Steve Puluka (@spuluka) header
Steve Puluka (@spuluka) profile picture

Steve Puluka

@spuluka

Senior Network & Security Engineer / Cantor & Religious Educator

 Pittsburgh, PA
puluka.com/home
Joined November 2013
  • Tweets3.4K
  • Following174
  • Followers1.3K
212Media
Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)Photo by Steve Puluka (@spuluka)
Be careful out there, report from @ApiiroSecurity details have the Claude #AI agent has leaked over 2.5k credentials to Github by a simple configuration mistake. apiiro.com/blog/coding-agent…
Coding Agents Are Leaking Your Secrets to GitHub

Coding Agents Are Leaking Your Secrets to GitHub

Apiiro found 2,539 real secrets in 1,994 public GitHub repos, saved by Claude Code's "don't ask again" to .claude/settings.local.json. Check if you're affected.

apiiro.com
59
That time again to review the ten new CVE from @PaloAltoNtwks and get patching the affected gear. security.paloaltonetworks.co…
Palo Alto Networks Security Advisories

Palo Alto Networks Security Advisories

Palo Alto Networks Security Advisories - Latest information and remediations available for vulnerabilities concerning Palo Alto Networks products and services.

security.paloaltonetworks.com
59
Good news looks like Ukrainian authorities have arrested four suspects in stealing €4.3 million from over a hundred German victims. cyberpolice.gov.ua/news/u-me…
37
Looks like @Apple is taking mild steps back into looking for CSAM material by starting with content publicly shared via iCloud. support.apple.com/en-us/1491…

Learn more about sharing content that can be accessed by Anyone with the Link - Apple Support

When you share an item that can be accessed by Anyone with the Link in version 27.3 or later of iOS, iPadOS, macOS, and visionOS, that content is made accessible to Apple to check for harmful content.

support.apple.com
65
Interesting deep dive by @ESET into how the Amatera infostealer works and is detected. welivesecurity.com/en/malwar…

Amatera: How the prolific infostealer works and spreads

The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 exemplifies the professionalization of cybercrime.

welivesecurity.com
1
108
Good news that @Apple has detected spyware and notified affected end users in 99 countries. cyberscoop.com/apple-spyware…
Apple notifications alert victims in 99 countries about mercenary spyware infections

Apple notifications alert victims in 99 countries about mercenary spyware infections

As Apple issues new spyware threat notifications, rights groups urge stricter accountability ahead of final Pall Mall Process standard negotiations.

cyberscoop.com
81
In good news for @Microsoft the Danish Government pilot program to replace MS @Office with open source alternatives has been discontinued and Office will remain. computerworld.dk/art/297226/…
Digitaliseringsministeriet har i al stilhed droppet stort anlagt forsøg med open source-alternativ...

Digitaliseringsministeriet har i al stilhed droppet stort anlagt forsøg med open source-alternativ...

Digitaliseringsministeriet har i al stilhed lagt sit pilotprojekt med et alternativ til Microsoft Office i graven.

computerworld.dk
79
Good news that @Europol has seized over 100 servers and arrested seven suspects running scams in trading web sites. europol.europa.eu/media-pres…
Investment scams with potential victims in at least 50 countries: over 100 servers seized –...

Investment scams with potential victims in at least 50 countries: over 100 servers seized –...

An international operation involving authorities in Albania, Cyprus, Finland, Germany, Kosovo* and North Macedonia, supported by Europol and Eurojust, has struck at the infrastructure of an investm...

europol.europa.eu
1
57
New feature on the @Microsoft Edge browser detects scare ware alerts locally on websites and blocks them. blogs.windows.com/msedgedev/…
Client-side threat detection: how Scareware blocker uncovered malicious notification abuse

Client-side threat detection: how Scareware blocker uncovered malicious notification abuse

Website notifications were designed to help us stay informed. They can alert you to a new message, remind you of an upcoming event, or share an important update from a service you trust. But scammers...

blogs.windows.com
58
Cybersecurity guidelines from @NISTcyber for the self employed and entrepreneurs. nist.gov/news-events/news/20…
Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You

Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You

The guide is designed to help solopreneurs prioritize and implement a selection of actions from the NIST Cybersecurity Framework that would best help their businesses.

nist.gov
1
71
Updated guidelines from the US @NISTcyber on timelines and procedures to transition to Post Quantum Cryptography methods for organizations. nist.gov/news-events/news/20…
NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards

NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards

This report describes the timelines and migration activities for federal agencies, and it can serve as a key resource for technology providers and organizations that are developing their quantum-re...

nist.gov
52
Interesting deep dive from Stairwell on the Insomnia RAT with versions on both Node.js and Python running on either Windows or macOS. stairwell.com/resources/inso…
Insomnia RAT: A Dual-Payload Backdoor - Stairwell

Insomnia RAT: A Dual-Payload Backdoor - Stairwell

Discover technical analysis of Insomnia RAT, a dual-payload backdoor targeting Windows and macOS via OfferLoader. Explore its PowerShell loader, YARA rules, and IOCs.

stairwell.com
80
Good news that Dutch Police have arrested two suspects in mobile phishing and card / ATM thefts. politie.nl/nieuws/2026/oktob…
Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude

Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude

380.000 euro schade bij zo'n 170 slachtoffers. Dat waren de cijfers waarmee het Rotterdamse Team Cybercrime werd geconfronteerd in de drie weken die het onderzoeksteam zicht had op de servers van een...

politie.nl
45
Public preview of the new @github package firewall is out. This project is intended to help package maintainers fight supply chain malware. github.blog/changelog/2026-1…
GitHub package firewall in public preview - GitHub Changelog

GitHub package firewall in public preview - GitHub Changelog

Editor’s note (October 21, 2026): Rewrote the changelog for clarity and added imagery. There’s been a recent flood of malware attacks that exploit systems at package installation time. Agents and…

github.blog
1
60
Nice set of detection rules from @github on how to see if you PHP site is vulnerable and under attack from CVE-2026-111497. gist.github.com/Blevene/7d9d…
CVE-2026-111497, node2shell Detection Opportunities

CVE-2026-111497, node2shell Detection Opportunities

CVE-2026-111497, node2shell Detection Opportunities - Detection_CVE-2026-111497.md

gist.github.com
110
Interesting dashboard created by @censysio tracking the patching of PHP2Shell vulnerabilities across the internet. php2shell.censys.com/
Censys PHP2Shell Exposure Tracker

Censys PHP2Shell Exposure Tracker

Track Internet-wide PHP2Shell exposure and patching progress with hourly data from Censys.

php2shell.censys.com
1
94
According to @Google evaluations over 6k of the 35k #AI agent. Submissions to VirusTotal are malicious in nature. blog.virustotal.com/2026/10/…
77
Good news that @Interpol arrested over 1400 suspects in 21 countries for a wide range of online scam activities. interpol.int/News-and-Events…

Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million

Operation Serengeti III dismantles thousands of malicious cyber networks

interpol.int
58
Interesting and thoughtful analysis from @Microsoft on how #AI should be implemented in a corporate environment. blogs.microsoft.com/blog/202…
What we’ve learned from Microsoft's own AI transformation - The Official Microsoft Blog

What we’ve learned from Microsoft's own AI transformation - The Official Microsoft Blog

AI is reshaping work faster than any organization has fully mastered. Across industries, the conversation has shifted from what AI can do to how companies can use AI to create business value and...

blogs.microsoft.com
56
New advisory from the US @CISACyber on how to perform incident response looking for #AI agent training hacking into corporate systems. cisa.gov/resources-tools/res…

Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation |...

This joint product outlines ten voluntary practices for super intelligence (SI) control incident management to help organizations that train and evaluate highly capable SI agents prepare for, detect,...

cisa.gov
1
70
Load more