Signal Check

This episode covers a critical Linux kernel flaw that gives unprivileged users full root access across billions of devices, a clever macOS credential stealer disguising itself as legitimate software, and the takedown of a massive residential proxy network that secretly compromised two million Android devices. Adrian North walks through the early morning signals that matter before the weekend noise kicks in. It's a quick Saturday security briefing for anyone who needs to know what's actively threatening systems right now.

Stories covered:

- New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android (The Hacker News) - https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html

- PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords (The Hacker News) - https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html

- NetNut proxy network disrupted, 2 million infected devices cut off (BleepingComputer) - https://www.bleepingcomputer.com/news/security/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off/

- Basing Your Weekly Mileage on Your Race Distance? One Coach Explains Why That’s the Wrong Tactic—and the Real Factors to Consider. (Runner's World) - https://www.runnersworld.com/training/a71806426/race-distance-weekly-mileage/

- Africans Are Turning to Starlink (Hacker News) - https://www.economist.com/middle-east-and-africa/2026/07/02/africans-are-turning-to-starlink

- Vincent Bouillard and Jenn Lichter Win 2026 Western States 100 (Trail Runner Mag) - https://www.trailrunnermag.com/people/news/2026-western-states-100-live-updates-results/

This episode digs into ransomware crews deploying multi-vector attacks through Citrix vulnerabilities and stolen Fortinet credentials, plus a CISA warning on an actively exploited SharePoint flaw. We also cover the Tesla bug bounty that somehow escalated into a $243 million lesson, and why elite athletes aren't just better at training—they're better at everything around it.

Stories covered:

- Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials (The Hacker News) - https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html

- FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations (The Hacker News) - https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html

- CISA: Microsoft SharePoint RCE flaw now actively exploited (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-microsoft-sharepoint-rce-flaw-now-actively-exploited/

- Tesla paid a Russian hacker $15,000 per bug found — then he cracked open the case that cost them $243 million - Yahoo Finance (Yahoo Finance) - https://news.google.com/rss/articles/CBMilwFBVV95cUxOdnNiS0VBcTZqY3NOVzRjYXFLejRpeDYzRmpCV3J6QUlnRXhjVU80VHh6MXZnYV9pZVhmY0x6X21QcHUzanp5RW1kTkxTLUlMWHFXSGNLWWZiS0ZmZFI0ekpLWk1OczlOTXpCNTF5ZDVrMWwwN196bUFpRFVKNWg0STR6bkNUTlJoQzN4ZnNyNE9idUtHdkxn?oc=5

- A Run Coach to the Pros Reveals the Habits That Separate Elites. Here’s How They Can Transform Your Next Training Cycle. (Runner's World) - https://www.runnersworld.com/training/a71785588/pro-runner-training-tips/

- Virginia bans sale of geolocation data (Hacker News) - https://www.hunton.com/privacy-and-cybersecurity-law-blog/virginia-bans-sale-of-geolocation-data

This episode covers AI-generated malware that's raising alarms among cybersecurity researchers, a teenage hacker's extradition in the Scattered Spider case, and record-breaking performances at the Western States 100 ultramarathon. Adrian North walks through six signals from the tech and culture landscape before your workday demands attention. It's your early-morning dose of what's moving through the network right now.

Stories covered:

- AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android (The Hacker News) - https://thehackernews.com/2026/07/ai-generated-browser-ransomware-abuses.html

- 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges (The Hacker News) - https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html

- Vincent Bouillard and Jenn Lichter Win 2026 Western States 100 (Trail Runner Mag) - https://www.trailrunnermag.com/people/news/2026-western-states-100-live-updates-results/

- The Training Plan That Takes You From Walking to Your First Marathon (Runner's World) - https://www.runnersworld.com/training/a71787211/24-week-zero-to-marathon-training-plan/

- A space history mystery: What happened to the Viking arm used 50 years ago? (Ars Technica) - https://arstechnica.com/space/2026/07/50-years-on-will-the-mars-lander-arm-that-opened-the-air-and-space-raise-its-hand/

- New ChocoPoC malware targets researchers via trojanized PoC exploits (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/

This episode digs into a shocking security study revealing that nearly two-thirds of AI chatbot apps on iPhone are leaking user credentials and API keys in plain sight. We also cover RustDuck, a dangerous new botnet targeting home routers and cameras, plus the latest Kali Linux release packed with fresh penetration testing tools.

Stories covered:

- 282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study (The Hacker News) - https://thehackernews.com/2026/06/282-ios-apps-found-leaking-llm-api-keys.html

- RustDuck Botnet Rebuilds in Rust to Hijack Routers and Servers for DDoS (The Hacker News) - https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html

- Kali Linux 2026.2 released with 9 new tools, NetHunter updates (BleepingComputer) - https://www.bleepingcomputer.com/news/linux/kali-linux-20262-released-with-9-new-tools-nethunter-updates/

- ‘I Still Have a Lot to Learn’: Despite Chafing and a Hypothermia Scare, Molly Seidel Finished Western States (Runner's World) - https://www.runnersworld.com/news/a71772906/molly-seidel-ws100/

- EFF to Grindr: This Pride Month, Put Safety and Privacy Over Profits (EFF) - https://www.eff.org/deeplinks/2026/06/grindr-put-queer-safety-and-privacy-over-profits

- Victory! Supreme Court Says Constitution Protects People’s Location Data (EFF) - https://www.eff.org/deeplinks/2026/06/victory-supreme-court-says-constitution-protects-peoples-location-data

This episode covers a major Microsoft Edge extension purge, a sneaky supply chain attack using VS Code automation, and a new Linux privilege escalation exploit called pedit COW. Adrian also highlights an incredible ultrarunning performance at Western States before the day's chaos takes over.

Stories covered:

- Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts (The Hacker News) - https://thehackernews.com/2026/06/microsoft-removes-119-edge-extensions.html

- Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer (The Hacker News) - https://thehackernews.com/2026/06/hijacked-npm-and-go-packages-use-vs.html

- New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries - The Hacker News (The Hacker News) - https://news.google.com/rss/articles/CBMif0FVX3lxTE9OUEtDRmFFUFFmRk5qUGtuUklzQ0xkYTVWWXhadEY5YUxrUDN0c1B3bWptTzRYSi1uZGNPT2dGTFItVUFaS1I0TUZPSWZqTFVwRnV1cXpxZ3pkTHVDRmg0RmxTWldjdmUyVG5aSWlDUEt5TUtTZzB2aEpiWWhHSDg?oc=5

- This Week In Running: June 29, 2026 (iRunFar) - https://www.irunfar.com/this-week-in-running-june-29-2026

- In major privacy win, Supreme Court rules geofence warrants are protected by privacy rights (TechCrunch) - https://techcrunch.com/2026/06/29/in-major-privacy-win-supreme-court-rules-geofence-warrants-are-protected-by-privacy-rights/

- In Her First 100-Miler, Jennifer Lichter Wins Western States and Takes Down Courtney Dauwalter’s Course Record (Runner's World) - https://www.runnersworld.com/news/a71760742/jennifer-lichter-wins-western-states-2026/

This episode digs into three emerging threats targeting the tools developers and security-conscious users rely on most. We cover a sophisticated npm supply chain attack infiltrating GitHub Actions, a Russian phishing campaign hunting Signal backup keys, and a chilling new exploit that weaponizes AI coding agents through hidden instructions. The common thread? Trust is the new attack surface.

Stories covered:

- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack (The Hacker News) - https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html

- FBI: Russian hackers now target Signal backup recovery keys (BleepingComputer) - https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/

- Clean GitHub repo tricks AI coding agents into running malware (BleepingComputer) - https://www.bleepingcomputer.com/news/security/clean-github-repo-tricks-ai-coding-agents-into-running-malware/

- Librepods: AirPods liberated (Hacker News) - https://github.com/librepods-org/librepods

- What Western States 100 Training Data Reveals About How to Maintain Performance Late in a Race (Runner's World) - https://www.runnersworld.com/training/a71617479/western-states-training-data/

- What to Do in Houston If You're Here for Business (2026) (Wired) - https://www.wired.com/story/the-wired-guide-to-houston-for-business-travelers/

This episode covers the quiet but critical signals from a Sunday morning in late June, including a new framework to help companies manage aging open-source projects before they become security nightmares. We dig into a Russian phishing campaign targeting Signal backup keys, an anonymous GitHub account dropping zero-day exploits into the wild, and why even the most secure tools fail when human trust gets weaponized.

Stories covered:

- New Initiative Tackles Security for End-of-Life Open Source Software (Dark Reading) - https://www.darkreading.com/application-security/initiative-tackles-security-end-of-life-open-source

- FBI: Russian hackers now target Signal backup recovery keys (BleepingComputer) - https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/

- Anonymous GitHub account mass-dropping undisclosed 0-days (Hacker News) - https://github.com/bikini/exploitarium

- Older Runners Have Reshaped College Track and Cross Country. A New Age-Based Rule Could Change That (Runner's World) - https://www.runnersworld.com/news/a71732214/ncaa-eligibility-rule-track-cross-country/

- EFF to Grindr: This Pride Month, Put Safety and Privacy Over Profits (EFF) - https://www.eff.org/deeplinks/2026/06/grindr-put-queer-safety-and-privacy-over-profits

- Canadian hacker Aubrey Cottle sentenced to 18 months custody after pleading guilty to cyberattack charges - The Globe and Mail (The Globe and Mail) - https://news.google.com/rss/articles/CBMilAFBVV95cUxOdEh0YlluSk5RT3M4aTZ1U0dMWVFDbUtoZ2lRaEFicE9SQmFaNlR5Uks5SFkwQ0pDazVWc2t6eE9vcGE1N2hSb2hJaVlBSWJMd3RFdHdsSjRuUGFXZDk2aGZpS2U3dkVyX0kycy1OeDcwTmRneFNtekpNdnFOdldaUkxaYWJXbTFNcUJmUE82cV9TNERB?oc=5

This episode digs into a Cisco SD-WAN zero-day exploit breakdown from Mandiant, a clever macOS malware strain that deceives AI analysis tools with fake error messages, and a former hacker now applying exploit-finding skills to solar energy collection. Adrian North walks through early-morning signals before the noise of the day takes over.

Stories covered:

- Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access (BleepingComputer) - https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/

- New macOS malware embeds fake errors to confuse AI analysis tools (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools/

- This former hacker saw the light—and now wants to collect all of it - Ars Technica (Ars Technica) - https://news.google.com/rss/articles/CBMirgFBVV95cUxNcUlQeG1mWTJSeC1MOFEwZjBKUHZxdFZxTnh6ZmN4UUhHMXBlYVd4SjZhRnoxSnpaRXFIUnotQnYzWThKR3pDWlRwZjNWVHRSZjNhN3pBLXFINHdfSWpjQWtkWE5fdjYxT3o3dXVzT0RlSm5oVUZNVVFWQ3JtXzFQZzh2cl8wYWZ0eXBFXzBrNWJFRnVKZVFCNC1BNVBpZ2ZfSlQxZFBYZnZuUXdGOFE?oc=5

- Fifty Years On, New York Honors the Five Who Took the NYC Marathon Out of Central Park (Marathon Handbook) - https://marathonhandbook.com/fifty-years-on-new-york-honors-the-five-who-took-the-nyc-marathon-out-of-central-park/

- An entire Herculaneum scroll has been read for the first time (Hacker News) - https://scrollprize.org/firstscroll

- Mother Nature has a Weird and Nasty Way of Welcoming You to the Trail - The Trek (The Trek) - https://news.google.com/rss/articles/CBMiqwFBVV95cUxOR2xiOWV3d2tIMGlaUVc4ODFVcGtoLWt3cElsSkZIMUdIRndzMHRPdG83UVk0bG0tRlNLZllIT3Ftc21FT1Njc3pmUVhDOEtjU29vdU1YRkJzd1pQb3cwZmowbm5sWTF5OWREZmlXUnV2dWNZZXVPQUU3WFpjSE1DQTBZNFpxQkxDZkgtU19TOUhVWDZSb0l2RnJFY3dxYlY2LVdJbkE1UXp1R00?oc=5

This episode digs into two actively exploited Cisco vulnerabilities that are making waves — including a zero-day that gave attackers root access to SD-WAN devices. We also cover a new website publicly shaming companies that still don't support passkeys, and a reformed hacker with an unexpected new mission.

Stories covered:

- Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access (BleepingComputer) - https://www.bleepingcomputer.com/news/security/mandiant-reveals-how-cisco-sd-wan-zero-day-attacks-gained-root-access/

- Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/

- New website names and shames companies that still don’t offer passkeys to users (TechCrunch) - https://techcrunch.com/2026/06/24/new-website-names-and-shames-companies-that-still-dont-offer-passkeys-to-users/

- This former hacker saw the light—and now wants to collect all of it - Ars Technica (Ars Technica) - https://news.google.com/rss/articles/CBMirgFBVV95cUxNcUlQeG1mWTJSeC1MOFEwZjBKUHZxdFZxTnh6ZmN4UUhHMXBlYVd4SjZhRnoxSnpaRXFIUnotQnYzWThKR3pDWlRwZjNWVHRSZjNhN3pBLXFINHdfSWpjQWtkWE5fdjYxT3o3dXVzT0RlSm5oVUZNVVFWQ3JtXzFQZzh2cl8wYWZ0eXBFXzBrNWJFRnVKZVFCNC1BNVBpZ2ZfSlQxZFBYZnZuUXdGOFE?oc=5

- There’s an IKEA Marathon Happening This Year—and You May Have to Self-Assemble Your Medal (Of Course) (Runner's World) - https://www.runnersworld.com/news/a71679229/ikea-marathon/

- Amateur Hacker Used Claude And OpenAI Agents To Hack 14 Companies - bgr.com (bgr.com) - https://news.google.com/rss/articles/CBMigAFBVV95cUxOUy1rd0FqTk1EcF9qaDNtSjg0OUpLR1ZXWTZlM1hRU2xockRCMTF6U1FMZTFDZEw2UUxJTFlnZUpsVlFsa0tLZkRSUTlMRWJKVjhpNmhKNnVGSkp0Z1pNSlRBRDNrN2NYQ083a1NpeFVIMXVZLTVUSWc5blFZNHlJNg?oc=5

This episode covers active exploitation of a Cisco Unified Communications flaw, LastPass confirming another breach through stolen OAuth tokens, and a former hacker who pivoted to solar energy. Adrian digs into why supply chain attacks are now the standard playbook and shares a Runner's World tip on avoiding long-run mistakes.

Stories covered:

- Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/

- LastPass confirms data breach in Klue supply chain attack (BleepingComputer) - https://www.bleepingcomputer.com/news/security/lastpass-confirms-data-breach-in-klue-supply-chain-attack/

- This former hacker saw the light—and now wants to collect all of it - Ars Technica (Ars Technica) - https://news.google.com/rss/articles/CBMirgFBVV95cUxNcUlQeG1mWTJSeC1MOFEwZjBKUHZxdFZxTnh6ZmN4UUhHMXBlYVd4SjZhRnoxSnpaRXFIUnotQnYzWThKR3pDWlRwZjNWVHRSZjNhN3pBLXFINHdfSWpjQWtkWE5fdjYxT3o3dXVzT0RlSm5oVUZNVVFWQ3JtXzFQZzh2cl8wYWZ0eXBFXzBrNWJFRnVKZVFCNC1BNVBpZ2ZfSlQxZFBYZnZuUXdGOFE?oc=5

- 8 Ways You’re Sabotaging Your Long Runs and How to Make Them Feel Easier (Runner's World) - https://www.runnersworld.com/training/a71682764/long-run-mistakes-runners/

- On Her Own Path: Lotti Brinks and the 2026 Western States 100 (iRunFar) - https://www.irunfar.com/on-her-own-path-lotti-brinks-and-the-2026-western-states-100

- The NO FAKES Act Could Silence Satire, Commentary, And News (EFF) - https://www.eff.org/deeplinks/2026/06/no-fakes-act-could-silence-satire-commentary-and-news