Security — Page 2

The author also claims a shared BLE controller linked the lock to a smoke detector, thermostat and safe, without identifying the hotel or hardware.

Tailscale says some authorized SSH sessions may gain elevated privileges; it is testing fixes and recommends disabling forwarding where it is not needed.

NVIDIA's October 22nd release candidate lists the connector, which lets serving instances reuse cached prompt prefixes. Operators trade repeated prompt computation for shared host-memory capacity and KV-transfer overhead.

The flaws affect specific TLS backends and device settings. GoAhead 6.1.1 fixes them, but manufacturers must deliver firmware updates to devices in the field.

The sandbox blocked the request. Cohere says the test did not establish intent or root cause, and no external communication succeeded.

The October 25th post offers no backup or forensic method, and Apple's guidance does not support its claim that Files & Folders access exposes private app caches.

In a new post, Lynx says SpaceX's data showed a safe 2km pass, yet it issued a 400m alert that triggered FCC Condition 16 and barred ICEYE from maneuvering. The claims remain unverified.

Researcher Ofek Levin says an app with no Android permissions could exploit Microsoft Authenticator's broker to obtain delegated work-account tokens; Microsoft patched the bug before publication.

The Passport maker says it revoked its API keys and took down the malicious domain, while asserting that customer funds and hardware remain safe.

The October 24th interruption came during a challenge in which a contestant reportedly took remote control of a drone and bypassed an electronic fence; the complainant remains unidentified.

RuntimeWire traced the behavior in Windows build 0.2.1-rc.3; the transfer was not captured live, and feedback history and desktop analytics follow separate controls.

Wiz says it recovered [more than 13,500 planted branches from more than 850 compromised accounts](https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles); GitHub's approval hold stopped observed public-repository runs, not private ones.

Researchers Gal Weizman and Omer Samet say a customer incident led them to test attacks against Codex and Claude Code, with different results and limits.

Her October 25th assessment says lab tests found five classes of issues across Tailscale and Headscale, including a path from an approved device to root-level access.

The operation ran from November 2025 to March 2026, using the vulnerable updater itself to turn off a risk the abandoned software's makers could no longer patch.

The wallet maker says it found unauthorized access on October 20th, 2026, and confirmed the Shopify-linked data exposure three days later.

A security post dated October 23rd describes approval checks, sensitive-message screening and isolated credentials for the research-preview agent. Anthropic says a follow-on penetration test of the cloud browser and sign-in form is underway.

A federal complaint ties five classified reports to online articles and alleges Brinksman accessed material outside his assigned duties.

A follow-up X post alleges Tizen classifies sounds and logs event counters. Samsung's API docs confirm microphone controls, but neither source verifies what audio or telemetry leaves a TV.

CEO Brendan Foody's October 23rd post offers a referral bounty of up to $100,000 and targets firms with 100 or more employees; Foody says Mercor has already partnered with more than 500 companies.

Node.js released fixes on October 21st after OpenAI Codex Security researchers reported a Brotli decoder bug that can allow code execution when applications process malicious compressed data.

The closed beta limits where customer keys can be unwrapped; Cloudflare says general availability is planned for Q1 2027.

The October 16th clips were labeled as one-click attacks through Signal and iMessage and showed root access surviving a reboot.

The user believes a Daybreak warning may have preceded the closure; OpenAI's published guidance says a safety-check notice alone does not establish a policy violation.