r/Infosec

Came across an article, product like phpBB still has some potential flaws.

More holes, more patches.

https://www.theregister.com/security/2026/06/27/its-looking-like-a-hot-messy-summer-for-security-teams-as-ai-finds-countless-previously-hidden-vulns/5260478

Hi everyone,

I'm working on the compliance framework for an Indian fintech (Lending Service Provider) and would like to understand how the security safeguards under Rule 6 of the DPDP Rules, 2025 are implemented in practice.

The Rule mentions encryption, masking/obfuscation, access controls, audit logs, monitoring, backups and other technical and organisational measures, but I'd like to understand how engineering teams actually build these systems.

Some questions:

1.How do Fintech typically protect sensitive data such as PAN, Aadhaar and KYC documents?

2. Is data generally encrypted both at rest and in transit? How is key management usually handled?

3. How are access controls implemented? Do you use Role-Based Access Control (RBAC) or something more granular?

4. What kinds of logs are maintained for security and audit purposes? Are they application logs, database logs, audit trails or something else?

5.Do Indian fintechs commonly obtain ISO/IEC 27001 certification, or do many startups simply implement equivalent security controls without formal certification?

I'm looking for practical implementation insights from backend, security or DevSecOps engineers rather than legal interpretations.

I built a small tool to catch infra risks before production releases
I’ve been working on a project called Beacon.
The idea came from a very practical problem I’ve seen in distributed systems: before a release, teams usually have dashboards, logs, Terraform files, Kafka configs, Kubernetes manifests, runtime snapshots, etc. But still, the actual question is usually very simple:
“Is this system safe enough to release to production?”
Beacon tries to answer that.
It scans infrastructure/config/runtime inputs and gives a production-readiness decision with ranked risks, possible root causes, and suggested next actions. Right now it has examples around Kafka, Kubernetes, Terraform, Helm, runtime snapshots, OpenTelemetry, Prometheus, Schema Registry, CI/CD, and flow degradation.
This is not meant to replace observability tools. The way I think about it is:
Observability tells you what is happening.
Beacon tries to tell you what is risky, why it matters, and what should be fixed first.
You can try the demo without setting up Python locally.
Run the UI with Docker:

docker pull ghcr.io/mishraricha1806/beacon:latest

docker run --rm -p 8765:8765 ghcr.io/mishraricha1806/beacon:latest ui --host 0.0.0.0 --port 8765

Then open:

http://127.0.0.1:8765/

For the simplest demo, use the sample bad infrastructure example from the repo:

examples/bad-infra/

In the UI, choose the static/readiness input, upload the files from that folder, run the scan, and check the readiness score, top reasons, grouped risks, and next actions.
You can also run the same demo from CLI:

docker run --rm \
  -v "$PWD:/workspace/project:ro" \
  ghcr.io/mishraricha1806/beacon:latest readiness static \
  /workspace/project/examples/bad-infra \
  --environment prod \
  --no-html \
  --no-open-report

Expected result is the tool should flag the setup as NOT READY, with risks like replication, storage/message-size, and missing governance context.
There is also a Black Friday style demo for payment/event pipeline readiness:

docker run --rm \
  -v "$PWD:/workspace/project:ro" \
  ghcr.io/mishraricha1806/beacon:latest readiness all \
  --static-path /workspace/project/examples/demo-black-friday \
  --snapshot /workspace/project/examples/demo-black-friday/runtime-snapshot.yaml \
  --environment prod \
  --no-html \
  --no-open-report

Repo: https://github.com/mishraricha1806/beacon
I’d be interested in feedback from people who work with Kafka, Kubernetes, Terraform, platform engineering, SRE, or release governance.
Mainly looking for thoughts on:

• Does this kind of readiness gate feel useful before production releases?
• What signals would you expect such a tool to check?
• Would you prefer this as a CLI, CI/CD gate, or lightweight UI?

GitHub

GitHub - mishraricha1806/beacon: Detect infrastructure risks before production.

BREAKING: The NSA's own director says Mythos broke into almost all of its classified systems in hours.

Per The Economist, Senator Mark Warner, vice chair of the Senate Intelligence Committee, said General Joshua Rudd, who runs the NSA and the Pentagon's Cyber Command, told him this directly.

This came out on June 11, the same day Amazon reportedly found a separate jailbreak in Anthropic's models. Within hours, Trump ordered Anthropic to cut off foreign access to Mythos and Fable.

Anthropic shut both down completely instead.

Now there are two competing stories for why this actually happened.

One says the shutdown was a response to the NSA's own classified systems getting breached in hours.

The other says Anthropic is privately pushing back, calling the jailbreak minor and the shutdown an overreaction to something other AI models can already be tricked into doing.

The NSA was already using Mythos for its own cyber operations, with Anthropic engineers embedded inside the agency. The same tool the agency was actively relying on is the one its own director says broke into almost everything it owns.

On the technical side we’ve had to layer controls. Start by not training on, indexing, or stuffing into prompts any sensitive data that isn’t strictly required. Then narrow which models and routes can ever touch the higher‑risk buckets, scrub and tag inputs so anything coming from third parties is clearly marked, and add an explicit enforcement step on outputs that flags or blocks anything that looks like secrets or regulated information. In parallel, the organization has to pull its weight: data classification that engineers actually understand, clear guidance on which categories may reach a model at all, and review requirements for any feature that touches those categories. Without that, you’re effectively betting on every individual dev to remember an invisible boundary.

For those working under tight privacy or regulatory constraints, what additional guardrails technical or process ended up being crucial beyond the obvious “don’t train on PII”?

Hi everyone,

I need advice on how to get YesWeHack staff to intervene or review a ticket, as I don't see a "Request Mediation" button on the report interface.

The Situation:

• My Report: I submitted a Critical bug (CVSS 9.6) regarding an iOS/Android app. The vendor accepted it, paid a bounty (though underpaid by ~60% based on their own matrix), and explicitly wrote: "We will apply for a CVE on your behalf and list your name as the reporter." After the payout, they completely ghosted my follow-up messages.
• The Suspicion: A few days ago, a public CVE dropped for the exact same app. The CVE was "Reserved" just 3 days before the vendor promised me the credits in writing.
• The Dilemma: The public CVE credits Cisco Talos and the technical description is different from what I reported (it talks about unencrypted legacy APIs, whereas I reported a TLS chain validation flaw). However, given the identical timeline and app, I strongly suspect they might be related, or affecting the same component.

Since the vendor is ignoring my comments, I want YesWeHack to step in so I can get clear answers on whether this CVE is connected to my findings, and why the payout matrix wasn't respected.

My Question:

What is the best way to open a support ticket or call for mediation with YesWeHack staff when a vendor ghosts you? Has anyone experienced something similar?

Thanks!

I worked in forensics for many years and one of the most annoying things in MFT/Journal analysis, is that initial work of prepping the files until they are readable by humans (size, format, timeframe). I used to export to csv, open in emeditor, then carve out the time periods I did not care about, but that took time and was not reliable.

Now, with the emergence of AI, I was finally able to create the app that does it.

It basically allows you to select a timeframe, extensions you do or do not care about, folders you wish to exclude, and go on your merry way of exporting the valid but carved out MFT for use in other tools or a CSV for use in your favorite tools, too.

As this could be a collaborative project... and I will NEVER sell it, it will remain free (and maybe even open source) - what else would you like to see in such an app? Mods, am I allowed to add a link to a free tool here?

https://preview.redd.it/smc3u9vl679h1.png?width=2470&format=png&auto=webp&s=8435e8ed9428b9d46396d069816eefe7fe631af1

I am almost certain there is no free or paid software out there that allows this kind of laser-focused carving of MFT files for speed of analysis. If the mods allow it, I'll post a link to the download. It's Freeware.