On the night of 19 October 2026 an attacker abused UpdraftCentral, the remote management service built into UpdraftPlus, a backup plugin with more than 4 million installations, and planted a backdoor on two of our three websites. Our sites were fully up to date and the fault was not on our side: the attacker signed the commands with valid keys that the UpdraftCentral Cloud service generates and keeps. We publish an analysis of the backdoor, indicators of compromise and a...
Read More
In one evening we built an AI-assisted ORSR aggregator: one click gives the birth number, signature, home address and health insurer of any Slovak company director. And we priced out harvesting the entire register: the cost of a used laptop.
Read More
A senseless Slovak statute published the birth numbers, addresses and certified signatures of company directors — and it is not a bug, it is written into Section 100(3). We are convinced the greatest threat to citizens privacy today is the state itself.
Read More
Slovakia’s e-invoicing act contains not one mention of personal data protection. The bar association asked to shield client identities — rejected. The secret service asked the same for itself — accepted.
Read More
Mandatory e-invoicing from 2027 hits 530,726 entities in Slovakia. The government never costed the one fee businesses will actually pay.
Read More
Summer is here — and so is our favourite tradition. The 13.37% hacker discount is back. But this year we are going further: you can stack a second 13.37%, and we are being radically transparent about how — and whether — AI ever touches your data. 1. The summer hacker discount: 13.37% off everything Through […]
Read More
A practical look at how today's protocols and services could already make a self-replicating, autonomous AI possible — anonymous crypto wallets, no-KYC VPS/GPU providers, censorship-resistant inference, Nostr coordination, and the implications.
Read More
For our loyal and new customers, we are offering a 13.37% discount on all penetration tests and security audits, provided the binding order is received by August 31, 2025, and the work commences before this date. If you are planning penetration testing or security audits this year, consider rescheduling them for the summer. Not only […]
Read More
The problem of mobile anonymity Dystopia is in full swing in Europe, and achieving true anonymity from mobile devices is a big problem. The picture below shows that most countries require mandatory registration of SIM cards on the national ID or passport. This means that all mobile operators in a given state (and, of course, […]
Read More
When on a security audit for a client it was discovered that a key component – the open-source private paste service PrivateBin contained a previously undocumented flaw. Cross-site-scripting is nothing new. I actually feel there must be prehistoric cave paintings and markings somewhere in the world containing some variation of <script>alert(1)</script>. Although XSS payloads embedded […]
Read MoreHow to get an EU vaccination card for any citizen of the Slovak Republic based on their name and date of birth 1 Vulnerability history Similar to our recent revealed vulnerability in the NCZI systems (NCZI or NHIC National Health Information Center), where we were able to download 130 000 PCR/antigen tests and personal information […]
Read More
Job Description: Search for security vulnerabilities in Android/iOS apps and in the most diverse web applications and web services. Testing of mobile applications involves detailed testing of mobile applications and relevant web services in accordance with the OWASP Mobile Security Testing Guide. The result of the testing is documented by creating a final report in […]
Read More
