The biggest Cold Chain cyber attack in history is still unfolding. Where are the security patches? These vulnerable chilling systems will remain empty until they are secured. And as a precaution, I can see other supermarkets primitively not restocking and shutting down their potentially vulnerable cooling systems. And I can see insurance companies instructing them to do it. And it's not just food systems under attack. Blood banks are reporting possible issues too.

First Ledger, now Trezor?

The Hacker News

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis

Trezor warns CryptoBilis buyers to replace wallet recovery phrases after a customer reported a Safe 5 implant that transmits them over cellular.

Head's up if you use Claude in VS code:

The Hacker News

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

A compromised Claude Code VS Code extension added an SSH key, installed persistence, and sent host details before version 2.1.314 replaced it.

A tech post. A simple one for some people in tech, but many disciplines within the sector do not cover this, it it was a long forgotten lecture at uni. Before attackers touch your network, they read your DNS. Each of these records left empty is an open door. Here is what they see, and what it means: 1. CAA. Empty means any certificate authority can issue a cert for YOUR domain. Publish: 0 issue "letsencrypt.org" (list the CAs you actually use). 2. SPF. Empty means anyone can send mail as your servers. Publish: v=spf1 <your senders> ~all, and exactly ONE SPF record. 3. DMARC. Empty means phishers spoof your exact domain to your own staff. Publish: v=DMARC1; p=none; rua=mailto:you@yourdomain. Read the reports, then ratchet to p=reject. 4. DNSSEC. Unsigned means your DNS answers can be forged. Enable auto-signing at your DNS provider and publish the DS record at your registrar. Proof: dig @1.1.1.1 yourdomain +dnssec returns the ad flag. 5. MTA-STS. Empty means attackers can strip encryption off your inbound mail. Publish a "v=STSv1" TXT at _mta-sts plus the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt. Add TLS-RPT to see failures. 6. Null MX. Your parked domains are free spoofing stationery. Publish: MX 0 . plus "v=spf1 -all".

Did the new global currency system sneak up on you like a tidal wave? Until now, assets held on blockchain protocols were confined to those platforms. These isolated liquidity pools could only be traversed using clunky exchanges. A new layer is rolling out next month (June 2026) which will allow instantaneous and unlimited flow between protocols via Digital Liquidity Tokens. DTCC will be tokenizing all assets on earth. Every commodity (e.g. Agrotokens), every living thing, every natural resource, every machine, computer, and person. All tracked and traced in real time, controlled and managed via smart contracts. $300 Billion in assets will be managed in the soft launch. The official go live is October 2026, and the expect to be managing $30 Trillion in 3 years time. $75 trillion in tokenized equities is also earmarked for onboarding which makes the $30 trillion target very conservative. Now you know why Tether is buying and holding more Gold than China. ETH, XRP and XLM appear to be the first candidates for onboarding. The ultimate goal is to have over $450 Quadrillion in tokenized assets under real-time management with near real-time transactional settlement.

Fucking Palantir. If humanity doesn't regulate soon, I really don't see much of a future.