THE JDNEER

Chainguard Broke the PHP Embargo by Six Hours. That Was the Wrong Call

Chainguard Broke the PHP Embargo by Six Hours. That Was the Wrong Call

Chainguard shipped fixed PHP images more than six hours before the coordinated October 21 release, citing exploits in the wild. Here is how embargoes work, what Chainguard says, and why I still think releasing early was the wrong call for open source.

Denmark's CPR Breach Is a Warning About Government Data Hoarding, and PhilSys Should Take Note

Denmark's CPR Breach Is a Warning About Government Data Hoarding, and PhilSys Should Take Note

Outsiders pulled names, addresses and ID numbers of about 8.8 million people from Denmark's CPR register through one small company's lookup account, caught only by an invoice. Here is why central registers worry me, and what PhilSys can learn.

Your Car's App May Be the Bigger Privacy Leak: Study Maps Where 21 Cars and 30 Apps Send Data

Your Car's App May Be the Bigger Privacy Leak: Study Maps Where 21 Cars and 30 Apps Send Data

Northeastern researchers tracked network traffic from 21 cars and 30 automaker apps. Most cars reached third parties, but the apps did more damage: seven sent VINs and other personal data to ad and analytics firms, and Honda changed its app in response.

Scammers Are Posing as BSP Officials, Complete With Fake IDs. Here Is How to Spot Them

Scammers Are Posing as BSP Officials, Complete With Fake IDs. Here Is How to Spot Them

The Bangko Sentral ng Pilipinas warns that fraudsters are posing as its officials with fake IDs and forged signatures, asking victims to send money to release or recover funds. BSP staff never ask for payments. Here is how the scam works and what to do.

Globe Says Its AI Projects Returned P1.2 Billion, 2.8 Times What It Spent

Globe Says Its AI Projects Returned P1.2 Billion, 2.8 Times What It Spent

Globe Telecom says its AI and machine learning work delivered P1.2 billion in measurable value as of August, about 2.8 times its AI investment, mostly from better-targeted offers. Here is how the number breaks down and what it does not tell us.

Citizen Lab: Targeted Ads Delivered Zero-Click Spyware to Al Jazeera Devices

Citizen Lab: Targeted Ads Delivered Zero-Click Spyware to Al Jazeera Devices

Citizen Lab says it has confirmed, for the first time, zero-click mercenary spyware delivered through targeted ads. Israeli firm Discover-Tech bought the ads that infected Al Jazeera devices with Candiru spyware, and its ads reached nearly 200,000 apps and sites.

GhostAction Hijacks About 1,900 GitHub Accounts to Steal CI Secrets From 30,000+ Repositories

GhostAction Hijacks About 1,900 GitHub Accounts to Steal CI Secrets From 30,000+ Repositories

GitGuardian says the GhostAction campaign hijacked about 1,900 GitHub accounts in October, targeting 30,000+ repositories and trying to pull 3,174 secrets from CI. Here is how the malicious workflows work, what GitHub did, and the steps to take now.

UPS Opens $80M Clark Hub as Central Luzon Builds a Logistics Corridor

UPS Opens $80M Clark Hub as Central Luzon Builds a Logistics Corridor

UPS opened a new $80M+ hub at Clark International Airport, 15 times larger than the old one, built to handle 46,000 packages a day and adding nearly 600 jobs. Here's what it means for Central Luzon's push to become a logistics corridor.

Citizen Lab Confirms Zero-Click Pegasus Hack of Belgrade University Rector's iPhone Days Before Serbia's Election

Citizen Lab Confirms Zero-Click Pegasus Hack of Belgrade University Rector's iPhone Days Before Serbia's Election

Citizen Lab confirmed with high confidence that University of Belgrade rector Vladan Đokić's iPhone was hacked with Pegasus via a zero-click exploit, six days before Serbia's election. A prosecutor also got an Apple threat warning. Here is what was confirmed and how to check.

PHP Will Ship Emergency Fixes for Two Critical Vulnerabilities Tonight

PHP Will Ship Emergency Fixes for Two Critical Vulnerabilities Tonight

The PHP security team will release fixes for two critical vulnerabilities, both rated CVSS v4.0 9.2, on October 21 at 14:00 UTC (10 PM Manila). Affected and fixed versions come with the release. Here is how to get ready now.

DHS Orders Federal Civilian Agencies to Drop DeepSeek, Including Products Built on It

DHS Orders Federal Civilian Agencies to Drop DeepSeek, Including Products Built on It

A DHS order published in the Federal Register on October 20 bars federal civilian agencies from buying DeepSeek products and requires them to remove DeepSeek and third-party products built on it. It does not cover private use or national security systems.