Blog
Security, networks and the occasional questionable decision, mostly with the Philippines in view.
Globe Says Its AI Projects Returned P1.2 Billion, 2.8 Times What It Spent
Globe Telecom says its AI and machine learning work delivered P1.2 billion in measurable value as of August, about 2.8 times its AI investment, mostly from better-targeted offers. Here is how the number breaks down and what it does not tell us.
Citizen Lab: Targeted Ads Delivered Zero-Click Spyware to Al Jazeera Devices
Citizen Lab says it has confirmed, for the first time, zero-click mercenary spyware delivered through targeted ads. Israeli firm Discover-Tech bought the ads that infected Al Jazeera devices with Candiru spyware, and its ads reached nearly 200,000 apps and sites.
GhostAction Hijacks About 1,900 GitHub Accounts to Steal CI Secrets From 30,000+ Repositories
GitGuardian says the GhostAction campaign hijacked about 1,900 GitHub accounts in October, targeting 30,000+ repositories and trying to pull 3,174 secrets from CI. Here is how the malicious workflows work, what GitHub did, and the steps to take now.
UPS Opens $80M Clark Hub as Central Luzon Builds a Logistics Corridor
UPS opened a new $80M+ hub at Clark International Airport, 15 times larger than the old one, built to handle 46,000 packages a day and adding nearly 600 jobs. Here's what it means for Central Luzon's push to become a logistics corridor.
Citizen Lab Confirms Zero-Click Pegasus Hack of Belgrade University Rector's iPhone Days Before Serbia's Election
Citizen Lab confirmed with high confidence that University of Belgrade rector Vladan Đokić's iPhone was hacked with Pegasus via a zero-click exploit, six days before Serbia's election. A prosecutor also got an Apple threat warning. Here is what was confirmed and how to check.
PHP Will Ship Emergency Fixes for Two Critical Vulnerabilities Tonight
The PHP security team will release fixes for two critical vulnerabilities, both rated CVSS v4.0 9.2, on October 21 at 14:00 UTC (10 PM Manila). Affected and fixed versions come with the release. Here is how to get ready now.
DHS Orders Federal Civilian Agencies to Drop DeepSeek, Including Products Built on It
A DHS order published in the Federal Register on October 20 bars federal civilian agencies from buying DeepSeek products and requires them to remove DeepSeek and third-party products built on it. It does not cover private use or national security systems.
OVHcloud CLI Releases Were Swapped for a Secret-Stealing Build for 94 Minutes
Attackers used a hijacked developer account to replace OVHcloud CLI v0.11.0 to v0.15.0 binaries on GitHub with a secret-stealing build on October 19. If you installed or updated in that window, rotate every secret on the machine and move to v0.16.0.
China Mobile Hong Kong Lights Up the City's First Upper 6GHz Network in Mong Kok
China Mobile Hong Kong says it has completed testing of Hong Kong's first U6G network at its Mong Kok store, using 100MHz of upper 6GHz spectrum bought in 2024. It claims 3Gbps with carrier aggregation. Here is what is known and what is not.
Attackers Used ConnectWise Cloud Backup App Identities to Get Into Microsoft 365 Tenants
Attackers abused application identities from ConnectWise Cloud Backup, formerly SkyKick, to sign in to customer Microsoft 365 tenants. ConnectWise has suspended the service. MSPs need to disable the apps in every tenant and hunt for added credentials.
