Zack Whittaker

@zackwhittaker

Security editor, TechCrunch Signal: zackwhittaker.1337 My stories: techcrunch.com/author/zack-whittaker My newsletter/blog: this.weekinsecurity.com

332 Following17,235 Followers1,115 Posts

Telegram Reddit Bluesky

Is this your profile?Claim it and zackwhittaker.dirty.social is yours.Claim profile

Zack Whittaker@zackwhittaker· Jul 7

Took a photo of this license plate a few days ago while on vacation in Maine, seems apt today.

a Maine license plate on a red Honda that reads: "UGHHH", followed by a bumper sticker that just reads: "[SCREAMING INTERNALLY]"

Zack Whittaker@zackwhittaker· Jul 6

a screenshot of a tweet from Damien Owens, which reads: "I'm 50. All celebrity news looks like this: CURTAINS FOR ZOOSHA? K-SMOG AND BATBOY CAUGHT FLIPPING A GRUNT."

Zack Whittaker@zackwhittaker· Jul 2

Sign up (or RSS!) for my newsletter this.weekinsecurity.com for all the cyber news you need to know from the week, plus stuff you might've missed, and much more — including a new reader-submitted cat (or friend) in every edition. Handwritten by me, no slop. Here's my cat Theo "helping" me write.

my grey fluffy cat Theo can be seen stood on my wooden office desk, directly in front of the camera, with my laptop and other computer in the background. he's blocking my way to both computers.

Zack Whittaker@zackwhittaker· Jul 2

Nice to be back home and online after a relaxing few days away, went outside to water the plants on the deck and OH FOR FU... guys, c'mon, AGAIN?!

a very cute but also very guilty-looking pigeon on my balcony in the distance looking at her two eggs that she laid in front of her, on our green astroturf, surrounded by a few twigs as a makeshift, albeit quite shit nest.

Zack Whittaker@zackwhittaker· Jun 19

In case you're wondering if I manually went through every top US company's website and checked for security.txt files, vulnerability disclosure programs, and bug bounties — and whether they paid for bug submissions? Exactly. And yes, it took me a while! More: this.weekinsecurity.com/dozens-of-am...

a screenshot of a table showing the first few rows of the Fortune 100 companies, featuring Apple, Amazon, Walmart, UnitedHealthGroup, and others, and whether they have a security.txt file on their website, as well as a vulnerability disclosure program and/or a paid bug bounty.

Zack Whittaker@zackwhittaker· Jun 18

My adorable large adult cat son Theo had high blood pressure (what reason does he have to be stressed? he's a cat, he doesn't even pay rent). After some medication, he's doing great. Still something hilarious about cats having their own blood pressure machines. His brother Toby was being very sweet.

my grey russian blue cat Theo, sat on top of my sofa cushions, with a blood pressure cuff on his arm next to a blood pressure machine.

my grey cat Theo, sat on top of my sofa cushions, with a blood pressure cuff on his arm, next to a blood pressure machine. Toby is my tabby cat who is stood next to the machine, looking pensive.

Zack Whittaker@zackwhittaker· Jun 3

The spire of One World Trade in NYC was lit up for Pride Month. 🏳️‍🌈

a photo of the spire of One World Trade Center in Manhattan; it's dark and there are lights on in the buildings on the skyline. The spire is lit up in rainbow colors.

Zack Whittaker@zackwhittaker· May 30

PostHog says it's currently experiencing a security incident. The analytics company said it's "rotating keys after a security research team was able to confirm an exploit in one of our AWS environments," referring to Amazon Web Services. Incident page: www.posthogstatus.com/incidents/01...

a screenshot from Posthog's status page, which reads: "We are rotating keys after a security research team was able to confirm an exploit in one of our AWS environments. We're working with the security research team on the issue. No keys were publicly available, and no data has been compromised. You may see impacts on exports, reverse proxies, and other services. We'll have more updates as we continue to work on this incident."

Zack Whittaker@zackwhittaker· May 27

Condé Nast shit the bed so hard when it fired four journalists last year that it's now settled with the union and given three out of the four reporters "two years’ pay and furnished [them] with positive letters of recommendation." UNIONS, PEOPLE. UNIONS! www.hollywoodreporter.com/business/bus...

a screenshot from the Hollywood Reporter piece, which reads: " Now, nearly half a year later, the union has reached a settlement with Condé Nast over the discipline, The Hollywood Reporter has learned. As part of the deal, the status of three of the four workers was changed from fired to being allowed to resign as active employees. They were each given nearly two years’ pay and furnished with positive letters of recommendation."

Zack Whittaker@zackwhittaker· May 22

Oh no! BASED APPAREL, the online store run by FBI director Kash Patel, was hacked to serve ClickFix attacks (🎻). Website visitors see a fake Captcha-style screen and are then tricked into hacking themselves by copying and pasting malware code. How this works: this.weekinsecurity.com/clickfix-att...

a screenshot of BasedApparel.com on Thursday, May 21, displaying a fake CAPTCHA designed to look like a Cloudflare page, but actually asks the user to copy code from the website and paste it into their computer's terminal, which hacks them.

BasedApparel.com is now down after the ClickFix attack was removed. (Friday, May 22).

Zack Whittaker@zackwhittaker· May 16

Bonus cyber cat from my local neighborhood eatery, who can be seen here strictly enforcing the "bathroom for customers only" policy. More cyber news and a new reader-submitted cyber cat (or friend) in every newsletter, out Sundays. this.weekinsecurity.com

a photo of a ginger cat in a local eatery seen with its front paws against the inside glass of the front door, and looking out at people walking past on the street. a sign on the door says: "bathroom for paying customers only."

Zack Whittaker@zackwhittaker· May 14

i haven't been able to search any of my messages on Mac or iPhone for about three years. my iPhone previously said it was "indexing." now it just nopes.

a screenshot showing trying to search anything in my Messages folder, and it just says "no results."

Zack Whittaker@zackwhittaker· May 13

U.S. President Donald Trump, as quoted by the White House pool report: "I don't think about Americans' financial situation. I don't think about anybody. I think about one thing, we cannot let Iran have a nuclear weapon. That's all." I want to embroider this quote onto a tea-towel for my in-laws.

A screenshot of a quote from a White House pool report, which reads:

Q: To what extent is the average American's finances motivating you to make a deal with Iran?
"The only thing that matters when I'm talking about Iran, they can't have a nuclear weapon. I don't think about Americans' financial situation. I don't think about anybody. I think about one thing, we cannot let Iran have a nuclear weapon. That's all."'

Zack Whittaker@zackwhittaker· May 12

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails. Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.

a screenshot of a real Microsoft email account notification being abused to send spam/phishing messages to users.

Zack Whittaker@zackwhittaker· May 7

Ahahaha. GOOD! Finally, I have actual documented proof that these two large handsome cat loaves actually like each other enough to snuggle.

my large handsome adult cat sons Theo (left, a grey russian blue) and Toby (right, a tabby) snuggling on some blankets and holding each others' paws; Theo is looking (begrudingly) at the camera while Toby is trying to pretend that he hates it.

Zack Whittaker@zackwhittaker· May 6

there was a whole chaotic thread on reddit doing the math and i think the general consensus was somewhere between 1.65 million and 1.92 million stolen KitKats? not sure on who was behind it but here's my amuse-bouche speculation from beyond the paywall:

a screenshot from my article, which reads:

"From there, the stolen goods can either be sold on, or held indefinitely until the shipper pays the hackers a ransom. Or, maybe some criminal mastermind somewhere desperately wanted a lifetime supply of KitKats? I don't know — and I try not to judge."

Zack Whittaker@zackwhittaker· Apr 23

I mean... 😅 this.weekinsecurity.com/fbi-agents-v...

a screenshot from a movie, a character is on the gallows with a rope around his neck, and turns to the guy next to him, in the same situation, and jokingly says, "First time?"

Zack Whittaker@zackwhittaker· Apr 22

So... Anthropic spent weeks claiming that it couldn't publicly release its Mythos AI model because of its alleged offensive hacking capabilities and.... some AI nerds from Discord found and accessed it? Anthropic is a fucking joke. www.bloomberg.com/news/article...

a screenshot from Bloomberg's story, which reads: "The users relied on a mix of tactics to get into Mythos. These included using access the person had as a worker at a third-party contractor for Anthropic and trying commonly used internet sleuthing tools often employed by cybersecurity researchers, the person said. The users are part of a private Discord channel that focuses on hunting for information about unreleased models, including by using bots to scour for details that Anthropic and others have posted on unsecured websites such as GitHub."

Zack Whittaker@zackwhittaker· Apr 20

thank you @burriscommaben.bsky.social.

Zack Whittaker@zackwhittaker· Apr 19

Here is Toby "helping" me write this week's edition of my cybersecurity newsletter. Sign up before it goes out later this morning! this.weekinsecurity.com

my tabby cat Toby laying on a blanket looking very handsome.

Zack Whittaker@zackwhittaker· Apr 7

It's incredibly bleak out there in the world today but I will take a little solace in just how soft and fuzzy my large adult cat son is.

a photo looking from above of my cat, Theo, a grey Russian blue with white socks/feet, who has fallen asleep upside down on the carpeted floor of my office at home.

Zack Whittaker@zackwhittaker· Mar 4

Seems like the whole world is melting down so I'm gonna break my longstanding rule of not posting my feet to the internet to post this snap of my incredibly handsome loaf cat.

my cat, Theo, grey and white Russian blue, laying on the floor, almost collapsed, on my foot, curled up with his paws up and looking me straight in the camera, like "draw me like one of your french girls"

Zack Whittaker@zackwhittaker· Feb 24

Conduent's handling of its data breach has been truly shit, refusing to say how many people are affected, or how the breach occurred. Conduent hid its breach notice with "noindex" code, so you won't see the page in search results. It doesn't even *mention* a breach! techcrunch.com/2026/02/24/c...

a snippet from Conduent's data breach notice, which contains "noindex" code so that it can't be found in search engine results.

Zack Whittaker@zackwhittaker· Feb 8

I had no idea that pigeons are so awesome. Sure, they can't build a nest for shit, but clearly they found a place of safety, took care of each other, loved their babies, and did a great job of raising their young. They're smart and resilient. And I'm really proud of them! Thanks for reading! /FIN.

an iPhone notification saying: "Home: Birdcam is offline," to show that the birdcam is no longer streaming after the pigeons left.

Zack Whittaker@zackwhittaker· Feb 8

And within a week, they were gone! We saw them flapping on the balcony, increasingly getting lift… sometimes flying into our balcony doors (with less frequency; they learned quickly enough!) On Jan. 8, the second baby pigeon took off into the world. Me: 🥲

Zack Whittaker@zackwhittaker· Feb 8

By the first week of January, the fledglings emerged from under our furniture and started exploring our balcony for the first time. They were pretty confident by the looks of it, and their parents were on the neighbor's balcony keeping watch. (Redacted for opsec.)

one of the birds can be seen outside the nest, purched on a chair propped up against the window. the pigeon is a little over a month old.

Zack Whittaker@zackwhittaker· Feb 8

And a particularly funny moment when bird meets Birdcam.

the red light from the birdcam can be seen reflecting in the face of one of the baby pigeons, and you can see the pigeon up close.

Zack Whittaker@zackwhittaker· Feb 8

We're now at Dec. 31 and they're now fledglings, with much of their feathers grown and they will soon leave the nest and fly away. (Any time they get excited, or fed, we can hear them chirping from the other side of the glass; our regular reminder that we are pigeon landlords.)

Zack Whittaker@zackwhittaker· Feb 8

I wasn't kidding when we called it Birdcam. Look at this little face! (Yes, this video feed was end-to-end encrypted.)

a screenshot from my iPhone showing the "Birdcam" camera, featuring a live shot from the baby pigeons.

Zack Whittaker@zackwhittaker· Feb 8

All the while, these pigeon babies are getting bigger, their feathers are developing, and they're getting more inquisitive, gaining independence from their parents.