Remote profile

Call me a cynic, but I don't it's a coincidence that an AI company publishes a press release about 5 high-profile bugs they found in Chrome, Safari, Android, Windows and Linux the day after they file their IPO. As usual, they don't say anything about how many millions of tokens were spent, or about how many hours experts had to pour over results to weed out these 5 as the nicest examples among all the false positives. That is what future investors *should* want to know...

For the monthly Windows update we also do not have data about the cost of finding vulnerabilities, but at least here we can see a trend in the overall numbers: the October update set a new record with fixing 1411 CVEs, comfortably beating the records sets in the previous months (723 in Sept, 537 in July, and 180 in June). In fact, this month's update fixed more CVEs than the total for the entire year 2025.

170 customers of Dutch banks fell victim to a social engineering attack that used relaying of NFC communication to their contactless bank card: victims were tricked to install a malicious app on their phone and hold their contactless bank card to it so that the criminals, pretending to be from the bank's helpdesk, could do an NFC relay attack to a payment terminal or ATM https://www.politie.nl/nieuws/2026/oktober/20/07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude.html This type of attack has happened before on Czech banks in 2023, but I think it's the first time it happened in the Netherlands.

Already over 10 years ago in master thesis research of Jordi van den Breekel https://www.linkedin.com/in/jbreekel we were surprised to find that contactless terminals had very long time-outs, sometimes over 50 seconds, which makes relay attacks less tricky that one would hope.

This month is without a doubt the most successful October Cybersecurity Awareness month since the initiative began in 2004 (I checked, HeartBleed and Shellshock were not in October):

After making sure that certificates relying on 4 as private key are not accepted and upgrading PHP, people can move on to upgrade systems affected by CVE-2026-111497 (aka Node2Shell, HTTP2Shell and Broccoli2Shell). Same CVSS score as PHP2Shell, but exploiting it looks simpler, judging by the PoCs. And: it seems no tokens were harmed to come up with exploits.

Interesting article on the PHP panic of last week: https://blog.luitjes.it/posts/i-want-my-wednesday-back/
Still, I think all the panic was really useful: a great wake-up call for organisations to take their asset management seriously, especially for those organisations that were scrambling to figure out if they were affected

Interesting report on Anthropic's efforts to formally verify code: https://www.anthropic.com/research/formal-verification with more details in the appendix https://www-cdn.anthropic.com/files/4zrzovbb/website/6867eadf760258fa8b42a504600cd3c036d16358.pdf

Especially interesting for me personally: as a formal methods researcher I started looking at cybersecurity a few decades ago in the hope that security might be a killer application for formal verification. We managed to get some results, eg. verifying some security and safety properties of an SSH implementation (see https://www.cs.ru.nl/~erikpoll/papers/wits.pdf), but even for Java code this was very labour-intensive, so that we did not even begin to attempt it for C code or binaries.

@Frederik_Borgesius @mattis https://therecord.media/eu-cyber-law-wont-force-fixes-for-fridges-in-french-attack Nice example for your upcoming article on CRA support periods. But I guess you already thought of that...