‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records. The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav. He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night. Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.

‼️ Israel is pushing propaganda through YouTube ads being served in Germany, carrying the State emblem and the line "Click to expose the UN's lies." The ads follow "The UN's Lie Industry," a campaign Israel launched recently to influence the policies of US and European capitals toward Israel. Google says it no longer serves political ads in the EU at all, yet here we are.

‼️ AI doomer Jacob Coxon, who caused widespread panic, lied when he told Fox News he had no third-party help going public. The PR firm that represents another AI doomer, Eliezer Yudkowsky, has been working with him, according to two sources and an email seen by Pirate Wires. The same firm had already booked Yudkowsky's co-author Nate Soares for interviews that overlapped with Coxon's debut, one source says, which suggests it knew his announcement was coming.

> be GNOME user > touchpad scrolls way too fast > no setting to slow it down > ask for one, flag it as an accessibility issue > get linked a closed thread from 2024 > patches for it have been sitting in open merge requests for years > ask if anything ever happened with them > "it's a complex topic" > keep pushing, say maybe GNOME isn't for me > "There are plenty of environments for you to choose from" > thread locked

‼️ BREAKING: OpenAI-linked AI agents on ordinary data-retrieval tasks turned to SQL injection, path traversal and cross-site scripting when normal access failed, probing three public data sites including an Australian government health website. The agents used the free link-checking sandbox urlquery[.]net as a remote browser to slip past web blocks. 6,467 of urlquery-scans were flagged as strong evidence of agent activity, some as recent as this month. On September 19 and 20, activity through the same services tried to trade crypto on Quidax and fired an HTML injection at the exchange. Agents also tried to register accounts that can hide scans, so the public record is likely partial.

‼️ The Pentagon, the Secret Service and ICE's investigative arm bought phone forensics software from Oxygen Forensics that prosecutors say five Russians secretly controlled through a Cyprus holding company, while selling the same software in Russia to customers including the FSB. Their CEO Lee Reiber was arrested in Idaho and Russian co-founder Oleg Davydov at London's Heathrow Airport before boarding a flight to Istanbul, and both are charged with conspiracy to commit wire fraud. Prosecutors say Davydov moved the build servers to U.S. cloud computers so Reiber could tell federal buyers the code was built in America, while a team in Russia kept writing it. In March, weeks after reports that ICE was using the software, Reiber told DHS that no Russian was involved in developing it, the complaint says. The FSB used the Russian version, Mobile Criminalist, to unlock the iPhone seized from RFE/RL journalist Alsu Kurmasheva in 2023, according to case files cited by The Insider. The complaint does not allege malicious code or unauthorized access to any customer's systems or data.

‼️ Five Indianapolis police officers have been charged over Flock license plate camera searches, accused of tracking romantic partners, spouses and women they met in public, with prosecutors alleging one officer searched more than 1,000 plates and used the data to engineer encounters. Marion County Prosecutor Ryan Mears called the audit behind the charges "just the beginning" of Flock-related cases.

❗️ A security researcher was paid a 115k bounty for reporting a vulnerability to Facebook. It's one of many "HEIF Heist" remote attack paths reported, targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images.