Breach of Confidence — 28 August 2026

Breach of Confidence

I’ve started bringing a small notebook everywhere. Not because I’m particularly organised, but because I’ve realised the best analogies arrive whilst I’m doing something completely unrelated to security. This week it happened at a petrol station. More on that later.

Slovakia’s Traffic Camera Surprise

Slovakia bought 279 Russian traffic cameras with SMS backdoors and passwordless live feeds, funded by EU money meant to modernise infrastructure. The cameras arrived via a Cyprus shell company with fake certifications.

Someone was extremely confident nobody would check. They were nearly correct.

https://www.tomshardware.com/tech-industry/cyber-security/slovakia-discovers-russian-backdoors-in-279-new-traffic-cameras-national-security-service-deactivates-offending-units

The Mystery Model Nobody Knows

A mysterious AI model appears, everyone loses their minds speculating who built it, and nobody actually knows anything. This is just vendor keynotes with better production values and less catering.

https://techcrunch.com/2026/08/23/whos-behind-the-new-stealth-model-ox-alpha/

AliExpress Tried to Track You With Sound Waves

AliExpress attempted to fingerprint shoppers with inaudible sound waves. They worked so well one developer’s headphones switched inputs. Firefox and Brave now make everyone sound identical to tracking scripts.

Chrome users: you remain legible.

https://www.theregister.com/security/2026/08/24/aliexpress-accused-of-fingerprinting-shoppers-with-silent-audio-trick-that-also-muted-a-devs-headphones/5291662

Trillion-Dollar Firm Talked Into Handing Over SSNs

Apollo, a trillion-dollar investment giant, got socially engineered into surrendering Social Security numbers. Four days inside the cloud. No clarity on which platforms, how many affected, or whether the data’s being sold right now.

https://www.theregister.com/cyber-crime/2026/08/24/1t-investment-giant-apollo-breached-after-social-engineering-attack/5291609

Your Secrets Have 469 New Hiding Places

The npm ecosystem became a credential harvesting operation that hits 469 secret locations before your coffee cools. Machine speed means the old assumptions about where attackers look no longer apply. They look everywhere.

https://cybersec.gitguardian.com/s/mini-shai-hulud-s-latest-wave-280-new-places-it-hunts-for-your-secrets-29147

Zombified Visa Cards Still Work After Expiry

Expired Visa cards can be “zombified” to make contactless payments through a man-in-the-middle relay. Visa’s authentication flaw passes the problem to banks. Some stop it. Others don’t.

https://www.wired.com/story/security-news-this-week-your-expired-visa-card-could-be-zombiefied-to-make-contactless-payments/

LibreOffice Ships Without AI

LibreOffice 26.8 arrives without AI, with proper support for bidirectional text, variable fonts, and the genkō yōshi manuscript grid. A foundation does not have to ask whether a language pays for itself.

https://blog.documentfoundation.org/blog/2026/08/26/libreoffice-26-8/

The Productivity Tool That Makes You Worse

AI delivers a real productivity boost. The unmeasurable problem: the person using it to think for them gets faster at prompting and slower at thinking. Once the tool disappears, so does their capability.

Cognitive debt compounds silently.

https://thenextweb.com/news/ai-weaken-human-capability-cognitive-debt

That petrol station moment? Watched someone drive off without their fuel cap. They’ll notice eventually, probably when something goes badly wrong. Security feels like that most weeks. We’re all driving around missing something obvious, and we won’t know which bit until it matters.

Reply to this email if something this week made you laugh or wince. I read them all.