Barricades, as we know them today, are thought to date back to the European wars of religion. According to most historians, the first barricade went up in Paris in 1588; the word derives from the French barriques, or barrels, spontaneously put together. They have been assembled from the most diverse materials, from cobblestones, tyres, newspapers, dead horses and bags of ice (during Kyiv’s Euromaidan in 2013–14), to omnibuses and e‑scooters. Their tactical logic is close to that of guerrilla warfare: the authorities have to take the barricades in order to claim victory; all that those manning them have to do to prevail is to hold them.  The 19th century was the golden age for blocking narrow, labyrinthine streets. Paris had seen barricades go up nine times in the period before the Second Empire; during the July 1830 Revolution alone, 4,000 barricades had been erected (roughly one for every 200 Parisians). These barricades would not only stop, but also trap troops; people would then throw stones from windows or pour boiling water onto the streets. Georges‑Eugène Haussmann, Napoleon III’s prefect of Paris, famously created wide boulevards to make blocking by barricade more difficult and moving the military easier, and replaced cobblestones with macadam – a surface of crushed stone. As Flaubert observed in his Dictionary of Accepted Ideas: ‘Macadam: has cancelled revolutions. No more means to make barricades. Nevertheless rather inconvenient.’   Lead image: Barricades, as we know them today, are thought to have originated in early modern France. A colour engraving attributed to Achille‑Louis Martinet depicts the defence of a barricade during the 1830 July Revolution. Credit: Paris Musées / Musée Carnavalet – Histoire de Paris. Above: the socialist political thinker and activist Louis Auguste Blanqui – who was imprisoned by every regime that ruled France between 1815 and 1880 – drew instructions for how to build an effective barricade Under Napoleon III, Baron Haussmann widened Paris’s streets in his 1853–70 renovation of the city, making barricading more difficult Credit: Old Books Images / Alamy ‘On one hand, [the authorities] wanted to favour the circulation of ideas,’ reactionary intellectual Louis Veuillot observed apropos the ambiguous liberalism of the latter period of Napoleon III’s Second Empire. ‘On the other, to ensure the circulation of regiments.’ But ‘anti‑insurgency hardware’, as Justinien Tribillon has called it, also served to chase the working class out of the city centre: Haussmann’s projects amounted to a gigantic form of real-estate speculation, and the 1871 Paris Commune that followed constituted not just a short‑lived anarchist experiment featuring enormous barricades; it also signalled the return of the workers to the centre and, arguably, revenge for their dispossession.    By the mid‑19th century, observers questioned whether barricades still had practical meaning. Gottfried Semper’s barricade, constructed for the 1849 Dresden uprising, had proved unconquerable, but Friedrich Engels, one‑time ‘inspector of barricades’ in the Elberfeld insurrection of the same year, already suggested that the barricades’ primary meaning was now moral rather than military – a point to be echoed by Leon Trotsky in the subsequent century. Barricades symbolised bravery and the will to hold out among insurrectionists, and, not least, determination rather to destroy one’s possessions – and one’s neighbourhood – than put up with further oppression.   Not only self‑declared revolutionaries viewed things this way: the reformist Social Democrat leader Eduard Bernstein observed that ‘the barricade fight as a political weapon of the people has been completely eliminated due to changes in weapon technology and cities’ structures’. Bernstein was also picking up on the fact that, in the era of industrialisation, contention happened at least as much on the factory floor as on the streets. The strike, not the food riot or the defence of workers’ quartiers, became the paradigmatic form of conflict. Joshua Clover has pointed out in his 2016 book Riot. Strike. Riot: The New Era of Uprisings, that the price of labour, rather than the price of goods, caused people to confront the powerful. Blocking production grew more important than blocking the street. ‘The only weapons we have are our bodies, and we need to tuck them in places so wheels don’t turn’ Today, it is again blocking – not just people streaming along the streets in large marches – that is prominently associated with protests. Disrupting circulation is not only an important gesture in the face of climate emergency; blocking transport is a powerful form of protest in an economic system focused on logistics and just‑in‑time distribution. Members of Insulate Britain and Germany’s Last Generation super‑glue themselves to streets to stop car traffic to draw attention to the climate emergency; they have also attached themselves to airport runways. They form a human barricade of sorts, immobilising traffic by making themselves immovable.   Today’s protesters have made themselves consciously vulnerable. They in fact follow the advice of US civil rights’ Bayard Rustin who explained: ‘The only weapons we have are our bodies, and we need to tuck them in places so wheels don’t turn.’ Making oneself vulnerable might increase the chances of a majority of citizens seeing the importance of the cause which those engaged in civil disobedience are pursuing. Demonstrations – even large, unpredictable ones – are no longer sufficient. They draw too little attention and do not compel a reaction. Naomi Klein proposed the term ‘blockadia’ as ‘a roving transnational conflict zone’ in which people block extraction – be it open‑pit mines, fracking sites or tar sands pipelines – with their bodies. More often than not, these blockades are organised by local people opposing the fossil fuel industry, not environmental activists per se. Blockadia came to denote resistance to the Keystone XL pipeline as well as Canada’s First Nations‑led movement Idle No More. In cities, blocking can be accomplished with highly mobile structures. Like the barricade of the 19th century, they can be quickly assembled, yet are difficult to move; unlike old‑style barricades, they can also be quickly disassembled, removed and hidden (by those who have the engineering and architectural know‑how). Think of super tripods, intricate ‘protest beacons’ based on tensegrity principles, as well as inflatable cobblestones, pioneered by the artist‑activists of Tools for Action (and as analysed in Nick Newman’s recent volume Protest Architecture).   As recently as 1991, newly independent Latvia defended itself against Soviet tanks with the popular construction of barricades, in a series of confrontations that became known as the Barikādes Credit: Associated Press / Alamy Inversely, roadblocks can be used by police authorities to stop demonstrations and gatherings from taking place – protesters are seen removing such infrastructure in Dhaka during a general strike in 1999 Credit: REUTERS / Rafiqur Rahman / Bridgeman These inflatable objects are highly flexible, but can also be protective against police batons. They pose an awkward challenge to the authorities, who often end up looking ridiculous when dealing with them, and, as one of the inventors pointed out, they are guaranteed to create a media spectacle. This was also true of the 19th‑century barricade: people posed for pictures in front of them. As Wolfgang Scheppe, a curator of Architecture of the Barricade (currently on display at the Arsenale Institute for Politics of Representation in Venice), explains, these images helped the police to find Communards and mete out punishments after the end of the anarchist experiment. Much simpler structures can also be highly effective. In 2019, protesters in Hong Kong filled streets with little archways made from just three ordinary bricks: two standing upright, one resting on top. When touched, the falling top one would buttress the other two, and effectively block traffic. In line with their imperative of ‘be water’, protesters would retreat when the police appeared, but the ‘mini‑Stonehenges’ would remain and slow down the authorities. Today, elaborate architectures of protest, such as Extinction Rebellion’s ‘tensegrity towers’, are used to blockade roads and distribution networks – in this instance, Rupert Murdoch’s News UK printworks in Broxbourne, for the media group’s failure to report the climate emergency accurately Credit: Extinction Rebellion In June 2025, protests erupted in Los Angeles against the Trump administration’s deportation policies. Demonstrators barricaded downtown streets using various objects, including the pink public furniture designed by design firm Rios for Gloria Molina Grand Park. LAPD are seen advancing through tear gas Credit: Gina Ferazzi / Los Angeles Times via Getty Images Roads which radicals might want to target are not just ones in major metropoles and fancy post‑industrial downtowns. Rather, they might block the arteries leading to ‘fulfilment centres’ and harbours with container shipping. The model is not only Occupy Wall Street, which had initially called for the erection of ‘peaceful barricades’, but also the Occupy that led to the Oakland port shutdown in 2011. In short, such roadblocks disrupt what Phil Neel has called a ‘hinterland’ that is often invisible, yet crucial for contemporary capitalism. More recently, Extinction Rebellion targeted Amazon distribution centres in three European countries in November 2021; in the UK, they aimed to disrupt half of all deliveries on a Black Friday.   Will such blockades just anger consumers who, after all, are not present but are impatiently waiting for packages at home? One of the hopes associated with the traditional barricade was always that they might create spaces where protesters, police and previously indifferent citizens get talking; French theorists even expected them to become ‘a machine to produce the people’. That could be why military technology has evolved so that the authorities do not have to get close to the barricade: tear gas was first deployed against those on barricades before it was used in the First World War; so‑called riot control vehicles can ever more easily crush barricades. The challenge, then, for anyone who wishes to block is also how to get in other people’s faces – in order to have a chance to convince them of their cause.        2025-06-11 Kristina Rapacki Share

In 2024, Egypt completed its 1,155km stretch of the Cairo–Cape Town Highway, a 10,228km‑long road connecting 10 African countries – Egypt, Sudan, South Sudan, Ethiopia, Kenya, Tanzania, Zambia, Zimbabwe, Botswana and South Africa.   The imaginary of ‘Cape to Cairo’ is not new. In 1874, editor of the Daily Telegraph Edwin Arnold proposed a plan to connect the African continent by rail, a project that came to be known as the Cape to Cairo Railway project. Cecil Rhodes expressed his support for the project, seeing it as a means to connect the various ‘possessions’ of the British Empire across Africa, facilitating the movement of troops and natural resources. This railway project was never completed, and in 1970 was overlaid by a very different attempt at connecting the Cape to Cairo, as part of the Trans‑African Highway network. This 56,683km‑long system of highways – some dating from the colonial era, some built as part of the 1970s project, and some only recently built – aimed to create lines of connection across the African continent, from north to south as well as east to west.  Here, postcolonial state power invested in ‘moving the continent’s people and economies from past to future’, as architectural historians Kenny Cupers and Prita Meier write in their 2020 essay ‘Infrastructure between Statehood and Selfhood: The Trans‑African Highway’. The highways were to be built with the support of Kenya’s president Jomo Kenyatta, Ghana’s president Kwame Nkrumah and Ghana’s director of social welfare Robert Gardiner, as well as the United Nations Economic Commission for Africa (UNECA). This project was part of a particular historical moment during which anticolonial ideas animated most of the African continent; alongside trade, this iteration of Cape to Cairo centred social and cultural connection between African peoples. But though largely socialist in ambition, the project nevertheless engaged modernist developmentalist logics that cemented capitalism.  Lead image: Over a century in the making, the final stretches of the Cairo–Cape Town Highway are being finished. Egypt completed the section within its borders last year and a section over the dry Merille River in Kenya was constructed in 2019. Credit: Allan Muturi / SOPA / ZUMA / Alamy. Above: The route from Cairo to Cape Town, outlined in red, belongs to the Trans‑African Highway network, which comprises nine routes, here in black The project failed to fully materialise at the time, but efforts to complete the Trans‑African Highway network have been revived in the last 20 years; large parts are now complete though some links remain unbuilt and many roads are unpaved or hazardous. The most recent attempts to realise this project coincide with a new continental free trade agreement, the agreement on African Continental Free Trade Area (AfCFTA), established in 2019, to increase trade within the continent. The contemporary manifestation of the Cairo–Cape Town Highway – also known as Trans‑African Highway (TAH) 4 – is marked by deepening neoliberal politics. Represented as an opportunity to boost trade and exports, connecting Egypt to African markets that the Egyptian government view as ‘untapped’, the project invokes notions of trade steeped in extraction, reflecting the neoliberal logic underpinning contemporary Egyptian governance; today, the country’s political project, led by Abdel Fattah El Sisi, is oriented towards Egyptian dominance and extraction in relation to the rest of the continent.  Through an allusion to markets ripe for extraction, this language brings to the fore historical forms of domination that have shaped the connections between Egypt and the rest of the continent; previous iterations of connection across the continent often reproduced forms of domination stretching from the north of the African continent to the south, including the Trans‑Saharan slave trade routes across Africa that ended in various North African and Middle Eastern territories. These networks, beginning in the 8th century and lasting until the 20th, produced racialised hierarchies across the continent, shaping North Africa into a comparably privileged space proximate to ‘Arabness’. This was a racialised division based on a civilisational narrative that saw Arabs as superior, but more importantly a political economic division resulting from the slave trade routes that produced huge profits for North Africa and the Middle East. In the contemporary moment, these racialised hierarchies are bound up in political economic dependency on the Arab Gulf states, who are themselves dependent on resource extraction, land grabbing and privatisation across the entire African continent.  ‘The Cairo–Cape Town Highway connects Egypt to African markets viewed as “untapped”, invoking notions steeped in extraction’ However, this imaginary conjured by the Cairo–Cape Town Highway is countered by a network of streets scattered across Africa that traces the web of Egyptian Pan‑African solidarity across the continent. In Lusaka in Zambia, you might find yourself on Nasser Road, as you might in Mwanza in Tanzania or Luanda in Angola. In Mombasa in Kenya, you might be driving down Abdel Nasser Road; in Kampala in Uganda, you might find yourself at Nasser Road University; and in Tunis in Tunisia, you might end up on Gamal Abdel Nasser Street. These street names are a reference to Gamal Abdel Nasser, Egypt’s first postcolonial leader and president between 1956 and 1970.  Read against the contemporary Cairo–Cape Town Highway, these place names signal a different form of connection that brings to life Egyptian Pan‑Africanism, when solidarity was the hegemonic force connecting the continent, coming up against the notion of a natural or timeless ‘great divide’ within Africa. From the memoirs of Egyptian officials who were posted around Africa as conduits of solidarity, to the broadcasts of Radio Cairo that were heard across the continent, to the various conferences attended by anticolonial movements and postcolonial states, Egypt’s orientation towards Pan‑Africanism, beginning in the early 20th century and lasting until the 1970s, was both material and ideological. Figures and movements forged webs of solidarity with their African comrades, imagining an Africa that was united through shared commitments to ending colonialism and capitalist extraction.  The route between Cape Town in South Africa and Cairo in Egypt has long occupied the colonial imaginary. In 1930, Margaret Belcher and Ellen Budgell made the journey, sponsored by car brand Morris and oil company Shell Credit: Fox Photos / Getty The pair made use of the road built by British colonisers in the 19th century, and which forms the basis for the current Cairo–Cape Town Highway. The road was preceded by the 1874 Cape to Cairo Railway project, which connected the colonies of the British Empire Credit: Library of Congress, Geography and Map Division This network of eponymous streets represents attempts to inscribe anticolonial power into the materiality of the city. Street‑naming practices are one way in which the past comes into the present, ‘weaving history into the geographic fabric of everyday life’, as geographer Derek Alderman wrote in his 2002 essay ‘Street Names as Memorial Arenas’. In this vein, the renaming of streets during decolonisation marked a practice of contesting the production of colonial space. In the newly postcolonial city, renaming was a way of ‘claiming the city back’, Alderman continues. While these changes may appear discursive, it is their embedding in material spaces, through signs and maps, that make the names come to life; place names become a part of the everyday through sharing addresses or giving directions. This quality makes them powerful; consciously or unconsciously, they form part of how the spaces of the city are navigated.  These are traces that were once part of a dominant historical narrative; yet when they are encountered in the present, during a different historical moment, they no longer act as expressions of power but instead conjure up a moment that has long passed. A street in Lusaka named after an Egyptian general made more sense 60 years ago than it does today, yet contextualising it recovers a marginalised history of Egyptian Pan‑Africanism.  Markers such as street names or monuments are simultaneously markers of anticolonial struggle as well as expressions of state power – part of an attempt, by political projects such as Nasser’s, to exert their own dominance over cities, towns and villages. That such traces are expressions of both anticolonial hopes and postcolonial state power produces a sense of tension within them. For instance, Nasser’s postcolonial project in Egypt was a contradictory one; it gave life to anticolonial hopes – for instance by breaking away from European capitalism and embracing anticolonial geopolitics – while crushing many parts of the left through repression, censorship and imprisonment. Traces of Nasser found today inscribe both anticolonial promises – those that came to life and those that did not – while reproducing postcolonial power that in most instances ended in dictatorship.  Recent efforts to complete the route build on those of the post‑independence era – work on a section north of Nairobi started in 1968 Credit: Associated Press / Alamy The Trans‑African Highway network was conceived in 1970 in the spirit of Pan‑Africanism At that time, the routes did not extend into South Africa, which was in the grip of apartheid. The Trans‑African Highway initiative was motivated by a desire to improve trade and centre cultural links across the continent – an ambition that was even celebrated on postage stamps There have been long‑standing debates about the erasure of the radical anticolonial spirit from the more conservative postcolonial states that emerged; the promises and hopes of anticolonialism, not least among them socialism and a world free of white supremacy, remain largely unrealised. Instead, by the 1970s neoliberalism emerged as a new hegemonic project. The contemporary instantiation of Cape to Cairo highlights just how pervasive neoliberal logics continue to be, despite multiple global financial crises and the 2011 Egyptian revolution demanding ‘bread, freedom, social justice’.  But the network of streets named after anticolonial figures and events across the world is testament to the immense power and promise of anticolonial revolution. Most of the 20th century was characterised by anticolonial struggle, decolonisation and postcolonial nation‑building, as nations across the global south gained independence from European empire and founded their own political projects. Anticolonial traces, present in street and place names, point to the possibility of solidarity as a means of reorienting colonial geographies. They are a reminder that there have been other imaginings of Cape to Cairo, and that things can be – and have been – otherwise. 2025-06-13 Kristina Rapacki Share

The 12-year campaign to free Ross Ulbricht — the criminal mastermind behind the Silk Road, the original crypto-enabled dark web mail-order-drug emporium — finally ended in January, when newly-minted second term president Donald Trump officially pardoned the bitcoin criminal.Now, Ulbricht is picking up where he left off, getting his first taste of a world he left behind in 2013 when a federal judge sentenced him to two counts of life in prison, plus 40 years without parole.In sum, Ulbricht's feeling some culture shock. Taking the stage at the Bitcoin 2025 conference in Las Vegas this week, the drug kingpin was agog at the piles of kitschy tech products that had passed him by."When I walked out of prison a few months ago, I’d never seen a drone, used AI, or tried VR. I hadn’t even chatted with AI," Ulbricht marveled. "Now it's all hitting me at once — the freedom, the technology, the fact that I have a future again."He also basked in the glow of the crypto community's love — a parasocial following that lavished his clemency petition with over 600,000 signatures and an astonishing number of right-libertarian micro-celebrity endorsements."You didn't abandon me. You didn't forget me. You wrote me letters. You raised money for my defense. When I was silenced, you spoke up against the slander and the smears," the former dope baron lauded.Keep in mind, this wasn't a political activist jailed for protesting an unjust war, or a whistleblower whose life was destroyed after revealing a massive corporate fraud scheme.This is a guy who made millions selling drugs to teenagers and communities ravaged by the opioid crisis, resulting in at least six overdose deaths that we know of. (Not to mention the hitmen he tried to hire to take out his enemies, though he was unsuccessful.)At its peak in 2013, Ulbricht's Silk Road saw an estimated daily connected user base of 5.5 million. In just two years, it processed some $1.2 billion in illicit sales, according to the Department of Homeland Security.Through transaction fees, the service generated over $80 million worth of Bitcoin. Authorities in 2014 called it the "most sophisticated and extensive criminal marketplace on the internet."Of course, Ulbricht's saving grace isn't some ethical dilemma Trump has over incarceration or judicial mishandling, but the fact that he built Silk Road off the then-nascent blockchain. That single fact has cemented his status as a crypto superstar.For context, out of the 1.2 million citizens incarcerated in the US, over 360,000 of them face charges of nonviolent drug possession.In 2023, there were roughly 870,000 arrests for drug-related charges, the vast majority, or 87.8 percent of which were for drug possession — in other words, for carrying an impossibly tiny fraction of the volume that passed through Ulbricht's drug empire every minute.With his new lease on life, Ulbricht plans on paying it forward — not as an advocate for carceral reform or prison abolition, but to the crypto community of get-rich-quick schemers and granny scammers."With so much speed and chaos, it’s more important than ever to stay true to our principles," he told the crowd of cryptobros. "If we agree that we deserve freedom and that [crypto] decentralization secures it, we can stand together. Have each other’s backs, as you had mine. Freedom, decentralization, unity — stay true to these, and the future is ours."More on crypto: Visitors At This Bitcoin-Heated Spa Are Complaining About Mold and UTIsShare This Article

Cosmology of Kyoto is a first-person horror exploration game where players navigate a deeply haunted yet surprisingly educational terrain. Originally released in 1993, Cosmology of Kyoto and its disturbing depictions of suffering have since become a cult classic. Roger Ebert, known hater, loved the game so much that he spent weeks playing it. Despite its acclaim, though, the game was a commercial failure and never got a sequel. At least, that’s what many people believed until now. In 2023, a game called TRIPITAKA 玄奘三蔵求法の旅 was listed on Yahoo Japan. The game was sold for $300 to an unknown party who, despite embarking on a bidding war that culminated in hundreds of dollars, didn’t really share anything publicly about it. The transaction was originally noticed by Mark Buckner, who brought it up in a discussion between fans about the original eerie Japanese game. Though diehard aficionados had a suspicion that the Cosmology developers had considered a follow-up, concrete evidence of it was scant. The only apparent mention of a sequel lied in the resumes of two Cosmology producers, Hiroshi Ōnishi and Mori Kōichi. Fans also spotted mention of it in an old website for a 1999 museum exhibition on the Silk Road. Though it was a work of fiction, Cosmology was rooted in the history of 10th century Japan and provided players with an in-game encyclopedia. It would make sense for a potential sequel to have enough an educational focus worthy of a museum exhibition. Despite these rumblings, it was unclear if the game had ever been published, or how far into production it got. Knowledge of the auction prompted video game academic Bruno de Figueiredo to track down the auction winner. The hope was that whoever bought it might share a copy of the game online. After all, up until this point, few knew what this game was and its mere existence lay in doubt. But if it did exist, then it was obviously significant from a historical perspective. Fans would be eager to play it. But getting collectors to share copies of rare games is tricky. If a game is widely accessible, then it’s no longer rare. Holding on to a copy ensures that it retains its aura as a prized possession. Hoarding also means that the value of a game won’t drop — in fact, it might rise. Not all collectors see their possessions as commodities, though. Holding on to a culturally significant game might be motivated by the desire to preserve it for future generations, which is relevant in instances where a copy of a game is still sealed. Uploading a game that you did not develop is also likely to be legally dubious. In this case, the owner declined to share the game in a form that others could play. The collector did however upload an hour’s worth of footage on YouTube. The game was called TRIPITAKA, and though it did not outright classify itself as a sequel, the art style, historical focus, and slightly unnerving vibe placed TRIPITAKA in a similar realm as Cosmology of Kyoto. Fans considered it a spiritual successor. Cosmology itself had been developed with the help of Japanese museums. For some, it was enough to get more of a game they loved. Even if they couldn’t personally control the gameplay, the TRIPITAKA video was lengthy enough to give a sense of what the experience would be like. Others were enraged: Couldn’t the collector see how important this game was? “I cannot understate just how disgusted I am that this piece of culture and art (that I am a huge fan of) isn’t being preserved and spread for the enjoyment of others,” one commenter on YouTube wrote. “Shame on you.” Undeterred by this roadblock, Bruno de Figueiredo continued his pursuit of TRIPITAKA. In 2025, his efforts bore fruit. On X, the expert on obscure Japanese games revealed that he had finally convinced the collector to share the game online after “years of appeals.” Figueiredo has since uploaded a playable ISO of the game online alongside a full three-hour playthrough of a game that had once been considered lost media. Figuerido did not respond to a request for comment. In a blog post, he emphasized the significance of this find by stating that “the importance of this footage could hardly be overstated.” He continued: I am delighted to have played a minor role in the unraveling of this thirty year old mystery, and can hardly contain my enthusiasm, as I now find myself equipped with sufficient information to produce a full post concerning a game about which I could not have written more than a sentence, just last year. Figuerido refers to TRIPITAKA as one of the rarest games ever made, and it’s true inasmuch as there appears to be only one known copy of it. Value and rarity are also fluid concepts that are ultimately determined by interested audiences. At the same time, TRIPITAKA’s fate and availability is shockingly ordinary when you consider how poorly the gaming industry preserves its own history. If the lack of care is evident with significant games that have arguable merit, it’s doubly true for average games. This is how a game with mixed reviews from twenty years ago suddenly starts commanding hundreds of dollars on resale sites; the scarcity happens because nobody felt a game was worth holding on to. “There are many extremely rare (and even lost) games for personal computers which, unlike consoles, don’t have any central control over who can publish a game, or what the minimum number of manufactured units needs to be,” says Frank Cifaldi, founder of the Video Game History foundation, a nonprofit dedicated to preserving video games. Cifaldi notes that games in the 80s and 90s in particular, some of which were self-published and never got widespread circulation to begin with, are particularly prone to the type of obscurity that can lead to only a single copy of a game. “I would further suspect that there were many games and multimedia objects from Japan during this era that are just as rare, but we don’t hear about them because of their lack of historical significance in the West,” Cifaldi says. “I would bet good money that if you surveyed the collection at the Game Preservation Society in Japan, you’d come up with dozens of ‘only known copies’ of 1980s microcomputer games.”

May 31, 2025Ravie LakshmananVulnerability / Linux Two information disclosure flaws have been identified in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise Linux, and Fedora, according to the Qualys Threat Research Unit (TRU). Tracked as CVE-2025-5054 and CVE-2025-4598, both vulnerabilities are race condition bugs that could enable a local attacker to obtain access to access sensitive information. Tools like Apport and systemd-coredump are designed to handle crash reporting and core dumps in Linux systems. "These race conditions allow a local attacker to exploit a SUID program and gain read access to the resulting core dump," Saeed Abbasi, manager of product at Qualys TRU, said. A brief description of the two flaws is below - CVE-2025-5054 (CVSS score: 4.7) - A race condition in Canonical apport package up to and including 2.32.0 that allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces CVE-2025-4598 (CVSS score: 4.7) - A race condition in systemd-coredump that allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process SUID, short for Set User ID, is a special file permission that allows a user to execute a program with the privileges of its owner, rather than their own permissions. "When analyzing application crashes, apport attempts to detect if the crashing process was running inside a container before performing consistency checks on it," Canonical's Octavio Galland said. "This means that if a local attacker manages to induce a crash in a privileged process and quickly replaces it with another one with the same process ID that resides inside a mount and pid namespace, apport will attempt to forward the core dump (which might contain sensitive information belonging to the original, privileged process) into the namespace." Red Hat said CVE-2025-4598 has been rated Moderate in severity owing to the high complexity in pulling an exploit for the vulnerability, noting that the attacker has to first the race condition and be in possession of an unprivileged local account. As mitigations, Red Hat said users can run the command "echo 0 > /proc/sys/fs/suid_dumpable" as a root user to disable the ability of a system to generate a core dump for SUID binaries. The "/proc/sys/fs/suid_dumpable" parameter essentially controls whether SUID programs can produce core dumps on the crash. By setting it to zero, it disables core dumps for all SUID programs and prevents them from being analyzed in the event of a crash. "While this mitigates this vulnerability while it's not possible to update the systemd package, it disables the capability of analyzing crashes for such binaries," Red Hat said. Similar advisories have been issued by Amazon Linux, Debian, and Gentoo. It's worth noting that Debian systems aren't susceptible to CVE-2025-4598 by default, since they don't include any core dump handler unless the systemd-coredump package is manually installed. CVE-2025-4598 does not affect Ubuntu releases. Qualys has also developed proof-of-concept (PoC) code for both vulnerabilities, demonstrating how a local attacker can exploit the coredump of a crashed unix_chkpwd process, which is used to verify the validity of a user's password, to obtain password hashes from the /etc/shadow file. Canonical, in an alert of its own, said the impact of CVE-2025-5054 is restricted to the confidentiality of the memory space of invoked SUID executables and that the PoC exploit can leak hashed user passwords has limited real-world impact. "The exploitation of vulnerabilities in Apport and systemd-coredump can severely compromise the confidentiality at high risk, as attackers could extract sensitive data, like passwords, encryption keys, or customer information from core dumps," Abbasi said. "The fallout includes operational downtime, reputational damage, and potential non-compliance with regulations. To mitigate these multifaceted risks effectively, enterprises should adopt proactive security measures by prioritizing patches and mitigations, enforcing robust monitoring, and tightening access controls." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

White House Chief of Staff Susie Wiles uses a phone as she attends a National Day of Prayer event hosted by President Donald Trump in the Rose Garden at the White House, May 1, 2025 in Washington / Image credits - Andrew Harnik/Getty Images The personal phone of Susie Wiles, the U.S. President Donald Trump’s chief of staff, was allegedly hacked, with the individual responsible obtaining access to a bevy of contacts, including high-profile officials. According to the latest report, a federal probe has been launched, but there is no confirmation on how the phone was compromised in the first place. The contacts present in Susie Wiles’ phone grew suspicious after the impersonator asked to move the conversation to Telegram, risking the leaking of sensitive information Shortly after gaining access to the White House chief of staff’s personal phone, the hackers leveraged AI to impersonate Wiles’ likeness and sent multiple contacts voice and text messages from a different number. It was only after the person or persons on the other end recommended continuing the conversation to a private platform like Telegram that the contacts realized that something was off. FBI Director Kash Patel shared the following statement with CBS News regarding the incident. “The FBI takes all threats against the President, his staff, and our cybersecurity with the utmost seriousness; safeguarding our administration officials’ ability to securely communicate to accomplish the President's mission is a top priority.” As for how Wiles’ phone was compromised, TechCrunch asked White House spokesperson Anna Kelly if a cloud account associated with the chief of staff’s device was compromised, or if her handset was a part of a more sophisticated attack involving government-grade spyware. Unfortunately, the outlet did not receive a meaningful response, suggesting that the investigation is still ongoing. This is the second incident in which Wiles has been targeted by hackers, with the first instance transpiring in 2024, when it was reported that Iranian cyber-espionage experts attempted to obtain access to her personal email account. A separate report claims that these individuals were successful in bypassing the security as they obtained a dossier on Vice President JD Vance, who was Donald Trump’s running mate at the time. Going over a few images, we realized that the U.S. President’s chief of staff is currently in possession of an iPhone, which should cause even more concern because Apple prides itself on its robust security and privacy. News Source: The Wall Street Journal

May 30, 2025Ravie LakshmananCryptocurrency / Cybercrime The U.S. Department of Treasury's Office of Foreign Assets Control (OFAC) has levied sanctions against a Philippines-based company named Funnull Technology Inc. and its administrator Liu Lizhi for providing infrastructure to conduct romance baiting scams that led to massive cryptocurrency losses. The Treasury accused the Taguig-headquartered company of enabling thousands of websites involved in virtual currency investment scams that caused Americans to lose billions of dollars annually. "Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses," the agency said in a press release. The average loss is estimated to be over $150,000 per individual. Funnull, also called Fang Neng CDN (funnull[.]io, funnull[.]com, funnull[.]app, and funnull[.]buzz), was first attracted the attention of the cybersecurity community in June 2024 after it was implicated in the supply chain attack of widely-used Polyfill[.]io JavaScript library. Last year, an analysis by Silent Push revealed that the infrastructure associated with Funnull has been used to promote investment scams, fake trading applications, and suspect gambling networks. The infrastructure has been codenamed Triad Nexus. Then earlier this February, the cybersecurity company attributed Funnull to a practice dubbed infrastructure laundering wherein the company rented IP addresses from mainstream hosting providers such as Amazon Web Services (AWS) and Microsoft Azure to host criminal websites. Highlighting this aspect, the Treasury said Funnull enables virtual currency investment scams by acquiring IP addresses in bulk from major cloud services companies across the world and selling them to cybercriminals to host scam platforms and other malicious web content. "Funnull generates domain names for websites on its purchased IP addresses using domain generation algorithms (DGAs) – programs that generate large numbers of similar but unique names for websites – and provides web design templates to cybercriminals," the agency pointed out. "These services not only make it easier for cybercriminals to impersonate trusted brands when creating scam websites but also allow them to quickly change to different domain names and IP addresses when legitimate providers attempt to take the websites down." The Treasury also accused Funnull of purchasing Polyfill[.]io with the intent to redirect visitors of legitimate websites to scam websites and online gambling sites, some of which it said are linked to Chinese criminal money laundering operations. Furthermore, the department alleged that its administrator Liu, a Chinese national, was in possession of spreadsheets and other documents that contained information about the company's employees, their performance, and their work progress. The tasks assigned to them included assigning domain names to criminal actors for virtual currency investment fraud, phishing scams, and online gambling sites. In a standalone flash alert, the U.S. Federal Bureau of Investigation (FBI) said it identified 548 unique Funnull Canonical Names (CNAME) linked to over 332,000 unique domains since January 2025. "Between October 2023 and April 2025, multiple patterns of IP address activity were observed from several domains using Funnull infrastructure," the FBI said. "During this time frame, hundreds of domains using Funnull infrastructure simultaneously migrated from one IP address to another either on the same exact day or within the same timeframe." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    

Let's make this simple: You want to know if there are any post- or mid-credits scenes in Karate Kid: Legends. The answer is yes!Well, what do you call it when a movie ends, they cut to a title card, but then they immediately cut to another scene? Let’s call it a starts-credit scene. It would be hard to miss, but if you had to pee and were thinking of leaping out of your seat the second it seemed the movie was over, well, you shouldn’t. Full spoilers for the entire movie follow!The prophecy of six movies and six seasons of a TV show – wait, was that a thing? – has been fulfilled, as the Karate Kid franchise returns to theaters in Karate Kid: Legends. Though it is opening just a few months after the conclusion of the hit Netflix series Cobra Kai, the filmmakers have stressed this is a standalone story and that while Daniel LaRusso (Ralph Macchio) is in both, fans shouldn’t expect the film to continue Cobra Kai storylines, as we shift focus to a new Karate Kid, Li Fong (Ben Wang). Still, it was hard not to wonder if there would be any overt connections between the two beyond Daniel’s presence - or if fans should actually worry that the film would outright contradict the series in any way. Ultimately, while the movie sticks to that standalone promise pretty strongly, and Daniel actually has a relatively small role, there are two scenes that touch upon other aspects of the larger Karate Kid franchise - specifically tied to The Karate Kid Part II and, yes, Cobra Kai. Ranking the Karate Kid MoviesThe Karate Kid Part II Connection (and Continuity Error)Karate Kid: Legends has been marketed as a movie where Li Fong gets trained by two legends from Karate Kid history - Daniel LaRusso and Jackie Chan’s Mr. Han. This is pretty notable because Mr. Han’s only appearance prior to this was alongside Jaden Smith in 2010’s The Karate Kid, a film that was intended at the time to be an outright remake of the 1984 original. And while it changed the character names and locations, it used nearly every notable story beat from the 1984 film. All of which makes it pretty funny that it’s now been retconned to be part of the larger Karate Kid/Cobra Kai universe, since it means we just have to accept Mr. Han and Mr. Miyagi had remarkably similar experiences as widowed handymen who were secretly martial arts masters that ended up mentoring and befriending a bullied young boy who moved into the building they worked in… And then entered them in a tournament where they could face their bully… And one night drunkenly broke down and spoke about their dead family to the kid they were training... And so on…But hey, the universe works in mysterious ways, and I guess maybe it’s even more cosmic that Han and Miyagi lived such similar lives since it turns out they were really good friends whose families had been bonded together for literal centuries! Legends reveals that the two were longtime pals and we even get a photoshopped image of Pat Morita and Jackie Chan in the mid-1980s together to prove it. Legends opens with a flashback scene pulled from The Karate Kid Part II to dive into the bond between the Miyagi and Han families.“Legends actually opens with a flashback scene pulled from The Karate Kid Part II to dive into the bond between the Miyagi and Han families. In Part II, when Daniel traveled with Miyagi to Okinawa, Miyagi explained to him how in the year 1625, his ancestor, fisherman Shimpo Miyagi, got drunk on his boat and woke up to find himself off the coast of China. He would return to Okinawa a decade later with a Chinese wife and two children, also now knowing the secret of Miyagi family karate, bringing karate to Okinawa for the first time in the process. However, Legends transitions from this scene between Daniel and Miyagi into animation accompanied by a soundalike for the late Pat Morita (is it an actual human or AI? Who can say these days?) that goes into specifics we didn’t hear in The Karate Kid Part II. Here, Miyagi says that it was the kung fu experts in the Han family who Shimpo encountered and learned from, and that is what forged a bond that has lasted to the present day between the two families. Oh, and a side note fanboy rant: Karate Kid: Legends literally begins with this flashback scene, alongside onscreen text that says “Okinawa, 1986.” 1986 is the year The Karate Kid Part II was released, yes, but that’s not the year that movie took place in! The Karate Kid Part II is set the summer after Daniel won the All-Valley in December 1984 in the first movie. Hence, it’s the summer of 1985. They make sure to get this right on Cobra Kai when referencing Part II’s events (and hell, when referencing The Karate Kid Part III as well, which takes place later in 1985), so it is odd and annoying that no one noticed this error in the entire process of completing this film, when plenty of Karate Kid/Cobra Kai fans can spot it instantly. Sigh… End rant. PlayLi’s Three Dads (Can Fight)Karate Kid: Legends is actually rather misleading in terms of marketing, because yes, Li ends up being trained by Mr. Han and Daniel together for this film’s big tournament, the New York-based 5 Boroughs. But none of that happens – and we don’t even see Daniel outside of that old Part II footage – until the second half of the movie. The first half follows Li moving to New York with his mom (Ming-Na Wen) where, at first, he’s having the traditional Karate Kid new kid in town path of falling for a friendly cute girl he meets (Sadie Stanley as Mia) whose ex-boyfriend (Aramis Knight as Connor) turns out to be a bullying a-hole who’s also a seemingly unbeatable karate champion. But one big difference this time is that Li actually is a rather formidable kung fu fighter already, thanks to the training he received back in China from Mr. Han - he’s just not ready for someone as skilled as Connor yet. But the other big difference is that the film then takes a huge detour from other Karate Kid films for quite awhile when Li bonds with Mia’s dad, Victor (Joshua Jackson), an ex-boxer turned pizza place owner who’s attempting a boxing comeback in order to quickly make money he needs to pay back a loan from the dangerous O’Shea (Tim Rozon). O’Shea is also the guy who runs the Demolition karate school that trains Connor, so basically think of him as Kreese from the original Karate Kid… if he also had a side hustle as a mobster/loan shark type.      After Li helps Victor fight off some of O’Shea’s goons, Victor is amazed at his fighting prowess and asks the kid to help him train to get back into fighting shape - and pass on some of his kung fu techniques for punching and dodging. Li accepts, and for a surprising amount of the first half of its run time Karate Kid: Legends does a fun twist on the usual underdog story, with the young teen character mentoring the older character on how to fight. However, in Victor’s big comeback fight, his opponent goes for some brutal sucker punches at O’Shea’s orders, sending Victor to the hospital. With Connor still harassing Li and Li now wanting to help Victor and Mia get the money they still need to pay off Victor’s debt, he is convinced by Mr. Han – who comes from China to see him – to enter the 5 Boroughs tournament, which comes with a snazzy $50,000 prize for the winner. Mr. Han will of course help train him, but he can’t do it alone, because the 5 Boroughs is a karate tournament, not kung fu. So it’s off to Los Angeles and to Mr. Miyagi’s house (AKA Miyagi-Do Karate Dojo to Cobra Kai fans) to recruit a reluctant Daniel LaRusso to help, with Han explaining his friendship with Miyagi - though you’d think Daniel might already know about him?Karate Kid: Legends Ending ExplainedSoon enough, as Han predicts, Daniel does come to New York and he and Han team up to get Li ready for the tournament in just a few days time, using his foundation of kung fu to build upon to teach him Miyagi karate. Daniel also gives Li a headband he found among Miyagi’s belongings that he believes is connected to the bond between the Hans and the Miyagis and the idea of “two branches, one tree.” And then Li gets his ass kicked in the tournament and loses to Connor! Li beats Connor, and it being a Karate Kid movie, he does it using a special move he’d practiced earlier, of course.“Just kidding, Li beats Connor, and it being a Karate Kid movie, he does it using a special move he’d practiced earlier, of course - this one a fancy kick his late brother taught him, with an added second slide move suggested by Daniel, since Connor already has seen and countered that kick on its own in a previous skirmish the two had.Does Karate Kid: Legends Have a Mid- or Post-Credits Scene?As mentioned above, Karate Kid: Legends does have an additional scene – two, actually – though they appear almost immediately after the film appears to end, rather than true “mid-credits” scenes, since no credits actually run before they appear. After Li wins, Victor holds him up triumphantly to the cheering crowd and we get the traditional Karate Kid freeze frame on Li and then cut to the movie’s logo filling the screen… Except then, instead of the closing credits beginning, we get the two back-to-back scenes that actually wrap up the story. In the first scene, Victor is opening a new second location for his pizza place, with Li and Mia assisting. Han is there too alongside Li’s mom, though he mentions he will be returning to China soon, while Li says something about a pizza delivery to a notably far address. William Zabka (center) does show up as Johnny Lawrence in the "mid-credits" scene!We then cut to Los Angeles and a knock at the door of Mr. Miyagi’s home. Daniel answers and is confused to see it’s a pizza, saying he didn’t order one. However, when he opens the box, alongside the pizza (which we only glimpse, but it does appear to be freeze-dried, thankfully) is a note from Li, thanking Daniel for his help. Daniel walks inside with the pizza and up to… Johnny Lawrence! Yes, William Zabka does make a cameo in this movie as Johnny, in the one moment at my press screening of Karate Kid: Legends that got a big cheer from the crowd. The scene is an amusing comedic one, as Johnny first mocks the New York pizza Daniel received, insisting the best pizza is in the Valley’s own Encino. He then suggests to Daniel they open their own pizza place, which he has the perfect name for - Miyagi-Dough. An exasperated Daniel tells Johnny that’s offensive and walks off as Johnny begins brainstorming slogans like “Slice hard, slice fast.”So Is That It for Cobra Kai Connections in Karate Kid: Legends? Pretty much. And obviously the Johnny appearance is not an “important” scene, in that it doesn’t overtly set up anything for the future (unless we get a Miyagi-Dough Netflix series), but it does acknowledge Cobra Kai for the first time in the film. Prior to that, at no point does Daniel mention his wife or kids or that he runs a car dealership and an active dojo or really anything about the characters and events from the series, who we can presume are all simply living their lives off screen. But Johnny finally showing up, as Daniel’s pal, does at least let us know they are reinforcing where the show left off as far as where Daniel is in his life. If you’re searching for possible connections beyond that, there are a couple of slight/tenuous ones. When Li is explaining how vicious Connor fights, they end up describing him like he’s a tiger, with Daniel suggesting they just need to bait him. He mentions having fought opponents like that before, though it’s up to the viewer to determine if he means Johnny, Chozen, Mike Barnes, Kreese, Terry Silver, some combination of those guys, or someone else entirely. Then there’s the headband that Daniel says he found among Miyagi’s belongings. Was this something Daniel has had in his possession since Miyagi died or did he find it more recently? The final season of Cobra Kai had Daniel discover a trunk Miyagi had hidden away, containing artifacts from his past, including his headband from the brutal Sekai Taikai tournament. Was this second headband in there too and we just didn’t see it on the show or did Daniel already have it? That’s probably not a question we’ll ever get an answer to on screen, so the answer may be whichever you’d like it to be.But what did you think of Legends? Let’s discuss in the comments!

Cyber threats don't show up one at a time anymore. They're layered, planned, and often stay hidden until it's too late. For cybersecurity teams, the key isn't just reacting to alerts—it's spotting early signs of trouble before they become real threats. This update is designed to deliver clear, accurate insights based on real patterns and changes we can verify. With today's complex systems, we need focused analysis—not noise. What you'll see here isn't just a list of incidents, but a clear look at where control is being gained, lost, or quietly tested. ⚡ Threat of the Week Lumma Stealer, DanaBot Operations Disrupted — A coalition of private sector companies and law enforcement agencies have taken down the infrastructure associated with Lumma Stealer and DanaBot. Charges have also been unsealed against 16 individuals for their alleged involvement in the development and deployment of DanaBot. The malware is equipped to siphon data from victim computers, hijack banking sessions, and steal device information. More uniquely, though, DanaBot has also been used for hacking campaigns that appear to be linked to Russian state-sponsored interests. All of that makes DanaBot a particularly clear example of how commodity malware has been repurposed by Russian state hackers for their own goals. In tandem, about 2,300 domains that acted as the command-and-control (C2) backbone for the Lumma information stealer have been seized, alongside taking down 300 servers and neutralizing 650 domains that were used to launch ransomware attacks. The actions against international cybercrime in the past few days constituted the latest phase of Operation Endgame. Get the Guide ➝ 🔔 Top News Threat Actors Use TikTok Videos to Distribute Stealers — While ClickFix has become a popular social engineering tactic to deliver malware, threat actors have been observed using artificial intelligence (AI)-generated videos uploaded to TikTok to deceive users into running malicious commands on their systems and deploy malware like Vidar and StealC under the guise of activating pirated version of Windows, Microsoft Office, CapCut, and Spotify. "This campaign highlights how attackers are ready to weaponize whichever social media platforms are currently popular to distribute malware," Trend Micro said. APT28 Hackers Target Western Logistics and Tech Firms — Several cybersecurity and intelligence agencies from Australia, Europe, and the United States issued a joint alert warning of a state-sponsored campaign orchestrated by the Russian state-sponsored threat actor APT28 targeting Western logistics entities and technology companies since 2022. "This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors' wide scale targeting of IP cameras in Ukraine and bordering NATO nations," the agencies said. The attacks are designed to steal sensitive information and maintain long-term persistence on compromised hosts. Chinese Threat Actors Exploit Ivanti EPMM Flaws — The China-nexus cyber espionage group tracked as UNC5221 has been attributed to the exploitation of a pair of security flaws affecting Ivanti Endpoint Manager Mobile (EPMM) software (CVE-2025-4427 and CVE-2025-4428) to target a wide range of sectors across Europe, North America, and the Asia-Pacific region. The intrusions leverage the vulnerabilities to obtain a reverse shell and drop malicious payloads like KrustyLoader, which is known to deliver the Sliver command-and-control (C2) framework. "UNC5221 demonstrates a deep understanding of EPMM's internal architecture, repurposing legitimate system components for covert data exfiltration," EclecticIQ said. "Given EPMM's role in managing and pushing configurations to enterprise mobile devices, a successful exploitation could allow threat actors to remotely access, manipulate, or compromise thousands of managed devices across an organization." Over 100 Google Chrome Extensions Mimic Popular Tools — An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities such as DeepSeek, Manus, DeBank, FortiVPN, and Site Stats but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code. Links to these browser add-ons are hosted on specially crafted sites to which users are likely redirected to via phishing and social media posts. While the extensions appear to offer the advertised features, they also stealthily facilitate credential and cookie theft, session hijacking, ad injection, malicious redirects, traffic manipulation, and phishing via DOM manipulation. Several of these extensions have been taken down by Google. CISA Warns of SaaS Providers of Attacks Targeting Cloud Environments — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that SaaS companies are under threat from bad actors who are on the prowl for cloud applications with default configurations and elevated permissions. While the agency did not attribute the activity to a specific group, the advisory said enterprise backup platform Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment. "Threat actors may have accessed client secrets for Commvault's (Metallic) Microsoft 365 (M365) backup software-as-a-service (SaaS) solution, hosted in Azure," CISA said. "This provided the threat actors with unauthorized access to Commvault's customers' M365 environments that have application secrets stored by Commvault." GitLab AI Coding Assistant Flaws Could Be Used to Inject Malicious Code — Cybersecurity researchers have discovered an indirect prompt injection flaw in GitLab's artificial intelligence (AI) assistant Duo that could have allowed attackers to steal source code and inject untrusted HTML into its responses, which could then be used to direct victims to malicious websites. The attack could also leak confidential issue data, such as zero-day vulnerability details. All that's required is for the attacker to instruct the chatbot to interact with a merge request (or commit, issue, or source code) by taking advantage of the fact that GitLab Duo has extensive access to the platform. "By embedding hidden instructions in seemingly harmless project content, we were able to manipulate Duo's behavior, exfiltrate private source code, and demonstrate how AI responses can be leveraged for unintended and harmful outcomes," Legit Security said. One variation of the attack involved hiding a malicious instruction in an otherwise legitimate piece of source code, while another exploited Duo's parsing of markdown responses in real-time asynchronously. An attacker could leverage this behavior – that Duo begins rendering the output line by line rather than waiting until the entire response is generated and sending it all at once – to introduce malicious HTML code that can access sensitive data and exfiltrate the information to a remote server. The issues have been patched by GitLab following responsible disclosure. ‎️‍🔥 Trending CVEs Software vulnerabilities remain one of the simplest—and most effective—entry points for attackers. Each week uncovers new flaws, and even small delays in patching can escalate into serious security incidents. Staying ahead means acting fast. Below is this week's list of high-risk vulnerabilities that demand attention. Review them carefully, apply updates without delay, and close the doors before they're forced open. This week's list includes — CVE-2025-34025, CVE-2025-34026, CVE-2025-34027 (Versa Concerto), CVE-2025-30911 (RomethemeKit For Elementor WordPress plugin), CVE-2024-57273, CVE-2024-54780, and CVE-2024-54779 (pfSense), CVE-2025-41229 (VMware Cloud Foundation), CVE-2025-4322 (Motors WordPress theme), CVE-2025-47934 (OpenPGP.js), CVE-2025-30193 (PowerDNS), CVE-2025-0993 (GitLab), CVE-2025-36535 (AutomationDirect MB-Gateway), CVE-2025-47949 (Samlify), CVE-2025-40775 (BIND DNS), CVE-2025-20152 (Cisco Identity Services Engine), CVE-2025-4123 (Grafana), CVE-2025-5063 (Google Chrome), CVE-2025-37899 (Linux Kernel), CVE-2025-26817 (Netwrix Password Secure), CVE-2025-47947 (ModSecurity), CVE-2025-3078, CVE-2025-3079 (Canon Printers), and CVE-2025-4978 (NETGEAR). 📰 Around the Cyber World Sandworm Drops New Wiper in Ukraine — The Russia-aligned Sandworm group intensified destructive operations against Ukrainian energy companies, deploying a new wiper named ZEROLOT. "The infamous Sandworm group concentrated heavily on compromising Ukrainian energy infrastructure. In recent cases, it deployed the ZEROLOT wiper in Ukraine. For this, the attackers abused Active Directory Group Policy in the affected organizations," ESET Director of Threat Research, Jean-Ian Boutin, said. Another Russian hacking group, Gamaredon, remained the most prolific actor targeting the East European nation, enhancing malware obfuscation and introducing PteroBox, a file stealer leveraging Dropbox. Signal Says No to Recall — Signal has released a new version of its messaging app for Windows that, by default, blocks the ability of Windows to use Recall to periodically take screenshots of the app. "Although Microsoft made several adjustments over the past twelve months in response to critical feedback, the revamped version of Recall still places any content that's displayed within privacy-preserving apps like Signal at risk," Signal said. "As a result, we are enabling an extra layer of protection by default on Windows 11 in order to help maintain the security of Signal Desktop on that platform even though it introduces some usability trade-offs. Microsoft has simply given us no other option." Microsoft began officially rolling out Recall last month. Russia Introduces New Law to Track Foreigners Using Their Smartphones — The Russian government has introduced a new law that makes installing a tracking app mandatory for all foreign nationals in the Moscow region. This includes gathering their real-time locations, fingerprint, face photograph, and residential information. "The adopted mechanism will allow, using modern technologies, to strengthen control in the field of migration and will also contribute to reducing the number of violations and crimes in this area," Vyacheslav Volodin, chairman of the State Duma, said. "If migrants change their actual place of residence, they will be required to inform the Ministry of Internal Affairs (MVD) within three working days." A proposed four-year trial period begins on September 1, 2025, and runs until September 1, 2029. Dutch Government Passes Law to Criminalize Cyber Espionage — The Dutch government has approved a law criminalizing a wide range of espionage activities, including digital espionage, in an effort to protect national security, critical infrastructure, and high-quality technologies. Under the amended law, leaking sensitive information that is not classified as a state secret or engaging in activities on behalf of a foreign government that harm Dutch interests can also result in criminal charges. "Foreign governments are also interested in non-state-secret, sensitive information about a particular economic sector or about political decision-making," the government said. "Such information can be used to influence political processes, weaken the Dutch economy or play allies against each other. Espionage can also involve actions other than sharing information." Microsoft Announces Availability of Quantum-Resistant Algorithms to SymCrypt — Microsoft has revealed that it's making post-quantum cryptography (PQC) capabilities, including ML-KEM and ML-DSA, available for Windows Insiders, Canary Channel Build 27852 and higher, and Linux, SymCrypt-OpenSSL version 1.9.0. "This advancement will enable customers to commence their exploration and experimentation of PQC within their operational environments," Microsoft said. "By obtaining early access to PQC capabilities, organizations can proactively assess the compatibility, performance, and integration of these novel algorithms alongside their existing security infrastructure." New Malware DOUBLELOADER Uses ALCATRAZ for Obfuscation — The open-source obfuscator ALCATRAZ has been seen within a new generic loader dubbed DOUBLELOADER, which has been deployed alongside Rhadamanthys Stealer infections starting December 2024. The malware collects host information, requests an updated version of itself, and starts beaconing to a hardcoded IP address (185.147.125[.]81) stored within the binary. "Obfuscators such as ALCATRAZ end up increasing the complexity when triaging malware," Elastic Security Labs said. "Its main goal is to hinder binary analysis tools and increase the time of the reverse engineering process through different techniques; such as hiding the control flow or making decompilation hard to follow." New Formjacking Campaign Targets WooCommerce Sites — Cybersecurity researchers have detected a sophisticated formjacking campaign targeting WooCommerce sites. The malware, per Wordfence, injects a fake but professional-looking payment form into legitimate checkout processes and exfiltrates sensitive customer data to an external server. Further analysis has revealed that the infection likely originated from a compromised WordPress admin account, which was used to inject malicious JavaScript via a Simple Custom CSS and JS plugin (or something similar) that allows administrators to add custom code. "Unlike traditional card skimmers that simply overlay existing forms, this variant carefully integrates with the WooCommerce site's design and payment workflow, making it particularly difficult for site owners and users to detect," the WordPress security company said. "The malware author repurposed the browser's localStorage mechanism – typically used by websites to remember user preferences – to silently store stolen data and maintain access even after page reloads or when navigating away from the checkout page." E.U. Sanctions Stark Industries — The European Union (E.U.) has announced sanctions against 21 individuals and six entities in Russia over its "destabilising actions" in the region. One of the sanctioned entities is Stark Industries, a bulletproof hosting provider that has been accused of acting as "enablers of various Russian state-sponsored and affiliated actors to conduct destabilising activities including, information manipulation interference and cyber attacks against the Union and third countries." The sanctions also target its CEO Iurie Neculiti and owner Ivan Neculiti. Stark Industries was previously spotlighted by independent cybersecurity journalist Brian Krebs, detailing its use in DDoS attacks in Ukraine and across Europe. In August 2024, Team Cymru said it discovered 25 Stark-assigned IP addresses used to host domains associated with FIN7 activities and that it had been working with Stark Industries for several months to identify and reduce abuse of their systems. The sanctions have also targeted Kremlin-backed manufacturers of drones and radio communication equipment used by the Russian military, as well as those involved in GPS signal jamming in Baltic states and disrupting civil aviation. The Mask APT Unmasked as Tied to the Spanish Government — The mysterious threat actor known as The Mask (aka Careto) has been identified as run by the Spanish government, according to a report published by TechCrunch, citing people who worked at Kaspersky at the time and had knowledge of the investigation. The Russian cybersecurity company first exposed the hacking group in 2014, linking it to highly sophisticated attacks since at least 2007 targeting high-profile organizations, such as governments, diplomatic entities, and research institutions. A majority of the group's attacks have targeted Cuba, followed by hundreds of victims in Brazil, Morocco, Spain, and Gibraltar. While Kaspersky has not publicly attributed it to a specific country, the latest revelation makes The Mask one of the few Western government hacking groups that has ever been discussed in public. This includes the Equation Group, the Lamberts (the U.S.), and Animal Farm (France). Social Engineering Scams Target Coinbase Users — Earlier this month, cryptocurrency exchange Coinbase revealed that it was the victim of a malicious attack perpetrated by unknown threat actors to breach its systems by bribing customer support agents in India and siphon funds from nearly 70,000 customers. According to Blockchain security firm SlowMist, Coinbase users have been the target of social engineering scams since the start of the year, bombarding with SMS messages claiming to be fake withdrawal requests and seeking their confirmation as part of a "sustained and organized scam campaign." The goal is to induce a false sense of urgency and trick them into calling a number, eventually convincing them to transfer the funds to a secure wallet with a seed phrase pre-generated by the attackers and ultimately drain the assets. It's assessed that the activities are primarily carried out by two groups: low-level skid attackers from the Com community and organized cybercrime groups based in India. "Using spoofed PBX phone systems, scammers impersonate Coinbase support and claim there's been 'unauthorized access' or 'suspicious withdrawals' on the user's account," SlowMist said. "They create a sense of urgency, then follow up with phishing emails or texts containing fake ticket numbers or 'recovery links.'" Delta Can Sue CrowdStrike Over July 2024 Mega Outage — Delta Air Lines, which had its systems crippled and almost 7,000 flights canceled in the wake of a massive outage caused by a faulty update issued by CrowdStrike in mid-July 2024, has been given the green light to pursue to its lawsuit against the cybersecurity company. A judge in the U.S. state of Georgia stating Delta can try to prove that CrowdStrike was grossly negligent by pushing a defective update to its Falcon software to customers. The update crashed 8.5 million Windows devices across the world. Crowdstrike previously claimed that the airline had rejected technical support offers both from itself and Microsoft. In a statement shared with Reuters, lawyers representing CrowdStrike said they were "confident the judge will find Delta's case has no merit, or will limit damages to the 'single-digit millions of dollars' under Georgia law." The development comes months after MGM Resorts International agreed to pay $45 million to settle multiple class-action lawsuits related to a data breach in 2019 and a ransomware attack the company experienced in 2023. Storm-1516 Uses AI-Generated Media to Spread Disinformation — The Russian influence operation known as Storm-1516 (aka CopyCop) sought to spread narratives that undermined the European support for Ukraine by amplifying fabricated stories on X about European leaders using drugs while traveling by train to Kyiv for peace talks. One of the posts was subsequently shared by Russian state media and Maria Zakharova, a senior official in Russia's foreign ministry, as part of what has been described as a coordinated disinformation campaign by EclecticIQ. The activity is also notable for the use of synthetic content depicting French President Emmanuel Macron, U.K. Labour Party leader Keir Starmer, and German chancellor Friedrich Merz of drug possession during their return from Ukraine. "By attacking the reputation of these leaders, the campaign likely aimed to turn their own voters against them, using influence operations (IO) to reduce public support for Ukraine by discrediting the politicians who back it," the Dutch threat intelligence firm said. Turkish Users Targeted by DBatLoader — AhnLab has disclosed details of a malware campaign that's distributing a malware loader called DBatLoader (aka ModiLoader) via banking-themed banking emails, which then acts as a conduit to deliver SnakeKeylogger, an information stealer developed in .NET. "The DBatLoader malware distributed through phishing emails has the cunning behavior of exploiting normal processes (easinvoker.exe, loader.exe) through techniques such as DLL side-loading and injection for most of its behaviors, and it also utilizes normal processes (cmd.exe, powershell.exe, esentutl.exe, extrac32.exe) for behaviors such as file copying and changing policies," the company said. SEC SIM-Swapper Sentenced to 14 Months for SEC X Account Hack — A 26-year-old Alabama man, Eric Council Jr., has been sentenced to 14 months in prison and three years of supervised release for using SIM swapping attacks to breach the U.S. Securities and Exchange Commission's (SEC) official X account in January 2024 and falsely announced that the SEC approved Bitcoin (BTC) Exchange Traded Funds (ETFs). Council Jr. (aka Ronin, Agiantschnauzer, and @EasyMunny) was arrested in October 2024 and pleaded guilty to the crime earlier this February. He has also been ordered to forfeit $50,000. According to court documents, Council used his personal computer to search incriminating phrases such as "SECGOV hack," "telegram sim swap," "how can I know for sure if I am being investigated by the FBI," "What are the signs that you are under investigation by law enforcement or the FBI even if you have not been contacted by them," "what are some signs that the FBI is after you," "Verizon store list," "federal identity theft statute," and "how long does it take to delete telegram account." FBI Warns of Malicious Campaign Impersonating Government Officials — The U.S. Federal Bureau of Investigation (FBI) is warning of a new campaign that involves malicious actors impersonating senior U.S. federal or state government officials and their contacts to target individuals since April 2025. "The malicious actors have sent text messages and AI-generated voice messages — techniques known as smishing and vishing, respectively — that claim to come from a senior US official in an effort to establish rapport before gaining access to personal accounts," the FBI said. "One way the actors gain such access is by sending targeted individuals a malicious link under the guise of transitioning to a separate messaging platform." From there, the actor may present malware or introduce hyperlinks that lead intended targets to an actor-controlled site that steals login information. DICOM Flaw Enables Attackers to Embed Malicious Code Within Medical Image Files — Praetorian has released a proof-of-concept (PoC) for a high-severity security flaw in Digital Imaging and Communications in Medicine (DICOM), predominant file format for medical images, that enables attackers to embed malicious code within legitimate medical image files. CVE-2019-11687 (CVSS score: 7.8), originally disclosed in 2019 by Markel Picado Ortiz, stems from a design decision that allows arbitrary content at the start of the file, otherwise called the Preamble, which enables the creation of malicious polyglots. Codenamed ELFDICOM, the PoC extends the attack surface to Linux environments, making it a much more potent threat. As mitigations, it's advised to implement a DICOM preamble whitelist. "DICOM's file structure inherently allows arbitrary bytes at the beginning of the file, where Linux and most operating systems will look for magic bytes," Praetorian researcher Ryan Hennessee said. "[The whitelist] would check a DICOM file's preamble before it is imported into the system. This would allow known good patterns, such as 'TIFF' magic bytes, or '\x00' null bytes, while files with the ELF magic bytes would be blocked." Cookie-Bite Attack Uses Chrome Extension to Steal Session Tokens — Cybersecurity researchers have demonstrated a new attack technique called Cookie-Bite that employs custom-made malicious browser extensions to steal "ESTAUTH" and "ESTSAUTHPERSISTNT" cookies in Microsoft Azure Entra ID and bypass multi-factor authentication (MFA). The attack has multiple moving parts to it: A custom Chrome extension that monitors authentication events and captures cookies; a PowerShell script that automates the extension deployment and ensures persistence; an exfiltration mechanism to send the cookies to a remote collection point; and a complementary extension to inject the captured cookies into the attacker's browser. "Threat actors often use infostealers to extract authentication tokens directly from a victim's machine or buy them directly through darkness markets, allowing adversaries to hijack active cloud sessions without triggering MFA," Varonis said. "By injecting these cookies while mimicking the victim's OS, browser, and network, attackers can evade Conditional Access Policies (CAPs) and maintain persistent access." Authentication cookies can also be stolen using adversary-in-the-middle (AitM) phishing kits in real-time, or using rogue browser extensions that request excessive permissions to interact with web sessions, modify page content, and extract stored authentication data. Once installed, the extension can access the browser's storage API, intercept network requests, or inject malicious JavaScript into active sessions to harvest real-time session cookies. "By leveraging stolen session cookies, an adversary can bypass authentication mechanisms, gaining seamless entry into cloud environments without requiring user credentials," Varonis said. "Beyond initial access, session hijacking can facilitate lateral movement across the tenant, allowing attackers to explore additional resources, access sensitive data, and escalate privileges by abusing existing permissions or misconfigured roles." 🎥 Cybersecurity Webinars Non-Human Identities: The AI Backdoor You're Not Watching → AI agents rely on Non-Human Identities (like service accounts and API keys) to function—but these are often left untracked and unsecured. As attackers shift focus to this hidden layer, the risk is growing fast. In this session, you'll learn how to find, secure, and monitor these identities before they're exploited. Join the webinar to understand the real risks behind AI adoption—and how to stay ahead. Inside the LOTS Playbook: How Hackers Stay Undetected → Attackers are using trusted sites to stay hidden. In this webinar, Zscaler experts share how they detect these stealthy LOTS attacks using insights from the world's largest security cloud. Join to learn how to spot hidden threats and improve your defense. 🔧 Cybersecurity Tools ScriptSentry → It is a free tool that scans your environment for dangerous logon script misconfigurations—like plaintext credentials, insecure file/share permissions, and references to non-existent servers. These overlooked issues can enable lateral movement, privilege escalation, or even credential theft. ScriptSentry helps you quickly identify and fix them across large Active Directory environments. Aftermath → It is a Swift-based, open-source tool for macOS incident response. It collects forensic data—like logs, browser activity, and process info—from compromised systems, then analyzes it to build timelines and track infection paths. Deploy via MDM or run manually. Fast, lightweight, and ideal for post-incident investigation. AI Red Teaming Playground Labs → It is an open-source training suite with hands-on challenges designed to teach security professionals how to red team AI systems. Originally developed for Black Hat USA 2024, the labs cover prompt injections, safety bypasses, indirect attacks, and Responsible AI failures. Built on Chat Copilot and deployable via Docker, it's a practical resource for testing and understanding real-world AI vulnerabilities. 🔒 Tip of the Week Review and Revoke Old OAuth App Permissions — They're Silent Backdoor → You've likely logged into apps using "Continue with Google," "Sign in with Microsoft," or GitHub/Twitter/Facebook logins. That's OAuth. But did you know many of those apps still have access to your data long after you stop using them? Why it matters: Even if you delete the app or forget it existed, it might still have ongoing access to your calendar, email, cloud files, or contact list — no password needed. If that third-party gets breached, your data is at risk. What to do: Go through your connected apps here: Google: myaccount.google.com/permissions Microsoft: account.live.com/consent/Manage GitHub: github.com/settings/applications Facebook: facebook.com/settings?tab=applications Revoke anything you don't actively use. It's a fast, silent cleanup — and it closes doors you didn't know were open. Conclusion Looking ahead, it's not just about tracking threats—it's about understanding what they reveal. Every tactic used, every system tested, points to deeper issues in how trust, access, and visibility are managed. As attackers adapt quickly, defenders need sharper awareness and faster response loops. The takeaways from this week aren't just technical—they speak to how teams prioritize risk, design safeguards, and make choices under pressure. Use these insights not just to react, but to rethink what "secure" really needs to mean in today's environment. Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.