend Infrastructure Used by the Huione Group for Money Laundering Services
Today, the Justice Department announced the seizure of a cloud computing account used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate. These subsidiaries are alleged to ha...
justice.gov
We still suck at patching, the top entry point for breaches in the @verizonofficial.bsky.social annual DBIR is unpatched software vulnerabilities. www.verizon.com/business/res...
2026 Data Breach Investigations Report (DBIR)
Read the complete 2026 Data Breach Investigations Report (DBIR) for an in-depth, authoritative analysis of the latest cyber threats, data breaches, and actionable cybersecurity risks.
verizon.com
Looks like the bug apocalypse is here as Microsoft hits a new record of 570 flaws and 3 zero days in the last round of updates. www.bleepingcomputer.com/news/microso...
Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
Today is Microsoft's July 2026 Patch Tuesday, and with it comes security updates for a record-breaking 570 flaws, including two zero-day vulnerabilities exploited in attacks and one publicly disclosed...
bleepingcomputer.com
Good news the Canadian CSE coordinated a take down of a Ransomware platform responsible for at least 25 incidents in the country, deleting the data and making the infrastructure inoperable. techcrunch.com/2026/07/06/c...
Canadian spy agency says it hacked drug traffickers, extremists, and a ransomware gang last year | TechCrunch
The hacking operations disclosed in a Canadian spy agency's annual report underscores some pressing national security threats facing the country and its top allies.
techcrunch.com
The open source game engine Godot has banned #AI code contributions. The team is flooded with contributions from people not able to troubleshoot or maintain the code they submit. godotengine.org/article/cont...
Changes to our Contribution Policies – Godot Engine
Godot is growing fast, so here is how we are dealing with the huge increase in contributions.
godotengine.org
Good news from Interpol that so far in 2026 there have been 5.8k arrests in 97 countries for internet scams of all kinds and $293M recovered. www.interpol.int/en/News-and-...
Over 5,800 arrests, USD 293 million intercepted in global fraud bust
Operation involving 97 countries targets social engineering scams
interpol.int
The European Central Bank is giving members till October to update their security response plans to include new #AI based threat avenues. thenextweb.com/news/ecb-ban...
ECB tells banks to plan for AI cyber threats
The ECB has ordered euro-area banks to submit action plans for frontier-AI cyber threats by end-October, as EU watchdogs flag a “severe” systemic risk.
thenextweb.com
The #AI moderation agent for Discord accidentally banned over 8k accounts when it mistakenly thought grid patterns in spreadsheets and chess boards were malicious. www.windowscentral.com/gaming/weve-...
A massive Discord bug led to 8,000 mistaken bans
A bug in Discord's moderation system led to mistaken account bans after harmless images were incorrectly flagged as malicious content.
windowscentral.com
The US will require new cars in 2027 to have a camera monitoring the driver to prevent impaired and drowsy driving but also giving another data privacy and cost concerns for consumers. www.gadgetreview.com/federal-surv...
Federal Surveillance Tech Becomes Mandatory in New Cars by 2027
New car surveillance tech becomes mandatory by 2027, using infrared cameras to monitor driver sobriety and alertness with privacy and cost concerns.
gadgetreview.com
The annual report from the Canadian Security Establishment includes the offensive operations they have engaged since authorized by legislation last year. www.cse-cst.gc.ca/en/accountab...
Communications Security Establishment Canada Annual Report 2025-2026 - Communications Security Establishment Canada
CSE's unclassified, public Annual Report 2025-2026
cse-cst.gc.ca
That time again to review all the new CVE releases from Palo Alto Networks and get patching the affected gear. security.paloaltonetworks.com
Palo Alto Networks Security Advisories
Palo Alto Networks Security Advisories - Latest information and remediations available for vulnerabilities concerning Palo Alto Networks products and services.
security.paloaltonetworks.com
That time again to review all the new CVE releases from Juniper Networks and get patching the affected gear. supportportal.juniper.net/s/global-sea...
CEC Juniper Community
supportportal.juniper.net
Interesting deep drive from Ransom-ISAC on the Kali365 Phishing-as-a-service portal and how ads for this eco system work, ransom-isac.org/blog/kali365...
Kali365 PhaaS Kit: OAuth Device-Code Phishing Enables MFA-Satisfied Token Theft
End-to-end reverse engineering of the Kali365 (K365) Microsoft 365 Phishing-as-a-Service operator client, purchased web panel, and payment infrastructure — revealing OAuth device-code phishing (RFC 86...
ransom-isac.org
New lock screen key codes rate limits for Google Android is trying to thread the needle between users that fat finger or forget changed key codes and stopping bad actors from getting into stolen devices. source.android.com/docs/securit...
Rate-limiting | Android Open Source Project
source.android.com
Interesting new security feature in the Opera browser called Paste Protect will scan the clipboard and show warning of possible ClickFix attacks in progress. blogs.opera.com/security/202...
Here’s how Opera’s Paste Protect guards you natively against clipboard attacks
Opera introduces Paste Protect: a browser-first, native defense against malicious takeover of your clipboard. Here's how it works.
blogs.opera.com
The EU continues to press large US tech companies on their market dominance with a €4 billion fine against Google for they Android market actions. www.dw.com/en/google-mu...
Google must pay record €4.1 billion fine, top EU court rules
The EU's highest court has thrown out an appeal by Google against a record antitrust fine. The tech giant had argued that the bloc was unfairly penalizing innovation.
dw.com