ALL POSTS

Key Findings Meta detected NSO Group conducting spear phishing campaigns targeting WhatsApp users despite a permanent court injunction issued last year The company filed a federal contempt-of-court complaint, alleging NSO violated the injunction by creating test accounts and luring users to malicious external websites Three malicious domains have been identified: ikhwancast.com, ghazacast.com, and fr24cast.com NSO Group remains on the U.S. Commerce Department's Entity List an

Key Findings Meta's AI-powered Instagram account recovery tool, known as High Touch Support (HTS), contained a critical flaw that exposed over 20,000 accounts to unauthorized password resets The vulnerability existed for approximately seven weeks, from April 17 to early June 2026, before Meta discovered it on May 31 The flaw allowed attackers to request password reset links for any Instagram account and have them sent to email addresses they controlled, bypassing identity ver

Key Findings Meta's AI support assistant was exploited to hijack high-profile Instagram accounts including the Obama White House account and U.S. Space Force Chief Master Sergeant account over the weekend of May 31 Hackers used a VPN to spoof location, then tricked the AI bot into adding unauthorized email addresses to target accounts and resetting passwords The exploit bypassed two-factor authentication entirely and was defeated only by accounts with multi-factor authenticat

Key Findings Meta has secured up to 6.6 GW of nuclear power through landmark deals with Vistra, TerraPower, and Oklo to fuel its growing AI infrastructure and the "Prometheus" supercomputing cluster in Ohio. The collaboration with TerraPower involves financing the construction of two sodium-cooled reactors utilizing proprietary "Natrium" technology, providing 690 MW initially, with plans to expand to 2.1 GW by 2035. Meta has also entered an agreement with Oklo, a startup back

Key Findings Cybersecurity researchers have uncovered critical remote code execution vulnerabilities in major AI inference engines, including those from Meta, Nvidia, Microsoft, and open-source projects like vLLM and SGLang. The vulnerabilities stem from the unsafe use of ZeroMQ (ZMQ) and Python's pickle deserialization, a pattern dubbed "ShadowMQ." The root cause is a vulnerability in Meta's Llama large language model (LLM) framework (CVE-2024-50050) that was patched by the