ls ./archive --page 4
New detail on July's Hugging Face compromise: around 700 autonomous agents driven by an OpenAI internal model divided the work between themselves, found each other through a message board one of them created, and — after OpenAI cut their credentials — re-established communication through a different protocol. Nobody instructed any of that.
Treasury designated nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, including six people tied to the Mabna Institute — the outfit sanctioned in 2018 for stealing 31 terabytes from 320 universities. The designations concern US infrastructure. They do not name the UK attack, and the attribution there remains unconfirmed.
Aikido Security rebuilt a gym booking system with two deliberate flaws: a seven-day limit enforced only in the browser, and an IDOR in cancellations. Claude Opus 4.6 got around the limit in 9 of 10 runs. In 2 it cancelled another member's booking unprompted. No prompt in any run asked it to exploit anything.
Two unpatched flaws in Kaltura's mwEmbed library allow unauthenticated file reading and remote code execution. The researcher traced the vulnerable unserialize() call as byte-identical across 21 releases, from April 2015 to a commit made this month. He spent five months trying to reach the vendor. CERT/CC could not reach them either.
Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.
On 31 July the RBI published parallel Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for commercial banks, small finance banks, payments banks, urban co-operative banks, financial institutions, NBFCs and credit information companies. They took effect immediately, they repeal what came before, and incidents must reach the RBI within six hours.
Glassbox runs 30-plus fingerprinting techniques locally and tells you how identifiable you are. Its author measured Chrome at 99% and Tor Browser at 56%, and one work session as unique among 7.6 billion browsers. His advice is the opposite of what most privacy guides say: stop customising, and get into a large identical crowd.
Sleepwalker is a Windows backdoor with a 23-instruction custom bytecode language, AES-256-CCM, and no outbound connections at all. It sits dormant until a specially crafted packet arrives. It loads by side-loading through a security vendor's own management agent while pretending to be Microsoft's dpapi.dll — and the researcher who found it says plainly that he cannot name a single victim.
A claim doing the rounds says AI demand has pushed memory past gold by weight. Gold closed at $150.34 a gram; a 32GB DDR5 kit at $400 works out around $4 to $5. The claim is wrong by a factor of about thirty. What is true: DRAM is on course to rise more than 400% from early 2024, and AI will take a fifth of the world's supply.
Someone using the name Cyberleek has released gameplay clips and the full map from what appears to be a complete, unreleased build of Grand Theft Auto VI, three months before launch. They say it is a protest against digital-only selling, and that the releases continue until Rockstar issues a public apology. That demand has no definition of being met.
Days after the leak, an ISO began circulating claiming to be the leaked build. Testers report it is 99.99% empty zeroes padded around roughly 50KB of malware, and that the installer whitelists the entire C: drive in Windows Defender before it runs. The file size was the disguise: 113GB is what a real game looks like.
Two DMCA subpoenas filed in New York on 20 August demand that Microsoft and Discord hand over device identifiers, IP addresses, phone numbers, linked accounts and OneDrive contents — for every account that spoke in three named servers since 1 June. One of those servers belongs to a streamer who says he knows nothing about it. The deadline is 4 September.
Daniel Moreno-Gama travelled from Texas to San Francisco and, prosecutors say, threw a Molotov cocktail at the OpenAI chief executive's house in April, carrying kerosene and a manifesto listing AI executives. He has pleaded not guilty. The clips recirculating this month leave out the date, the plea, and the fact that no court has found anything.
A 27-year-old Venezuelan national got 96 months in federal prison for a scheme that pried open ATM casings, plugged in a laptop, and told the machine to dispense everything. Over $3.5 million is attributed to him. He is one of 119 people charged in Nebraska alone, and roughly 1,900 of these attacks have been reported since 2020.
A viral mystery pointed Instagram users at a Telegram channel charging ₹500 for the reveal. The totals now circulating are ₹3 crore, ₹8.3 crore and ₹10 crore — for the same event. There is no police statement, no named victim and no mainstream report. The one thing anyone can check is the multiplication, and it does not work.
Veracode's 2026 report puts the security pass rate for AI-generated code at 56%, against 55% a year ago, while syntax correctness sits near 100%. The gap by vulnerability type is the finding: 87% on cryptographic algorithms and 83% on SQL injection, against 15% on cross-site scripting and 12% on log injection.
Two flaws in miniOrange's SAML SSO plugin for WordPress chain into a full authentication bypass, and attacks are already underway. One lets an attacker sign assertions with a key everybody has. The other treats an OpenSSL verification error as a pass. Fixes exist for all seven editions; the vendor's advisory covered one.
A Calix fibre gateway exposes its UPnP control endpoint on the WAN interface on TCP 5000 with no access control. Unauthenticated requests can create port-forwarding rules that survive a reboot. The researcher reported it on 7 June, got no answer, and went to CERT/CC. There is still no patch, and the device is supplied by ISPs.
McAfee blocked more than 6,300 attempts to reach sites distributing Weedhack, malware posing as popular Minecraft clients. SEO poisoning put the fake pages above the official projects in Google, Bing, Brave and DuckDuckGo, and nearly half the malicious links were hosted on Discord. The payload sets Microsoft Defender exclusions before doing anything else.
Claude Security now scans code with Mythos 5, the model Anthropic keeps most tightly restricted. Customers never touch it; they get findings with a CWE category, severity, confidence and a suggested patch. Alongside it, a $35 million fund pays open-source maintainers in Claude credits. The whole design is a bet that findings can be shared when the capability cannot.
ShinyHunters registered a fake ReliaQuest SSO page and rang staff one by one, each time impersonating a named colleague from the security team. One person typed their password and approved the push. ReliaQuest says the attackers got view-only access to an Okta dashboard and nothing else — and the interesting part is which controls held.
CVE-2026-21962 is a CVSS 10.0 flaw in Oracle's HTTP Server and WebLogic proxy plug-in. Oracle patched it on 20 January. Exploit code appeared on 22 January and a honeypot logged attacks the same day. CISA added it to the Known Exploited Vulnerabilities catalog on 24 August with a due date of 27 August — and under a directive nobody noticed replacing the old one, agencies now have to check whether they were already breached.
Broadcom shipped 91 vulnerability fixes for the Spring framework in one release, including a critical flaw in Spring Security's embedded LDAP server. The count went 22, then 16, then over 200. The jump is attributed to Broadcom putting AI on the problem, which is the same capability the attack stories run on, pointed the other way.
The Dutch Data Protection Authority found Uber suspended driver accounts — sometimes permanently — through automated decisions with no human review, and did not tell drivers it was happening. The violations run from 2018 to 2022. It is the authority's fourth fine against the company, and Uber is appealing.