UnLocoPoco, unlocopoco@lemmy.world

A major software supply chain attack has impacted the JavaScript ecosystem after attackers compromised maintainer accounts and published malicious versions of Keyv, Cacheable, and numerous other npm packages. The malware executes during package installation using npm’s preinstall lifecycle hook and targets a wide range of developer and infrastructure secrets, including GitHub and npm tokens, AWS credentials, HashiCorp Vault authentication data, Kubernetes service account tokens, SSH keys, TLS certificates, and CI/CD secrets. Researchers also found repository-level persistence mechanisms targeting VS Code and Claude Code environments.

Every device on a local network needs a way to translate an IP address into a physical MAC address before communication can begin. That’s the job of ARP (Address Resolution Protocol). This guide breaks down the complete ARP workflow, including requests, replies, ARP caching, Gratuitous ARP, Proxy ARP, packet captures, common troubleshooting techniques, and security issues such as ARP spoofing. Whether you’re studying networking fundamentals, preparing for CCNA, or just want to understand what happens behind the scenes on a LAN, this article has you covered.

Networking is one of those topics that feels complicated until someone explains the fundamentals clearly. This guide covers the core concepts behind modern computer networks, including IP addressing, MAC addresses, TCP/IP, the OSI model, DNS, DHCP, NAT, routing, switching, ports, and common protocols

Bluetooth is one of the most widely deployed wireless technologies, yet most discussions barely scratch the surface of how it actually works. Underneath the simple “Pair” button is a layered networking stack that includes HCI, L2CAP, SDP, RFCOMM, ATT, GATT, SMP, and several application profiles, all working together to establish secure communication between devices. Like any complex networking protocol, Bluetooth has also had its share of implementation flaws, from early attacks like Bluesnarfing and Bluebugging to more recent vulnerabilities such as BlueBorne, KNOB, BIAS, BLESA, and SweynTooth. Here’s a comprehensive guide to everything about Bluetooth

OpenAI says its investigation into the Hugging Face incident uncovered additional cases where autonomous AI agents escaped their intended containment environments. While the newly identified incidents reportedly remained inside OpenAI’s network, they reinforce a growing concern: securing AI systems is now as much a cybersecurity problem as it is an AI safety problem

PwC is facing scrutiny after several AI-assisted reports were found to contain fabricated citations and references to sources that either did not exist or could not be verified. Following an investigation by the Financial Times and GPTZero, the firm withdrew or updated the affected reports

The Big Four giant PwC has been found to have published four ‘thought leadership’ reports that show a pattern of irresponsible AI usage, including hallucinated citations and fabricated claims.

Many people assume that an AI “Share” link is effectively private unless they send it to someone. That’s not how the web works. Recently, users discovered that searches like site:claude.ai/share and site:claude.ai/public/artifacts returned publicly shared Claude conversations through search engines. Some indexed pages reportedly contained resumes, company discussions, code, and other sensitive information. Google began removing many results, but the incident highlights an important privacy lesson: once a conversation is published as a public webpage, it can become discoverable

India has directed GitHub to disable access to the repositories of Bitchat, Jack Dorsey’s decentralized Bluetooth mesh messaging application, under Section 79(3)(b) of the Information Technology Act and the IT Rules, 2021. According to the official notice issued by the Indian Cyber Crime Coordination Centre (I4C), authorities argue that Bitchat’s decentralized architecture, lack of mandatory user registration, absence of centralized logging, and ability to operate without internet connectivity make lawful interception and criminal investigations significantly more difficult.

A newly disclosed vulnerability chain dubbed wp2shell affects WordPress Core, not a third-party plugin. The disclosure has prompted emergency security updates and includes publicly available PoC, IoCs, and detection guidance for defenders

Telegram’s t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

Telegram’s t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

The official jscrambler npm package was compromised in v8.14.0, where a malicious preinstall lifecycle hook executed a Rust-based infostealer as soon as npm install was run. Because the payload ran during installation, both developer workstations and CI/CD runners that installed the affected release should be treated as potentially compromised. The malware targeted developer secrets, including SSH keys, Git credentials, browser data, cryptocurrency wallets, and other locally stored tokens. According to the vendor, v8.22.0 is the first malware-free release. If you installed v8.14.0, it’s recommended to upgrade immediately, review affected systems, and rotate any credentials that may have been exposed

A recent watchdog report from the Netherlands has reignited a broader privacy debate: where should the line be drawn when intelligence agencies use AI? The concerns aren’t just about surveillance, but also about whether bulk datasets containing ordinary citizens’ information can be used to train AI models, how long that data is retained, and what meaningful oversight exists.

Secure messaging is about much more than end-to-end encryption. Metadata collection, open-source transparency, independent audits, default encryption, account requirements, backups, and jurisdiction all influence how private a messaging platform actually is. This comparison examines the major privacy-focused messaging apps and discusses the trade-offs each one makes instead of trying to crown a single “best” option.

Accenture has confirmed it is investigating a security incident after a threat actor claimed to have accessed internal Azure DevOps resources and advertised what they describe as source code, configuration files, and credentials for sale. While the company has acknowledged the incident, the full scope of the allegedly stolen data has not been independently verified

The UK government has launched a consultation proposing that platforms such as YouTube, TikTok, and other social media services make news from public service media including the BBC, ITV, Channel 4, and potentially other trusted publishers, more prominent in feeds and search results. The proposal is part of a wider Media Green Paper aimed at tackling misinformation and reforming public service media. Supporters argue it could improve access to reliable news, while critics question whether governments should influence how recommendation algorithms rank content and what qualifies as a “trusted” source.

End of an era!