Signal Check

This episode digs into Canada's unprecedented move to remotely clean malware from citizens' devices without permission, Microsoft's attribution of the Mastra AI supply chain attack to North Korean hackers, and a newly published iPhone exploit that lives in hardware Apple can't patch. We also touch on why your best running mentor is probably the local coach who shows up at dawn, not the influencer with perfect splits.

Stories covered:

- Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices (The Hacker News) - https://thehackernews.com/2026/06/canadas-spy-agency-used-first-of-its.html

- Microsoft links Mastra AI supply chain attack to North Korean hackers (BleepingComputer) - https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/

- Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain (The Hacker News) - https://thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html

- Your Best Running Mentor Probably Isn’t Who You Think (Marathon Handbook) - https://marathonhandbook.com/your-best-running-mentor-probably-isnt-who-you-think/

- A newbie hacker used "vague, low-skill prompts" in Claude and Codex to breach 14 companies, and the AI Agents did all the legwork - TechRadar (TechRadar) - https://news.google.com/rss/articles/CBMi9wFBVV95cUxQN3dzMmhNd3Y5TzN6OGxsVEI0TEZnZTN2aFY1QkJ2NDZMZWhRZl9EWmI3TjN3RVE1WmlKRWxBd2VBRE9xVHg2VGdEdFJfZmhZTE9xdUxOT2Jid1NRQVQ2RkdlU19PcUJBSFVXVURtWE1fZ1RpVUxjNU93bWdiRjVtdElITDJPRkptcHVmcnQ0Z0k3NDNLMWRJWGV0UlNSN3NVejJoN0NBUldXQzQwOWZRY1RSWk93NkRDLXNQeUlhLTQwOUljR0oyejYtTXhmS2xHT1BNc1hpbHNoZ0hEY1VPLXVEczNUMlRuSGRPTmpsZDZnQjVoNm5r?oc=5

- Linux and Secure Boot certificate expiration (2025) (Hacker News) - https://lwn.net/Articles/1029767/

This episode digs into a CISA deadline for a critical Splunk vulnerability that's already being exploited in the wild, a North Korean supply chain attack that poisoned over 140 npm packages, and how a junior hacker used legitimate tools like Tailscale to maintain persistence after losing his primary command server. Adrian breaks down six stories that show how attackers are leveraging trust, timing, and creative tradecraft to stay ahead.

Stories covered:

- CISA: Splunk Enterprise flaw actively exploited, patch by Sunday (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-splunk-enterprise-flaw-actively-exploited-patch-by-sunday/

- Microsoft links Mastra AI supply chain attack to North Korean hackers (BleepingComputer) - https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/

- Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - The Hacker News (The Hacker News) - https://news.google.com/rss/articles/CBMie0FVX3lxTFBNOXBPUEVoeE5CZl82WmNsVTRUMGY0LVJlMXMxZ3NJYnNuV1Y0MlFRY2pReHl1b2UwWVVENTRBeURnVlFpRmh0eEFzNEJUYkNNZ2IyNlRGOFRsMWJ0aTk1aFhfQURpb2ptVlh2N0hnYktPb2dwNGVMTWNZQQ?oc=5

- I Hated Running in the Heat. This Training Switch Led Me to Love It—and Faster Times (Runner's World) - https://www.runnersworld.com/training/a71631076/benefits-track-workouts-in-heat/

- Catching Up With Jimmy Chin: Training for Everest, Time, and His Next Big Project (Climbing Magazine) - https://www.climbing.com/culture-climbing/catching-up-with-jimmy-chin-training-for-everest-time-and-his-next-big-project/

- A bold satellite rescue mission came together in record time, but will it work? (Ars Technica) - https://arstechnica.com/space/2026/06/a-bold-satellite-rescue-mission-came-together-in-record-time-but-will-it-work/

On today's Signal Check, Adrian digs into a North Korean supply chain attack that poisoned over 140 npm packages, an unpatchable iPhone exploit targeting Apple's SecureROM, and a scrappy hacker who kept his operation alive using Tailscale and SSH after losing his C2 server. Plus, millions in Brazil received a mysterious unauthorized emergency alert that nobody can quite explain yet.

Stories covered:

- Microsoft links Mastra AI supply chain attack to North Korean hackers (BleepingComputer) - https://www.bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/

- Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain (The Hacker News) - https://thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html

- Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - The Hacker News (The Hacker News) - https://news.google.com/rss/articles/CBMie0FVX3lxTFBNOXBPUEVoeE5CZl82WmNsVTRUMGY0LVJlMXMxZ3NJYnNuV1Y0MlFRY2pReHl1b2UwWVVENTRBeURnVlFpRmh0eEFzNEJUYkNNZ2IyNlRGOFRsMWJ0aTk1aFhfQURpb2ptVlh2N0hnYktPb2dwNGVMTWNZQQ?oc=5

- Unauthorized alert sent to cell phones across Brazil (Hacker News) - https://www.cnn.com/2026/06/20/americas/brazil-hackers-unauthorized-alert-latam

- What 50,000 Runners And 76 Studies Teach Us About Racing The NYC Marathon Smarter (Marathon Handbook) - https://marathonhandbook.com/what-50000-runners-and-76-studies-teach-us-about-racing-the-nyc-marathon-smarter/

- The Free and Open Web Is Under Attack at the IETF (EFF) - https://www.eff.org/deeplinks/2026/06/free-and-open-web-under-attack-ietf

This episode covers critical security patches for NGINX that can't wait until Monday, a messy OAuth breach at Klue that gave hackers direct access to Salesforce data, and an unpatchable exploit in millions of older iPhones that Apple can't fix with software. Adrian walks through what moved overnight and why it matters before the weekend noise kicks in.

Stories covered:

- F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution (The Hacker News) - https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html

- Klue OAuth breach victim list grows as Icarus hackers claim attack (BleepingComputer) - https://www.bleepingcomputer.com/news/security/klue-oauth-breach-victim-list-grows-as-icarus-hackers-claim-attack/

- Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain (The Hacker News) - https://thehackernews.com/2026/06/unpatchable-usbliter8-exploit-breaks.html

- I Faded During My First Two Races. This Simple Workout Helped Me Finish the Next One Strong—and Set a PR. (Runner's World) - https://www.runnersworld.com/training/a71631335/fartlek-training-race-stronger/

- A bold satellite rescue mission came together in record time, but will it work? (Ars Technica) - https://arstechnica.com/space/2026/06/a-bold-satellite-rescue-mission-came-together-in-record-time-but-will-it-work/

- The Free and Open Web Is Under Attack at the IETF (EFF) - https://www.eff.org/deeplinks/2026/06/free-and-open-web-under-attack-ietf

This episode digs into a patient cryptocurrency clipper campaign running since February, a French attacker who pivoted to legitimate remote tools when their server died, and why Salesforce integrations are becoming a serious supply chain risk. Adrian pulls signal from the noise before the day gets loud.

Stories covered:

- Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 (The Hacker News) - https://thehackernews.com/2026/06/microsoft-details-windows-clipper.html

- Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline (The Hacker News) - https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html

- Salesforce Data Thefts Continue via Klue App Compromise (Dark Reading) - https://www.darkreading.com/cyberattacks-data-breaches/salesforce-data-thefts-klue-app-compromise

- Shoulder and back exercises to improve your running mechanics (Canadian Running) - https://runningmagazine.ca/sections/training/shoulder-and-back-exercises-to-improve-your-running-mechanics/

- Launch HN: TesterArmy (YC P26) – Agents that test web and mobile apps (Hacker News) - https://tester.army

- ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm (Krebs on Security) - https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/

On today's Signal Check, Adrian North walks through six morning signals including the UK's controversial ID-based age verification law for social media, a sophisticated Android banking trojan called Rokarolla targeting hundreds of apps, and a French cyberattack that used legitimate IT tools to maintain persistent access. It's a sharp look at what moved overnight before the inbox explodes.

Stories covered:

- UK to require ID or face scan before you can make social media accounts (BleepingComputer) - https://www.bleepingcomputer.com/news/security/uk-to-require-id-or-face-scan-before-you-can-make-social-media-accounts/

- New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds (The Hacker News) - https://thehackernews.com/2026/06/new-rokarolla-android-malware-steals.html

- Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline (The Hacker News) - https://thehackernews.com/2026/06/junior-hacker-used-tailscale-and.html

- The Performance Booster That Could Help You Push Through Fatigue—If Your Stomach Can Handle It (Runner's World) - https://www.runnersworld.com/nutrition-weight-loss/a71606411/sodium-bicarbonate-runners-performance/

- European Champion Ciara Mageean Says She Will “Fit as Much Living” Into the Years She Has Left (Marathon Handbook) - https://marathonhandbook.com/european-champion-ciara-mageean-says-she-will-fit-as-much-living-into-the-years-she-has-left/

- The Free and Open Web Is Under Attack at the IETF (EFF) - https://www.eff.org/deeplinks/2026/06/free-and-open-web-under-attack-ietf

This episode digs into a powerful new Android banking trojan hitting over 200 apps, a federal warning about an actively exploited cPanel plugin, and a leaked membership list from Peter Thiel's ultra-exclusive Dialog retreat. Signal Check covers the threats already moving before your coffee gets cold.

Stories covered:

- New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds (The Hacker News) - https://thehackernews.com/2026/06/new-rokarolla-android-malware-steals.html

- Humiliating IIS servers for fun and jail time (Hacker News) - https://mll.sh/humiliating-iis-servers-for-fun-and-jail-time/

- CISA warns of another cPanel plugin flaw exploited in attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-warns-of-another-actively-exploited-cpanel-plugin-flaw/

- Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society (Wired) - https://www.wired.com/story/leak-exposes-members-of-peter-thiels-secretive-dialog-society/

- The 6 Best Toe Separators That Can Help Prevent Injury and Relieve Pain (Runner's World) - https://www.runnersworld.com/health-injuries/g40457572/best-toe-separators/

- Hacker: 'I Could Have Rickrolled the World Cup' - Bank Info Security (Bank Info Security) - https://news.google.com/rss/articles/CBMiiAFBVV95cUxNODd3SDVpTGV6ZGxCMU9HNS1ycjc3M0JnSDltYmJIOXZkQUEzSEtVTi1hZGVaVW1nc2J5MXJwTTZHZGxDeDBRd2lRd2U2YXd3b0U1UUpEOVd6RjdXRUxoSW01UEFOTk9Jbm1lV1Y0MnNGS2RUNFpFZWQ1Zzctd2t5M0VodlVSZm4w?oc=5

This episode digs into a cascade of high-value security breaches, from a three-vulnerability chain in AI gateway infrastructure to a one-click exploit in Microsoft 365 Copilot that exposed entire workspaces. We also cover a year-long Chinese espionage campaign that weaponized Google Workspace forwarding rules and a LinkedIn job scam that sparked hundreds of comments on Hacker News.

Stories covered:

- LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers (The Hacker News) - https://thehackernews.com/2026/06/litellm-vulnerability-chain-lets-low.html

- One-Click Microsoft 365 Copilot Flaw Could Have Let Attackers Steal Emails, Files, and MFA Codes (The Hacker News) - https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html

- Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails (The Hacker News) - https://thehackernews.com/2026/06/chinese-hackers-abused-google-workspace.html

- A backdoor in a LinkedIn job offer (Hacker News) - https://roman.pt/posts/linkedin-backdoor/

- Think Your Best Running Years Are Behind You at 50+? This Mileage Data Says Otherwise. (Runner's World) - https://www.runnersworld.com/training/a71591415/running-after-50-mileage-data/

- A New “Stairway to Heaven” Awaits Broken Arrow Runners This Week (Marathon Handbook) - https://marathonhandbook.com/a-new-stairway-to-heaven-awaits-broken-arrow-runners-this-week/

This episode covers six cybersecurity and tech stories from Monday morning, including a zero-day exploit in Oracle PeopleSoft by ShinyHunters, a massive AUR package compromise affecting Arch Linux users, and a CISA emergency directive on Ivanti Sentry. Adrian also digs into a fascinating DIY project where someone indexed 669 gigabytes of GoPro footage using local machine learning models.

Stories covered:

- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities (The Hacker News) - https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html

- Over 400 Arch Linux packages compromised to push rootkit, infostealer (BleepingComputer) - https://www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/

- CISA orders feds to patch actively exploited Ivanti flaw by Sunday (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-gives-feds-3-days-to-patch-ivanti-flaw-exploited-in-attacks/

- I indexed 669 GB of my GoPro videos using my M1 Max computer and local ML models (Hacker News) - https://news.ycombinator.com/item?id=48528029

- Are You Running More or Less Than Your Peers? New Data Shows the Average Distance by Age Group (Runner's World) - https://www.runnersworld.com/training/a71570890/average-run-distance-by-age/

- She Started Running at 65—and Just 3 Years Later Finished Her First Boston Marathon (Runner's World) - https://www.runnersworld.com/runners-stories/a71550469/sandra-cotterell-boston-marathon/

This episode covers a major supply chain attack on Arch Linux's AUR, a zero-day exploit in Oracle PeopleSoft used by the ShinyHunters crew to breach universities, and a few unexpected signals about endurance and starting late. Adrian breaks down the technical fallout from both incidents and reminds us that not every signal is a threat—some are just proof that it's never too late to begin. Grab your coffee and get the morning download before the day gets loud.

Stories covered:

- Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit (The Hacker News) - https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html

- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities (The Hacker News) - https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html

- Over 400 Arch Linux packages compromised to push rootkit, infostealer (BleepingComputer) - https://www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/

- She Started Running at 65—and Just 3 Years Later Finished Her First Boston Marathon (Runner's World) - https://www.runnersworld.com/runners-stories/a71550469/sandra-cotterell-boston-marathon/

- Intriguing Storylines and Predictions for the 2026 Western States 100 (iRunFar) - https://www.irunfar.com/intriguing-storylines-and-predictions-for-the-2026-western-states-100

- Chinese hackers hijack auth flow, spy on isolated network for a decade (BleepingComputer) - https://www.bleepingcomputer.com/news/security/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade/