🚨: Engineers just proposed a 36 mile long spacecraft called 'Chrysalis' that could carry 2400 people to Alpha Centauri, just 4 light-years away from us, on one way trip. The journey will take 400 years! The passengers who board it will never see Earth again. Neither will their children. Or their grandchildren.

🚨 BREAKING: Hackers are BYPASSING Microsoft 365 MFA, hijacking corporate accounts, and secretly replacing victims' authentication methods to maintain access. 97 accounts compromised across 79 organizations. In some cases, attackers took over sessions in just 12 MINUTES. And now, researchers have separately exposed a critical flaw in Microsoft Authenticator that allowed malicious apps to steal login tokens with ZERO permissions. Microsoft's authentication security is facing two serious threats, and one is already being exploited in the wild. Here's what's happening: 🔴 1. MICROSOFT 365 ACCOUNTS HIJACKED IN THE WILD Cybersecurity researchers at Huntress uncovered a widespread token-replay attack campaign targeting Microsoft 365. The numbers are alarming: → 200,000+ failed login attempts observed. → 497 successful sign-in events. → 97 compromised accounts across 79 organizations. → 48 rogue devices registered inside Microsoft Entra environments. → 19 organizations had victims' MFA methods removed and replaced. Attackers used sophisticated phishing techniques to capture legitimate authentication tokens AFTER victims completed MFA. They then replayed those tokens to access Microsoft 365 without another authentication challenge. But it gets worse. Once inside, attackers registered their OWN authenticator apps and devices to maintain persistent access. They also created hidden email rules to intercept or delete messages involving payroll, banking, and direct deposits. In one case, attackers hijacked a session just 12 MINUTES after the victim reached the MFA prompt and registered their own authenticator less than an hour later. Changing your password alone may NOT remove the attacker. 🔴 2. CRITICAL MICROSOFT AUTHENTICATOR TOKEN THEFT FLAW In a separate discovery, researchers at Enclave exposed CVE-2026-80097 (CVSS 8.6), a vulnerability allowing malicious Android apps to steal Microsoft authentication tokens. → ZERO Android permissions required. → No password required. → No additional MFA prompt. → Malicious apps could impersonate Microsoft Teams. → Stolen tokens could provide access to corporate email, files, calendars, and sensitive account functionality. The underlying flaw? Microsoft Authenticator trusted an application's claimed identity without properly verifying the actual caller. Microsoft has since patched this vulnerability. These are TWO separate security issues, with no confirmed connection between them. But they expose the same dangerous reality: 🚨 MFA ALONE IS NO LONGER ENOUGH TO STOP ATTACKERS WHO CAN STEAL OR REPLAY AUTHENTICATION TOKENS. And businesses relying entirely on MFA for protection may have a serious blind spot. 🛡️ IS YOUR BUSINESS EXPOSED? At Lucid Security, we're offering FREE security reviews to help businesses identify vulnerabilities, authentication weaknesses, and potential security gaps before attackers exploit them. Get your free security review: 🌐 lucidsecurity.si Sources: thehackernews.com/2026/10/mi… enclave.ai/blog/authmask-we-…

But some supermarkets in Japan have a clever solution! 😂🛒🇯🇵 You put a ¥100 coin in to unlock a shopping cart.💰 When you’re done, you have to return your cart and insert the chain from the last cart in the row into your cart’s lock to get your coin back!😂 I’ve heard America has this system too! Is it becoming more common over there? 🤔🇺🇸

a surveillance company threatening to sue over privacy is my favorite genre

We had a Linux server that showed two successful SSH logins from an external IP overnight. The strange part was that there were no failed password attempts before them. The attacker got in cleanly. So I checked the SSH logs properly. Both sessions said: Accepted publickey That meant we were not dealing with a guessed password. I pulled the fingerprint from the logs and compared it with the keys in: /home/deploy/.ssh/authorized_keys There was only one key there. And it matched. The comment on the key was: deploy@old-build That name sounded familiar, so we checked our records. The build server it belonged to had been retired months ago. But nobody had removed its SSH key from this production server. I checked the timestamp on authorized_keys. The key had been sitting there since November 2025. So this was not some new persistence the attacker had just created. It was an old trust relationship we had forgotten about. That was actually worse in a different way. I checked the login history and confirmed both sessions came from the same external IP. Then I looked for files touched during those sessions. A backup copy of the application’s .env file had been created under /opt/api/. That immediately raised another concern because environment files often contain things like database credentials, API keys and application secrets. At that point we disabled the deployment account, removed the stale key, rotated the application secrets and started checking every other server that might still trust the same old build key. The lesson from this one was simple. Not every compromise starts with malware. Sometimes the attacker just finds a credential or key that your own environment forgot existed. Passwords expire. Employees leave. Servers get retired. But SSH keys can quietly sit in authorized_keys for years if nobody is actually reviewing them. That is why key rotation and access reviews matter. The attacker did not need to break SSH. We had already left the door open.

JUST IN: Wolves are reportedly roaming into Finnish villages after Google cleared over 56 million square feet of forest for AI data centers.

Web devs: What's the point of adding a trailing "/" to a URL? Why not leave it as it is?

‼️ A critical Signal bug could keep your microphone, and possibly your camera, live after you hang up. The other caller can flood the call's event queue so your hang-up is never processed. Dubed CVE-2026-113380 it scored 9.3 and got fixed in September.

This PHP stuff is so depressing because there's gonna be 15 Years worth of old sites that are going to become lost media now.

This is such a good read and so true for today’s times. A farmer, tired of rats destroying his crops and stealing his grain, came up with a clever but cruel plan. He threw a dead pig into a deep, abandoned well. Attracted by the smell, nearly 80 rats rushed into the well to feast on the carcass. At first, everything seemed wonderful. There was more than enough food for everyone, and the rats ate until they were satisfied. But when the food was gone, they discovered something terrifying. The walls of the well were too steep to climb. They were trapped. Days passed, and hunger turned into desperation. Desperation turned into aggression. The rats that had once eaten peacefully beside one another began fighting for survival. Eventually, they began killing and eating each other. One by one, their numbers dwindled until only a single rat remained. Its eyes were bloodshot, and it had survived by consuming its own kind. Then the farmer returned, lowered a rope into the well, and rescued the last surviving rat. But he didn't save it out of kindness or compassion. The farmer knew the rat had learned to survive by hunting other rats. When he released it into his fields, it would continue killing its own kind instead of eating his grain. The farmer had turned his enemy into his greatest weapon. And that is the lesson of divide and conquer. Those who control the trap don't need to fight the battles themselves. They simply create the conditions in which others turn against one another. The rats believed their enemies were the other rats. They never realized that the true enemy was the farmer who had put them there. The greatest danger isn't always the enemy standing in front of you. Sometimes it's the one who created the conflict and stands quietly watching you destroy each other. Before you turn against your neighbor because of their political beliefs, ask yourself who benefits from keeping Americans divided. While we fight each other over Republican and Democrat, we may be overlooking those who profit from the conflict. Perhaps the real question isn't which side you're on, but who built the well—and why they want us fighting at the bottom of it. Shared from Fb::unknown author

BREAKING: JPMorgan, Bank of America, Wells Fargo, & other major banks have reportedly detected unauthorized AI agents operating inside customer accounts.

What doesn’t kill you lands you in therapy and one or more 12 step programs