> InfoSec News Nuggets 10/27/2025

Ex-CISA head thinks AI might fix code so fast we won’t need security teams Ex-CISA head Jen Easterly claims AI could spell the end of the cybersecurity industry, as the sloppy software and vulnerabilities that criminals rely on will be tracked down faster than ever. Speaking at AuditBoard’s user conference in San Diego, Easterly said the threat landscape has never stopped evolving. The proliferation of data, platforms, and devices meant “we’ve expanded the attack surface for cyber threat actors like China and Russia and Iran and North Korea and gangs of cybercriminals.” Easterly said that if cybercrime was a country, it would be the third biggest in the world, just behind the US and China.   Man Alarmed to Discover His Smart Vacuum Was Broadcasting a Secret Map of His House Forget your phone spying on you — maybe it’s your vacuum you should really be worried about. In a post on his blog Small World, the computer programmer and electronics enthusiast Harishankar Narayanan detailed a startling find he made about his $300 smart vacuum: it was transmitting intimate data out of his home. Narayanan had been letting his iLife A11 smart vacuum — a popular gadget that’s gained mainstream media coverage — do its thing for about a year, before he became curious about its inner workings.   UN Cybercrime Treaty wins dozens of signatories, to go with its many critics The United Nations on Saturday staged a signing ceremony for the Convention against Cybercrime, the world’s first agreement to combat online crime. And while 72 nations picked up the pen, critics continue to point out the convention’s flaws. The Convention took five years to develop and has three purposes: Promote and strengthen measures to prevent and combat cybercrime more efficiently and effectively; Promote, facilitate and strengthen international cooperation in preventing and combating cybercrime; and Promote, facilitate and support technical assistance and capacity-building to prevent and combat cybercrime, in particular for the benefit of developing countries. Those goals are hard to oppose.   ‘There isn’t really another choice:’ Signal chief explains why the encrypted messenger relies on AWS After last week’s major Amazon Web Services (AWS) outage took Signal along with it, Elon Musk was quick to criticize the encrypted messaging app’s reliance on big tech. But Signal president Meredith Whittaker argues that the company didn’t have any other choice but to use AWS or another major cloud provider. “The problem here is not that Signal ‘chose’ to run on AWS,” Whittaker writes in a series of posts on Bluesky. “The problem is the concentration of power in the infrastructure space that means there isn’t really another choice: the entire stack, practically speaking, is owned by 3-4 players.” X Warns Users With Security Keys to Re-Enroll Before November 10 to Avoid Lockouts Social media platform X is urging users who have enrolled for two-factor authentication (2FA) using passkeys and hardware security keys like Yubikeys to re-enroll their key to ensure continued access to the service. To that end, users are being asked to complete the re-enrollment, either using their existing security key or enrolling a new one, by November 10, 2025. “After November 10, if you haven’t re-enrolled a security key, your account will be locked until you: re-enroll; choose a different 2FA method; or elect not to use 2FA (but we always recommend you use 2FA to protect your account!),” the company’s Safety handle wrote in a post on X. The post InfoSec News Nuggets 10/27/2025 appeared first on AboutDFIR - The Definitive Compendium Project.