What happened at HackerOne (Ep. 189): Joel Margolis unpacks HackerOne's recent shifts, from bug-bounty economics to researcher trust, useful context for any AppSec team. Find out more

OpenAI pitches AI models to defend critical infrastructure: OpenAI is positioning its models for critical-infrastructure cyber defence, framing frontier AI as a tool for defenders as much as attackers. Find out more

Google patches a Chrome zero-day under active attack: Chrome's update fixes 12 flaws, including CVE-2026-85046 (CVSS 8.8), a V8 type-confusion bug exploited in the wild to run code inside the sandbox via a crafted page. It is Google's sixth actively exploited Chrome zero-day this year. Find out more

MikroTik RouterOS flaws chained as "MikroTrick": CERT Poland warns of two actively exploited RouterOS zero-days that can be combined to take full control without authentication where SSH remote access is enabled (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2). Attacks creating an "ops" account have run since at least 2 September; patch to 6.49.21, 7.23.4 or 7.24.2. Find out more

KidsProtect: spyware sold as "parental control": A spyware tool marketed as a parental-control app, promoted on a hacker forum in April 2026 with a YouTube channel and Telegram walking through its C2 panel and features. The public site sits high in Google results, and the C2 is hosted on the same domain (KidsProtect[.]live). Find out more

Open Measures joins Everbridge: Open-source and threat-intelligence platform Open Measures announced it is joining critical-event-management firm Everbridge. Find out more

Mieroszewski Centre: Russian propaganda narratives in Polish academia, 2014 to 2024: The Centre (a Polish state institute for dialogue with Eastern Europe) screened 3,000+ scholarly works and flagged Kremlin-aligned messaging in 377 publications, with practical tips to avoid amplifying propaganda. Find out more (Report in Polish & Executive summary in English )

CSIRT GOV: Report on the State of Cybersecurity of the Republic of Poland. Report (in Polish)

Turkish OSINT groups publish a map of Greek military depots: Turkish accounts posted coordinates (and satellite video) of dozens of alleged Greek weapons and ammunition warehouses, even discussing means of destruction; Greek media read it as a psychological operation. Find out more

Chinese-owned Cyprus hotel feared used to watch RAF Akrotiri: Intelligence sources worry the "City of Dreams" luxury complex, with panoramic views over the British airbase, could serve as an observation post over a hub for Middle East operations. Find out more

Dutch intelligence services set for sweeping new powers: A new bill would let the AIVD and MIVD tap or follow anyone for up to a year without pre-approval and force platforms and banks to hand over data, drawing sharp privacy concerns. Find out more

Maldives emerges as a secret hub for Russian sanctions evasion: A WSJ investigation traces hundreds of millions in restricted Western goods (chips, aerospace parts) moving through Malé airport to sanctioned Russian firms. Find out more

Colombia appoints a controversial new spy chief: Retired general Jorge Andrés Zuluaga, known for the 2008 Operation Jaque rescue, was named head of the National Intelligence Directorate (DNI) despite pending investigations over illegally obtained "Andromeda" intelligence. Find out more

Uganda arrests 16 in an alleged $4M fake-gold scam: Ugandan police arrested 16 people, including four police officers, over a fake gold deal that conned a Dubai businessman out of $4M through a shell firm, Real Sunnex Ltd. Find out more

LinkedIn pushes AI job search and phases out classic search: LinkedIn is steering job seekers into its AI-powered search; users can still switch back to classic for now, but many expect it to be retired. Find out more

Public X viewers go dark: Full public mirror-viewers for reading the X feed anonymously without an account (nitter.net, twitterwebviewer.com, aguea.net) are no longer available, another squeeze on no-login access.

Yandex's "Alice" AI may get deep access on Russian devices: Russia is weighing rules that could grant the preinstalled Alice assistant far broader permissions than any other app, potentially including banking apps, with data stored on Yandex servers. Find out more

OpenAI's incident report on the "Hugging Face" rogue-agent event: OpenAI published its post-incident writeup; reporting suggests the agent incident was worse than first thought. Find out more

South Korea's "AI for all" gives free access to every citizen: Seoul is rolling out free national AI access, one of the boldest state AI-adoption pushes yet. Find out more

ChatGPT built its own search index: OpenAI has quietly built out its own web index for ChatGPT search, loosening reliance on third-party search, with real implications for SEO and discovery. Find out more

Investigation: the luxurious estates of Azerbaijan's president: A deep OSINT dive mapping mansions and property tied to Ilham Aliyev and his family through open records and imagery. Find out more

OSINT Webpage Capture Lite: A local-first browser extension (Chrome and Firefox) by Engelbert van Essen for capturing web pages as PNG, JPG or PDF, no cloud, no tracking, GDPR-minded, with a Professional edition in testing. Find out more

fingerprint.to: A browser-fingerprinting explainer/checker to see what your setup exposes.

OMERTÀ (The OSINT Vault): A new search engine by Nicole Hurey correlating names, usernames, phones, emails and domains across open sources. No account, no API keys; search, correlate, pivot. Find out more

Apple and Google miss UK deadline to block child nudity on phones: Both firms failed to meet a UK deadline for on-device measures against child nudity, drawing regulatory and safety criticism. Find out more

Google Maps organic results comparison: A look at how "organic" Maps results really stack up, useful context for local-search and geolocation work. Find out mor

CIJ webinar: investigating the climate crisis with results, Sep 10: A free CIJ session on biodiversity and ocean reporting, open to all with registration (3pm UK time). Find out more

FASPE Journalism Fellowship: Applications open for journalism students and early-career journalists to study professional ethics and ethical leadership in Berlin and Poland. The 2027 FASPE Fellowship application is now open through January 3, 2027, at 11:59 PM ET. Find out more

Skopenow OSINT Live 2026, Oct 15 (free, virtual): A free online OSINT conference with speakers including Micah Hoffman and Griffin Glynn (My OSINT Training) and The Guardian's Dr. Manisha Ganguly, covering AI agents in OSINT workflows, visual forensics of war crimes, image analysis and AI-generated identities. Find out more

CultOfTheRabbit CTF: An OSINT-heavy CTF (geolocation, image analysis, web research, archives) run with OSINT Switzerland and Compass Security. Around 124 challanges.

Fulcrum: online terrorism and extremism monitoring training: Fulcrum Intel Digest and Fulcrum Analytics are taking expressions of interest for hands-on training in locating and analysing extremist propaganda online, pitched as an affordable route into conflict-monitoring work. Find out more

Sumsub Transaction Monitoring 2.0 (AML): A free, CPD-accredited, self-paced course on typologies, rule design, investigations, FIU reporting and governance across finance, crypto, iGaming and trading, taught by working AML practitioners. Find out more

EUROCRIM 2026: Frontiers of Criminology, Warsaw, Sep 11: University of Warsaw, Faculty of Applied Languages, 10:30 to 11:45.

German Intelligence Community Conference 2026, Sep 17 to 18. Find out more

Hacks/Hackers AI x Investigative Journalism Forum, NYC, Sep 25. Find out more

Cyber Arena (Flaming Shield'26), Kaunas, Oct 10 to 11: A high-stakes cyber competition where around 100 players (teams or solo) race to find vulnerabilities, capture flags and take over virtual organisations, with a €10,000 prize pool sponsored by Vinted. Organised by the Lithuanian Riflemen's Union with MetaCTF and partners.