Signal Check

This episode digs into a brutal week for security, starting with over 400 hijacked Arch Linux packages that installed credential stealers and rootkits. We also cover ShinyHunters exploiting a zero-day in Oracle PeopleSoft to hit universities, and an AI-powered cyber defense platform launching with serious funding and even bigger questions.

Stories covered:

- Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit (The Hacker News) - https://thehackernews.com/2026/06/over-400-arch-linux-aur-packages.html

- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities (The Hacker News) - https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html

- He Hacked Teslas For Elon Musk. Now He’s Launching A $100 Million AI Cyber Agent. - Forbes (Forbes) - https://news.google.com/rss/articles/CBMiuwFBVV95cUxPeEhOdFU0M2trc1E2Zko0d0pzX2lyQ2RNdExTcno4WWI5cGRHUThGeWQtR3locXZPREwtNkhkVG0yZ2lUQjNVVTJQM0VjVHd3U2k1WHp3S0dwMEc5YlNfN1ZBTll3cTJ2dm14ZWVHZjJ4eTJiWnRVazBJN3FvbU1MM2I1VHh5VlhLNnVROHJaNXR5eDA5UUE2dUVJU25HcU1ITFpZQnV0eUxTS0FxUmpRaVI4TkFrbWdDTEFB?oc=5

- Oracle mitigates PeopleSoft zero-day exploited in data theft attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/oracle-mitigates-peoplesoft-zero-day-exploited-in-data-theft-attacks/

- Intriguing Storylines and Predictions for the 2026 Western States 100 (iRunFar) - https://www.irunfar.com/intriguing-storylines-and-predictions-for-the-2026-western-states-100

- Man sues law enforcement alleging AI facial recognition technology led to wrongful arrest - ABC News - Breaking News, Latest News and Videos (ABC News - Breaking News, Latest News and Videos) - https://news.google.com/rss/articles/CBMipgFBVV95cUxNYkxZcmlfd3dZdHRKb0JGdUExZWVmRDlPYkNlczc0LWtfMnU1ektLaWt1a2JtTXRhOGVpYkJUOUJmdG9VXzJVdUxsMnR0UWNRYXdmUUtnQnR6QmhuQUNRc2NpcFQ1ZEZackU2UzJ6SU8wUndvZ1VWUjN0NS0yWVhTRGt5QjZCZmk2QjR0NHQzTmx4Z0Q5MVBEZjdPZDVkbDg2WkRyNDdB0gGrAUFVX3lxTE1ZaGdfR1NQVWZQQVRkXzZDc2tWcl9JVUV4clhPUzlvNUgxdWNyVDFuSkptWjVSWXp1aU5ZOGcxblpWX1JzMGtJalgzUFJhcS1VX2lWNy1fR0tOeGFJY3NnNDhEUGlRazZuT2ZYejdOWGpPOXJBcExnd1paMnhvZkppdjZWU2xCeU9VMk1DeWZiMVNONzdMdHlyOFNpRC01Sm1Zb0RzY2dEY0ROSQ?oc=5

This episode covers ShinyHunters exploiting an unpatched Oracle PeopleSoft vulnerability to breach universities, the leaked Miasma worm source code lowering the barrier for supply-chain attacks, and new research showing how AI agents like OpenClaw can be tricked into running malicious code through prompt injection. Adrian breaks down the week's critical signals before the weekend hits.

Stories covered:

- ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities (The Hacker News) - https://thehackernews.com/2026/06/shinyhunters-exploits-oracle-peoplesoft.html

- The ‘Miasma’ worm source code briefly leaked on GitHub (BleepingComputer) - https://www.bleepingcomputer.com/news/security/the-miasma-worm-source-code-briefly-leaked-on-github/

- New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets (The Hacker News) - https://thehackernews.com/2026/06/new-attacks-trick-openclaw-ai-agent.html

- Why You Have to Run SLOW to Race FAST (The Science of Easy Running) (Marathon Handbook) - https://marathonhandbook.com/why-you-have-to-run-slow-to-race-fast-the-science-of-easy-running/

- Everest 2026: Sherpas and Guides Call For Change (ExplorersWeb) - https://explorersweb.com/everest-2026-summary-sherpas-and-guides-call-for-change/

- Why You Might Already Own SpaceX Shares, Siri’s AI Makeover, and Knicks Owner’s Surveillance Machine (Wired) - https://www.wired.com/story/uncanny-valley-podcast-why-you-might-already-own-spacex-shares-siri-ai-makeover-knicks-owner-surveillance-machine/

This episode digs into a fresh Microsoft Defender zero-day granting full system access, a new SSD timing attack that tracks your browsing through hardware behavior, and the rise of The Gentlemen ransomware group building a professional cybercrime empire. Adrian breaks down why these aren't just bugs—they're fundamental shifts in how attacks work. Morning coffee required.

Stories covered:

- Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows (The Hacker News) - https://thehackernews.com/2026/06/microsoft-defender-rogueplanet-zero-day.html

- New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing - The Hacker News (The Hacker News) - https://news.google.com/rss/articles/CBMigAFBVV95cUxQcHJSUHJZODRwQVc2bUJwR3hGUWlwS1NYazduREVkWk1ScXNMVTd4c051Uk5TOUwtNk52RGh6QlVLZjhIR2ExZGpoWDJha0hIR193eC00WlNxaXhwZ1A5T0wxSlJKdC11d2JESldOcVpfSThBT3ZjWUpfTW15M3Z0cA?oc=5

- Who Runs the Ransomware Group ‘The Gentlemen?’ (Krebs on Security) - https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/

- This Adidas Trainer Was Our Best Overall Running Shoe, and It’s Just $105 Right Now (Runner's World) - https://www.runnersworld.com/gear/a71547463/adidas-adizero-evo-sl-sale-june-2026/

- China Opens World’s First Wind-Powered Underwater Data Center (Wired) - https://www.wired.com/story/china-opens-worlds-first-wind-powered-underwater-data-center/

- How JPL keeps the 13-year-old Curiosity rover doing science (Hacker News) - https://spectrum.ieee.org/curiosity-rover-jpl-mars-science

This episode covers a critical Check Point VPN flaw being actively exploited by ransomware groups, a wild new browser-based attack that uses your SSD to spy on your activity, and a must-patch Veeam vulnerability that lets any domain user compromise your backup infrastructure. Adrian also digs into surprising running science that shows walking breaks can actually make you faster. It's threat intel, hardware side-channels, and a dash of endurance strategy before your second cup of coffee.

Stories covered:

- CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/

- New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing (The Hacker News) - https://thehackernews.com/2026/06/new-frost-attack-lets-websites-track.html

- Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code (The Hacker News) - https://thehackernews.com/2026/06/veeam-backup-replication-rce-flaw-lets.html

- Walking Breaks Can Make You a Faster and Better Runner. We Can Prove It. (Runner's World) - https://www.runnersworld.com/training/a70690471/walking-break-can-make-you-faster/

- 4 Tactics and 14 Organizations to Support LGBTQ+ Climbers This Pride Month (Climbing Magazine) - https://www.climbing.com/culture-climbing/support-lgbtq-climbers-pride-month/

- COROS Watches Now Talk to AllTrails, Giving Trail Runners One Map for the Backcountry (Marathon Handbook) - https://marathonhandbook.com/coros-watches-now-talk-to-alltrails-giving-trail-runners-one-map-for-the-backcountry/

This episode covers emergency patches for a critical Check Point VPN zero-day that's been exploited by ransomware groups since early May, plus a Python supply-chain attack that compromised nineteen packages on PyPI. Adrian breaks down why patching isn't enough when attackers have already had weeks inside networks, and how developer trust becomes the vulnerability in these campaigns.

Stories covered:

- Check Point VPN Flaw Exploited Since Early May (Dark Reading) - https://www.darkreading.com/vulnerabilities-threats/check-point-vpn-flaw-exploited-early-may

- Check Point links VPN zero-day attacks to Qilin ransomware gang (BleepingComputer) - https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/

- New Shai-Hulud attack trojanizes 19 science-focused PyPI packages (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-shai-hulud-attack-trojanizes-19-science-focused-pypi-packages/

- UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign (The Hacker News) - https://thehackernews.com/2026/06/unc3753-used-vishing-and-physical.html

- ‘I’m a 75-Year-Old Grandmother of Six and Just Ran a 3:57 Marathon. This Is How I Train’ (Runner's World) - https://www.runnersworld.com/training/a71523801/penny-jarvis-runner/

- Surveillance Is Not Safety: A statement on the UK's latest threat to privacy [pdf] (Hacker News) - https://signal.org/blog/pdfs/2026-06-08-uk-surveillance-is-not-safety.pdf

This episode digs into the worst security breaches of 2026 so far, from compromised critical infrastructure to a hacked FBI surveillance system. Adrian also covers World Cup scammers flooding the web with fake ticket sites and a freshly exploited SolarWinds vulnerability causing server crashes across government and enterprise networks.

Stories covered:

- Hacked, leaked, and held for ransom: the worst breaches of 2026 so far (TechCrunch) - https://techcrunch.com/2026/06/07/the-worst-hacks-and-breaches-of-2026-so-far/

- FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins (The Hacker News) - https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html

- CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/

- Cisco warns of unpatched SD-WAN zero-day exploited in attacks (BleepingComputer) - https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/

- This High School Star Just Ran the 3rd Fastest Prep Mile Ever—and Even Beat the Pros (Runner's World) - https://www.runnersworld.com/news/a71508401/ellery-lincoln-hoka-festival-of-miles/

- Rory Linkletter Trades the Road for His Trail Running Debut (Marathon Handbook) - https://marathonhandbook.com/rory-linkletter-trades-the-road-for-a-mountain/

This episode digs into Arabic-targeted Android spyware disguised as news apps, a massive npm supply chain attack distributing Rust-based malware to developers, and how hackers reportedly hijacked high-profile Instagram accounts using Meta's own AI support bot. Adrian North walks through the weekend's most critical signals before the world fully wakes up. It's your Sunday morning threat briefing with coffee in hand.

Stories covered:

- Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps (The Hacker News) - https://thehackernews.com/2026/06/android-spyware-asin-targets-arabic.html

- IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks (The Hacker News) - https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html

- Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts (Krebs on Security) - https://krebsonsecurity.com/2026/06/hackers-used-metas-ai-support-bot-to-seize-instagram-accounts/

- This High School Star Just Ran the 3rd Fastest Prep Mile Ever—and Even Beat the Pros (Runner's World) - https://www.runnersworld.com/news/a71508401/ellery-lincoln-hoka-festival-of-miles/

- What to Do if Your Trail Dog is Obsessed With Wildlife (Trail Runner Mag) - https://www.trailrunnermag.com/people/culture-people/what-to-do-if-your-trail-dog-is-obsessed-with-wildlife/

- Pentagon raised threat of Israeli spying on U.S. to highest level, sources say (Hacker News) - https://www.nbcnews.com/politics/national-security/pentagon-raised-threat-israeli-spying-us-highest-level-sources-say-rcna348565

This episode covers six critical cybersecurity signals, from World Cup scam operations already in overdrive to the disturbing rise of in-person social engineering attacks where ransomware crews literally walk into offices. Adrian unpacks why the browser has become the new security perimeter and what that means for anyone who thinks their defenses are still holding.

Stories covered:

- FIFA World Cup 2026 Scams Are Already Live: Fake Sites, Banking Malware, and Stolen Logins (The Hacker News) - https://thehackernews.com/2026/06/fifa-world-cup-2026-scams-are-already.html

- What 2026 DBIR Confirms: Attacks Are Living in the Browser (BleepingComputer) - https://www.bleepingcomputer.com/news/security/what-2026-dbir-confirms-attacks-are-living-in-the-browser/

- Google and FBI warn of ransomware group that sends fake IT workers to hack victims in person (TechCrunch) - https://techcrunch.com/2026/06/05/google-and-fbi-warn-of-ransomware-group-that-sends-fake-it-workers-to-hack-victims-in-person/

- Best Running Shoes, Tested and Reviewed (2026): Saucony, Adidas, Hoka (Wired) - https://www.wired.com/gallery/best-running-shoes/

- pg_durable: Microsoft open sources in-database durable execution (Hacker News) - https://github.com/microsoft/pg_durable

- The saga of the International Space Station air leak took a worrying turn Friday (Ars Technica) - https://arstechnica.com/space/2026/06/work-on-russias-leaky-space-station-module-causes-astronauts-to-take-shelter/

This episode covers a critical Cisco vulnerability that grants attackers root access without credentials, AI-powered tools now hunting bugs faster than humans, and underground tutorials industrializing cybercrime for beginners. We also dig into a two-year-old Redis flaw and a sixteen-year-old white-hat hacker who broke into India's exam portals just to fix them. It's Signal Check — your early-morning look at what's moving in the security world before the chaos starts.

Stories covered:

- Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public (The Hacker News) - https://thehackernews.com/2026/06/cisco-patches-cve-2026-20230-in-unified.html

- Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479) (The Hacker News) - https://thehackernews.com/2026/06/autonomous-ai-tool-finds-2-year-old-rce.html

- Hackers Are After the Gaps in Your Vulnerability Program: Here's Their Playbook (BleepingComputer) - https://www.bleepingcomputer.com/news/security/hackers-are-after-the-gaps-in-your-vulnerability-program-heres-their-playbook/

- He is 16. He broke into NEET and JEE portals to fix it - India Today (India Today) - https://news.google.com/rss/articles/CBMiugFBVV95cUxNYV9RR0xua1h2X1lQQTNzN1ZwX1Blck82V0huZmFScmdwZFlfOXQ0OXFyOTVKLUZ4Mlp3WVJsQmI0Qm9JQjE1THA4aGJ3QVhjWGgtY2dXYm80Z01GTXR6MXh1SEdIVzM5dTkxUDhIYUpkN1dxSUp6WnBiN0I3M0E0ZjhZZk5vbkhsNHhsZ3YzUFI0cjZLQl9SYjNUdU9qcThxai1mYWRFRHZqRWE0WkdXbzV6MjVtMTdCVGfSAb8BQVVfeXFMUDdUUkx4VVZJbnAyNUdfWHdBdGMwWlRvR0padFFUY3hMR252YXJjcHA1TlEtSThlaE8teWpFelp6RlFsVzhvQ2JDMXpfWUdhalBsa3pObGdrbkVvSjBkVFRJbGhtWTh6VmdfRFhlMWNYek92dHFQa0M2enV0OE9USGdFM1hZS21tOUdFTUxUWkRJNmhmbUhZMlFaS19aank1WS1RNHFZSWFSU2ozTllEVXN6blBDLVJJb0FJdHVvYjA?oc=5

- This 90-Year-Old Runner Just Finished His First Marathon After Rediscovering Running Later in Life (Runner's World) - https://www.runnersworld.com/news/a71481967/bill-schwarz-first-marathon-90-years-old/

- Meta's ships facial recognition on smart glasses (Hacker News) - https://www.buchodi.com/meta-glasses-facial-recognition/

This episode covers a zero-day flaw in Visual Studio Code that's leaking GitHub tokens, a devastating HTTP/2 exploit hammering web servers across the internet, and how attackers are now using AI to automatically bypass security tools faster than defenders can respond. Adrian breaks down what's moving in the threat landscape before your second cup of coffee hits. It's Thursday morning, and the signals are already loud.

Stories covered:

- VS Code zero-day lets hackers steal GitHub tokens in one click (BleepingComputer) - https://www.bleepingcomputer.com/news/security/vs-code-zero-day-lets-hackers-steal-github-tokens-in-one-click/

- New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare (The Hacker News) - https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html

- Attackers Use AI to Automate EDR Evasion Testing (Dark Reading) - https://www.darkreading.com/endpoint-security/attackers-automate-edr-evasion-testing

- Is It Okay to Take Breaks During Long Runs? Experts Explain When It Helps and When It Signals a Red Flag (Runner's World) - https://www.runnersworld.com/training/a71483612/stopping-during-long-runs/

- UAH researchers studying technology that could cut travel time to Mars - WAAY 31 News (WAAY 31 News) - https://news.google.com/rss/articles/CBMi4gFBVV95cUxQS081ZEhrbGhfa2V3LXhYcmVjQjZmMmU2UURsU2FkTnhOSlNzYW1nQ0duLS1iSTdRTE1pcG55cUhhR0hxX0ZxZHlmTG5kZ09ZSkdrejREb1ZTNzhQaHEwcWlWUWlFWi1RdUtackdPOGRmaEdIaGlSc0hWRHdWaWRzZUlBQV9FSUlzY1FsTk1zRFBXM08wLWVYNEgwMGZyMDJXY1lEYmdxZFVQd0wwWFR3aWczVkl6ZDM5Znc5SVplaEpQZnNJUkVsN0tjLVlXQ3FvQ1VfOXJGNFVKMmp2eXBxb25n?oc=5

- CISA warns of cyberattacks targeting fuel tank monitoring systems (BleepingComputer) - https://www.bleepingcomputer.com/news/security/cisa-warns-of-cyberattacks-targeting-fuel-tank-monitoring-systems/