Friday Squid Blogging: Bigfin Squid Off California Coast

Friday Squid Blogging: Bigfin Squid Off California Coast

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

Tags: squid, video

Posted on October 30, 2026 at 5:04 PM • 3 Comments

Billy Jack • October 30, 2026 6:05 PM

There are reports about a Claude extension to install persistent ssh backdoors.

From “Malicious Claude Code extension on Cursor planted SSH backdoors>news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/

Researchers at Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension’s extension.js file, leaving the legitimate extension code otherwise unchanged.

…

However, according to Phorion, coding errors in the malware’s SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems.

The mistakes prevented the malware from enabling SSH on machines where it was not already running, leaving the reverse tunnel unable to provide access to the compromised device.

ResearcherZero • October 31, 2026 12:49 AM

Trump ignored a spy plot at the center of Beijing’s efforts to target the CEO of Nvidia. Huang Le had a close relationship with the Nvidia CEO, a fact which was discovered during investigations into efforts to pass on trade secrets to China while working as an executive at Megaspeed, which markets itself an AI cloud datacenter company.

Export restrictions to prevent China obtaining advanced AI chips were relaxed due to the influence Nvidia CEO Jensen Huang had over Trump. Trump worried the spy plot would affect Nvidia stock. Nvidia denies that its CEO is of interest to Chinese intelligence.

Boxes of Nvidia parts delivered to Megaspeed had not been installed, and instead appeared ready to be shipped. Nobody is sure what Megaspeed really does, or if it’s actually based in Singapore. Singapore director, James Tan, lives in China and is “never present.”

Over the last year since being briefed by intelligence agencies, Trump has done nothing about the covert Chinese operation. Large risks lurk within digital products, their origins, unsound access controls, and interests that skirt proper procedure for profit.

‘https://arstechnica.com/tech-policy/2026/10/report-trump-did-nothing-with-intel-that-china-planted-spy-close-to-nvidia-ceo/

Unprofessional attitudes and practices within government, lead to a lax and unmeasured approach to security. Unsafe data handling practices. Poor access controls. Transfer of confidential records and sensitive information to insecure systems. Risky behavior.

https://www.techradar.com/pro/its-100-percent-a-national-security-threat-accenture-contractor-connected-an-ai-agent-to-the-pentagons-secure-network-and-then-sent-data-to-a-high-risk-website

Agencies largely stonewall GAO on audit of DOGE’s data practices

https://fedscoop.com/gao-report-doge-data-security-federal-agencies/