Daily Reading for 2026-08-11

Security

Security Risk Advisors

• Metabase Unauthenticated SQL Injection Vulnerability Enables Administrative Access and Complete Database Compromise Across Affected Versions.

  ONE SENTENCE SUMMARY

  Metabase disclosed an actively exploited 0-day SQL injection enabling administrative access and full database compromise, urging self-hosted users to upgrade immediately.

  MAIN POINTS

  1. 0-day vulnerability affects Metabase versions 1.58 and above.
  2. Attackers exploited unknown flaw against Metabase Cloud instances.
  3. Cloud customers already upgraded and patched automatically.
  4. Self-hosted instances may remain vulnerable to compromise.
  5. Attack enables arbitrary SQL against application database.
  6. Attacker can gain administrator access to the instance.
  7. Credentials for connected databases could be stolen.
  8. Attackers can change configuration and export data.
  9. Versions below 58 are not vulnerable.
  10. Upgrade to latest point release of your version.

  TAKEAWAYS

  1. Immediately upgrade self-hosted Metabase to listed safe point releases.
  2. Delete all rows in core_session table to revoke sessions.
  3. Review API keys, admin accounts, and connected-database credentials.
  4. Check data warehouse and activity logs for unauthorized access.
  5. Temporarily block /api/session/reset_password endpoint if unable to upgrade.

• 🚩 UNC6671 Rebrands Across Multiple Extortion Fronts While Continuing Vishing and SaaS Data Theft

  ONE SENTENCE SUMMARY

  UNC6671 rebranded across multiple extortion fronts (Redact, Pink, Helix, Falcon) while continuing vishing, AiTM credential theft, and automated SaaS data exfiltration.

  MAIN POINTS

  1. UNC6671 continues operations despite BlackFile’s announced May 2026 retirement.
  2. Group uses IT helpdesk vishing targeting employees on personal mobile devices.
  3. Calls lure victims to spoofed portals using AiTM infrastructure.
  4. Attackers exfiltrate data from Microsoft 365 and Okta via scripts.
  5. Shared root domains link Falcon, Helix, Pink, and BlackFile brands.
  6. Identical phishing templates deployed across all credential-harvesting domains.
  7. Targeting evolved toward financial, legal, and private-equity sectors.
  8. Ransom demands $1-3M, with 50-75% reductions averaging $750K.
  9. Payments totaling 141.65 BTC (~$10.69M) continued past brand shutdown.
  10. Defenders advised enforcing phishing-resistant FIDO2 multi-factor authentication.

  TAKEAWAYS

  1. Mandate phishing-resistant FIDO2 authenticators across all SSO environments.
  2. Enforce session controls, idle timeouts, and step-up authentication.
  3. Restrict authentication to trusted corporate, VPN, and SASE network sources.
  4. Monitor IdP logs for abandoned MFA challenges and failed authentications.
  5. Treat high-volume scripting-based file access as critical exfiltration events.

• 🚩 DeadLock Ransomware Uses Decentralized Messaging and Blockchain Infrastructure to Support Extortion

  ONE SENTENCE SUMMARY

  Microsoft analyzes DeadLock ransomware, an emerging double-extortion threat using Session messaging and Polygon blockchain infrastructure for resilient decryptor, leak, and victim-communication operations.

  MAIN POINTS

  1. DeadLock emerged July 2025, deployed by Lynx and INC affiliate groups.
  2. Employs double extortion: encrypts environments and threatens public data leaks.
  3. Over 80 victims published on DeadLock blog, half in Europe.
  4. Geofencing avoids former Soviet, CIS-linked, and select Middle Eastern countries.
  5. Uses resource-aware throttling to keep systems responsive during encryption.
  6. Hybrid crypto combining Curve25519 ECDH with XChaCha20 stream cipher.
  7. Per-file unique ephemeral keys prevent any key reuse across files.
  8. Tiered encryption encrypts only portions of large database and backup files.
  9. Recovery chat HTML uses Session network and Polygon smart contracts.
  10. Wasabi file browser enables browsable stolen-data access without web server.

  TAKEAWAYS

  1. Decentralized blockchain and Session infrastructure increase ransomware takedown resilience.
  2. DeadLock uses SEC1-prefixed Curve25519 keys and a zero crypto_box nonce per file.
  3. Language geofencing and resource throttling reflect sophisticated, mature ransomware tradecraft.
  4. Enable Defender EDR block mode, tamper protection, and attack surface reduction rules.
  5. Employees and defenders should recognize both HTML and text ransom note deployment patterns.

wardley-beta
%% 1. Users: Enterprise security teams, CISOs, SOC analysts, IT leadership
%% 2. Needs: Continuous threat detection/response, vulnerability remediation, actionable threat intelligence, ransomware resilience
%% 3. Capabilities: Managed detection/response, vuln management, threat intel ingestion, ransomware defense, incident response
%% 4. Components from articles: MDR/MXDR services, vulnerability management, threat intelligence feeds, ransomware defense, decentralized threat infra analysis
%% 5. Maturity: MDR/MXDR (Product→Commodity), Vuln Mgmt (Product), Threat Intel (Product), Ransomware Defense (Custom→Product), Decentralized Threat Infra (Genesis)
%% 6. Managed by: Security vendors (Microsoft, Google), internal SecOps, threat intel providers, IR firms

anchor threatProtection [0.95, 0.90]
anchor vulnRemediation [0.90, 0.75]
anchor intelDrivenDefense [0.88, 0.60]
anchor ransomwareResilience [0.85, 0.45]

component mdrMxdrServices [0.75, 0.85]
component vulnManagement [0.65, 0.70]
component threatIntelFeeds [0.55, 0.55]
component ransomwareDefense [0.45, 0.40]
component decentralizedThreatAnalysis [0.25, 0.30]

mdrMxdrServices -> threatProtection
vulnManagement -> vulnRemediation
threatIntelFeeds -> intelDrivenDefense
ransomwareDefense -> ransomwareResilience
decentralizedThreatAnalysis -> ransomwareDefense
threatIntelFeeds -> mdrMxdrServices
vulnManagement -> mdrMxdrServices

evolve mdrMxdrServices 0.85
evolve vulnManagement 0.70
evolve threatIntelFeeds 0.65
evolve ransomwareDefense 0.50
evolve decentralizedThreatAnalysis 0.20

Interesting Stuff

Daniel Miessler

• Creativity vs. Consumption

  ONE SENTENCE SUMMARY:

  Your happiness is most strongly governed by your ratio of creating value versus consuming others’ content, not any single other metric.

  MAIN POINTS:

  1. Creativity vs Consumption is the single biggest happiness metric.
  2. Feeling empty suggests excessive time watching or consuming media.
  3. Compare consuming time against building or helping others.
  4. Watch other people’s activities, short-form video, YouTube, TV.
  5. Contrast with time spent building something meaningful.
  6. Also count time improving someone else’s life.
  7. It’s not the only metric that matters.
  8. Roughly 29.8 years of ad-free writing here.
  9. Over 3,081 essays and tutorials published and counting.
  10. A monthly or one-time donation keeps it going.

  TAKEAWAYS:

  1. Audit your media consumption when you feel empty.
  2. Prioritize building and helping over passive watching.
  3. Treat the creativity-consumption ratio as your compass.
  4. Shift time from short-form video toward creation.
  5. Recognize creation sustains meaning and contribution.

wardley-beta
%% 1. Users: Blog readers seeking personal growth, creators, knowledge workers
%% 2. Needs: Balance creation vs consumption, build creative habits, reduce passive consumption
%% 3. Capabilities: Conceptual framing, practical frameworks, behavioral nudges, curated examples
%% 4. Components: Creativity/Consumption dichotomy, Output-over-input mindset, Daily creative practice, Consumption audit
%% 5. Maturity: Dichotomy (Product), Mindset (Custom), Practice (Custom), Audit (Genesis)
%% 6. Managed by: Author (Daniel Miessler) via blog posts, newsletters

anchor balanceNeed [0.90, 0.90]
anchor habitNeed [0.85, 0.75]

component dichotomy [0.65, 0.80]
component mindset [0.45, 0.60]
component practice [0.30, 0.45]
component audit [0.15, 0.35]
component curation [0.55, 0.50]
component newsletter [0.75, 0.40]

dichotomy -> balanceNeed
mindset -> dichotomy
practice -> mindset
audit -> practice
curation -> mindset
newsletter -> curation
newsletter -> habitNeed
practice -> habitNeed

evolve dichotomy 0.75
evolve mindset 0.55
evolve practice 0.40
evolve audit 0.20

Programming

Simon Willison’s Weblog

• Introducing Muse Glimmer

  ONE SENTENCE SUMMARY:

  Meta released Muse Glimmer, a new 30B open-weights vision model under Apache 2.0, optimized for agentic tasks, reliable tool use, and multi-step reasoning.

  MAIN POINTS:

  1. Muse Glimmer is Meta’s new 30B model under Apache 2.0 license.
  2. It improves on Meta’s previous janky Llama licenses.
  3. Optimized for end-to-end agentic task completion.
  4. Strong benchmarks include DeepSearch QA, MCP-Atlas, 𝛕-Bench, and SWE-Bench.
  5. Excels at coding, debugging, and multi-turn request resolution.
  6. Handles precise tool invocation across extended workflows.
  7. Chains reasoning over long horizons coherently.
  8. Simon tested it via LM Studio’s 18.16 GB version.
  9. Also tested with llm-coding-agent on Datasette’s codebase.
  10. Vision capability accurately describes pelican photos from iNaturalist.

  TAKEAWAYS:

  1. Open-weights competitors are improving license terms and agentic focus.
  2. A 30B model leaves ample RAM for concurrent applications.
  3. Benchmarks emphasize real-world scaffold and coding workflows.
  4. Reliable tool use matters for extended agent workflows.
  5. Local models now handle vision plus reasoning tasks well.

wardley-beta
%% 1. Users: Developers/programmers tracking emerging tools & AI-assisted coding
%% 2. Needs: Stay informed on cutting-edge dev tools; evaluate new AI coding approaches
%% 3. Capabilities: Curation, technical analysis, tutorial writing, tech evaluation
%% 4. Components: Muse Glimmer (new AI tool), Simon's analysis, Blog platform, AI coding category
%% 5. Maturity: Muse Glimmer=Genesis, AI coding tools=Custom, Simon's curation=Product, Blog platform=Commodity
%% 6. Management: Simon Willison (curation/blog), Muse team (tool), Platform providers (hosting)

anchor stayInformed [0.92, 0.90]
anchor evaluateTools [0.88, 0.75]

component museGlimmer [0.12, 0.55]
component aiCodingTools [0.35, 0.60]
component simonCuration [0.65, 0.70]
component blogPlatform [0.90, 0.40]
component techAnalysis [0.55, 0.50]

museGlimmer -> aiCodingTools
aiCodingTools -> techAnalysis
techAnalysis -> simonCuration
simonCuration -> stayInformed
simonCuration -> evaluateTools
blogPlatform -> simonCuration

evolve museGlimmer 0.25
evolve aiCodingTools 0.45
evolve simonCuration 0.72