A day late but hopefully not a dollar short!

Here’s what happened last week that I caught and maybe you did too, or maybe you didn’t.

The CISO who forgot rule one

A CISO spent half a million on security patches, then used “r3@lg00dp@$$w0rd” as his password. Actually the password itself wasn’t the real issue, it was the plaintext storage of it and the lack of patching an already expoited vulnerability

https://www.theregister.com/security/2026/10/01/ciso-thought-he-had-a-r3lg00dpw0rd-but-forgot-to-patch/5300314

Everyone in Denmark

8.8 million records breached in Denmark. Which is pretty much everyone in Denmark. At some point we’ll stop calling these incidents “breaches” and start calling them what they are: scheduled data releases to people who weren’t supposed to get an invitation.

Denmark Confirms Major Security Incident Exposing 8.8 Million Citizen Records

The vault that opens from the inside

A guest-to-host escape in KVM is the virtualisation equivalent of discovering your bank’s vault door opens from the inside. Except the vault is running half the internet’s infrastructure. Sleep well.

https://www.theregister.com/offbeat/2026/10/06/security-researcher-claims-they-found-kvm-guest-host-escape-flaw/5301267

Your AI is clicking for you now

We spent a decade training humans not to click. Now the AI we put in their email is clicking for them, reading things it wasn’t asked about, and handing data to attackers while the user watches a perfectly normal draft appear. Copilot CLI will steal your .env file if you ask it nicely enough. GitHub says that’s not a bug, it’s a feature you explicitly enabled by asking an AI to execute code from the internet with full permissions. Hard to argue with that logic.

https://www.csoonline.com/article/4231763/encrypted-instructions-trick-copilot-cli-to-spill-dev-secrets.html

https://blog.knowbe4.com/are-your-ai-assistants-the-next-attack-surface

Two people hold up the internet

Two people maintain the time zone database that runs on billions of phones. One of them is an unpaid volunteer. When one maintainer of xz got tired, a stranger with no real identity took over and hid malware inside it. This is how the internet actually works. Not blockchain. Not AI. Two blokes and a mailing list.

https://sheets.works/data-viz/holding-up-the-internet

The AI that fabricated a murder case

An AI company’s test went unsupervised for two months, fabricated evidence in a murder case, and told nobody until nine days after finding out. This is fine. Everything is fine. When researchers quit millions in equity to warn you something might end the world, and their colleagues immediately agree, it’s worth asking whether you’re hearing science or a very specific internet subculture’s liturgy. Either way, we’re powering it all with 890 megawatts of new nuclear capacity because solar panels aren’t enough for LLMs. Sure, feed the LLM. I don’t need affordable energy.

https://www.bbc.co.uk/news/articles/cqkg50j1yd5lo

https://www.iankduncan.com/personal/2026-09-16-sex-ai-and-the-apocalypse

https://finance.yahoo.com/markets/stocks/articles/why-constellation-energy-rallied-today-194923415.html

Margaret Hamilton

Margaret Hamilton died at 90. She wrote the code that got us to the moon. Everything since has been footnotes.

https://news.mit.edu/2026/margaret-hamilton-computing-pioneer-dies-1007

—

Reply to this if something made you laugh or wince. I’m on Mastodon if you prefer shouting into the void there instead.

Stay cynical.