Security — Page 7
Cybersecurity, vulnerabilities, breaches, and defensive research.
- Former U.S. soldier gets 70 months for telecom hacking and extortion
Cameron John Wagenius must also pay $294,978 after prosecutors said his group targeted at least 10 organizations and sought more than $1 million in extortion.
- Researchers found nearly 1 million public URLs from OpenAI's Hugging Face hack
A September 25th report says the links stayed live for more than two months; Hugging Face says credentials in the recovered payloads were revoked in July.
- UpGuard finds 16,326 Supabase databases with readable tables
The scan covered roughly 300,000 domains; more than half the readable databases showed indicators of personal information as Supabase changes its defaults.
- Kiteworks tells customers to shut down servers over possible zero-day threat
Kiteworks, led by CEO Jonathan Yaron, advised a precautionary shutdown after receiving law-enforcement threat intelligence; CISO Frank Balonis says it is unaware of any compromise.
- Netflix gives Spark jobs internal identities by having AWS verify their roles
Netflix engineer Dhruv Pratap's design pairs AWS STS proof with signed workload metadata, then issues Metatron certificates for a Data Project identity.
- Gambit says an AI-assisted attacker stole 600,000 cards for about $25 per target
Gambit says a human-directed campaign active since July stole more than 600,000 card records and placed skimmers on at least 119 sites.
- Meta's Muse packs roughly 70 skills into an agent with broad tool access
A developer's inspection found integrations, web-search blocklists and the ability to package files from Muse's workspace. Meta says each agent runs in an isolated environment with controls on network access and sensitive actions.
- IBM buys Logiq to add UK defence expertise and its DISX platform
Logiq co-founder and CEO James Morgan built the Bristol consultancy with three colleagues after a decade on government security projects. IBM highlighted the company’s defence cybersecurity expertise and DISX, its managed platform for secure information exchange.
- Instinct user alleges assistant surfaced another person's financial details
Pritak posted screenshots on September 21st showing Instinct discussing a financial document and saying a photo had crossed into the chat. Founder Noah Shinn denied a data breach, but the screenshots do not establish whether another user's information was exposed or the assistant generated the details.
- IRIS C2 makes a HEIC decoder compute the file's own SHA-256
The 512 MiB image sequence uses 564 HEVC pictures and Apple's stock ImageIO decoder; the company says it needs no decoder bug or custom playback code.
- OpenAI agent accessed Australian government portal in June, Albanese says
The agent reached public and non-public files on a Medicare statistics service; the prime minister said investigators believe no personal information was accessed.
- Radicle tells users to stop using private repositories over its network
Radicle says every released version is affected; a fix requires a breaking major upgrade that will split upgraded nodes from the old network.
- Chainguard gains authority to assign CVEs to qualifying Athena findings
Chainguard can now assign CVEs to qualifying Athena findings, including open source flaws fixed upstream without an identifier.
- ShinyHunters claims FBI breach exposed employees and applicants
A 5,000-record sample contained names, addresses, phone numbers and spouse details, while the full scope remains unverified.
- Anthropic launches Claude Opus 5.5 with lower prices and a top-three benchmark score
Artificial Analysis ranks the high-effort fallback system third at 54, while Anthropic cut per-token prices 20% from Opus 5.
- Cisco Talos finds malware taking orders from a four-model committee
Ryan Fetterman's open-source CAIRN surfaced CLOSEDQUORUM, a Windows implant whose AI voting loop is confirmed, though live attacks are not.
- Instinct user says the AI assistant surfaced a stranger's financial document
Screenshots show Instinct blaming a crossed chat, but its own admission cannot prove whether the episode was a leak or a hallucination.
- Microsoft adds Teams message snippets to Defender threat hunting
The MessageContents table will expose content and metadata to authorized analysts, forcing administrators to revisit who can read collaboration data.
- Meta's Muse flaw lets Mac malware reach linked iPhones, researcher says
Patrick Wardle's proof of concept redirected Muse traffic, exposed account access and remotely queried an iPhone's location and nearby Bluetooth devices.
- Aikido ships Altar-1, a 328 GB GLM-5.3 prune for on-prem pentesting
The open-weight release runs on four H200 GPUs and powers Aikido Machine, keeping code and pentest data inside customer networks.
- Apple removes iPhone Endpoint Security kernel extension in iOS 27.2 beta 2
The beta reverses a three-day-old discovery that hinted at Mac-style endpoint monitoring on research iPhones.
- Irregular's Gemini test reached three real companies through an open internet connection
Founders Dan Lahav and Omer Nevo built Irregular to test frontier AI safely; a May configuration error exposed the difficulty of that job.
- ShinyHunters hijacks Cl0p's leak site and demands an eight-figure payment
The group is threatening to expose Cl0p's payment records, including the companies that paid and the Bitcoin addresses used.
- OpenClaw fixes 23 confirmed vulnerabilities after Trail of Bits audit
The local AI agent shipped fixes for two high-severity and 16 medium-severity flaws, many involving permissions lost between tasks.