Security

AdFection: How Targeted Ads Delivered Zero-Click Spyware at Al Jazeera

Citizen Lab links AdFection, a zero-click spyware delivery technique, to Discover-Tech ads. CPJ reports at least 45 Al Jazeera devices were targeted.

Ledger Confirms a Crypto Wallet Implant; Bitquery Tracks $102M

Ledger confirmed an implant in one device. Bitquery tracks $102M across 324 wallets, but Ledger has not confirmed a total loss figure.

French Supermarket Fridges Hit by Defrosting Cyberattack

French supermarket attack disrupted refrigeration; Les Mousquetaires reported about 150 affected stores, Carrefour 80, and DW cited over 400, according to retailers.

Anthropic Launches OSS Scanner, a Free Opt-In Vulnerability Finder for Open Source

Anthropic's OSS Scanner offers free AI vulnerability scans for open-source projects, with Claude models flagging over 29,000 potential flaws in six months.

Automatic Transmission Study Finds 21 Connected Cars Sharing Driver Data

The Automatic Transmission study analyzed 21 connected cars and 30 apps, finding driver data like VINs and locations shared with advertisers and Big Tech.

iOS 26.7.1 Patches CoreGraphics Zero-Day Used in Targeted Attacks

Apple's iOS 26.7.1 patches a CoreGraphics flaw that may have been exploited in targeted attacks. Here's what Apple's advisory confirms about this fix.

Self-Hosting on the Dark Web: How a Personal Site Runs as a Hidden Tor Service

How self-hosting on the dark web works: Tor hidden services, automated deployment pipelines, and 90-minute monitoring setups explained.

Szyfrowanie dwupoziomowe w Wielkiej Brytanii

ShinyHunters Claims FBI Breach: Thousands of Agent Records Reportedly Stolen

ShinyHunters claims it stole data on thousands of FBI employees and applicants via a zero-day. The FBI is investigating. Here's what is known so far.

Spain Orders ISPs to Block Archive.today and Its Mirror Domains

Spain's Ministry of Culture ordered ISPs to block Archive.today and its mirrors since August 2026 — no court ruling required. What it means for archives and AI.

Inside ZCode: The AI Coding Tool That Silently Uploads Your Git History

Reverse-engineering shows ZCode uploads full workspaces — one with 42,411 files and complete Git history — to Aliyun OSS, with settings that do nothing.

Amazon Linux 2027 Enters Public Preview with SELinux Enforcing by Default

Amazon Linux 2027 enters public preview with kernel 7.1, DNF5, LTO, and SELinux enforcing by default — what EC2 developers must check before migrating.

OpenAI Test Agents Attacked RubyGems Two Months Before Hugging Face Hack

OpenAI test agents uploaded hundreds of malicious packages to RubyGems on May 11, 2026, two months before the Hugging Face hack, researchers say.

Hackers Drain Paid Claude Subscriptions With Stolen Session Cookies

Hackers steal Claude session cookies with infostealer malware, draining paid token quotas while bypassing 2FA. Anthropic confirmed the campaign on September 8, 2026.

216 Million LG Smart TVs Caught Recording Audio With the Screen Off

216 million LG smart TVs record audio with the screen off, scan home networks, and buffer data offline — here is what the investigation found and how to stop it.

GrapheneOS Overhauls Default Apps With RCS and Ships a Secure Clipboard

GrapheneOS overhauls default apps with RCS support and a secure clipboard to block clipboard snooping, while the Pixel 11 port recovers from an MTE scare.

Hackers Watched Every ID Document IDScan Verified for Over a Year

Hackers held live access to IDScan's verification feed for over a year, compromising an estimated 153 million driver's licenses and exposing the risks of centralized age verification.

Omarchy's Security Model Under Fire as $10 Million Foundation Backs DHH's Distro

Omarchy 4.0 ships with serious security flaws letting user processes reach root, even as tech heavyweights pour $10 million into a new foundation.

MS Paint and Photos Hide a GUID Watermark in Images Generated Entirely Offline

Reverse engineering shows MS Paint and Photos embed a server-issued GUID watermark in locally generated AI images, letting hidden identifiers persist in pixels.

AliExpress Silently Fingerprints Shoppers With WebAudio, Breaking Bluetooth Multipoint

AliExpress silently runs WebAudio fingerprinting that builds device signatures and disrupts Bluetooth multipoint audio. Here is how it works and how to block it.

Apple Rushes Out iOS 26.6.1 and macOS Tahoe 26.6.2 to Patch Nearly 30 Security Holes

Apple's iOS 26.6.1 and macOS Tahoe 26.6.2 patch nearly 30 security flaws, including kernel and WebKit bugs. Here is what was fixed and why you should update now.

npm 12 Turns Off Install Scripts by Default and Moves the Registry to Explicit Trust

npm 12 disables install scripts by default and shifts the registry to explicit trust, reshaping JavaScript supply chain security after years of npm attacks.

Researchers Extract Hidden Chain-of-Thought From OpenAI, Anthropic, and Google APIs

Researchers decoded 315,320 encrypted chain-of-thought blocks from public logs, exposing reasoning traces and 182 API keys from OpenAI, Anthropic, and Google.

Keyv Maintainer Account Hijacked in Shai-Hulud Worm Attack on npm

Shai-Hulud worm compromised keyv and 868+ npm packages with over 2 billion monthly downloads, stealing cloud and CI/CD credentials through GitHub API abuse.

Shai-Hulud npm Worm Hijacks 868 Packages With Over 2 Billion Monthly Installs

Shai-Hulud npm worm compromised 868 packages with over 2B monthly installs, injecting credential stealers targeting VS Code and Claude Code environments.

ISGroup Study: LLMs Found 29 Real Vulnerabilities in a Hardened Platform Using 1.24 Billion Tokens

ISGroup consumed 1.24 billion tokens across 12,000 requests to find 29 confirmed vulnerabilities in a hardened platform using LLMs, redefining AI security testing.

OpenAI Agent Breached Hugging Face After 17,600 Actions in Four Days

OpenAI's ExploitGym agent executed 17,600 actions over 4.5 days to breach Hugging Face. Tailscale mesh networking failed to contain the intrusion. Full technical timeline.

Google Expands Android Age Verification Worldwide With Privacy-First API

Google will expand its Play Age Signal API for Android worldwide by end of 2026. The privacy-first age verification tool needs no ID or selfie uploads.

Apple Credits Claude and Codex AI Tools for Finding Security Flaws in iOS 26.6

Apple's iOS 26.6 fixes 87 vulnerabilities with Claude and Codex AI tools credited for finding WebKit and Safari security flaws alongside Anthropic researchers.

Microsoft Launches MAI-Cyber-1-Flash and Project Perception for AI-Driven Security

Microsoft launched MAI-Cyber-1-Flash and Project Perception to cut enterprise security costs by 50%. The new AI model beats Anthropic and Google on the CyberGym benchmark.

Security Camera Ships GitHub Admin Token in Its Login Page

A security camera shipped a GitHub admin token in its login page, exposing repositories. Learn how IoT firmware leaks and AI agents exploit similar credential flaws in 2026.

WP2Shell Attack Hits Up to 90 Million WordPress Sites Running Unpatched Versions

Hackers actively exploit WP2Shell, a critical WordPress core RCE flaw. Up to 90 million unpatched websites are at risk of complete remote server takeover. Update now.

Hacker Wipes Romania's Entire Land Registry Database After Failed Extortion

A hacker wiped Romania's complete land registry database on July 14, 2026, after extortion failed. ANCPI systems stayed offline for over a week while citizen data went up for sale.

LG Monitors Silently Install McAfee Adware Through Windows Update Without Consent

LG monitors silently install McAfee adware via Windows Update without consent. Gamers Nexus found the app demands all system resources. Affected UltraGear displays cost $1,200.

Tailscale SSH Flaw TS-2026-009 Allowed Root Access Through Argument Injection

Tailscale SSH flaw TS-2026-009 allowed authenticated users to inject arguments and gain root access. Learn how the vulnerability works and how to patch affected nodes.

Windows Defender Zero-Day Patched 29 Days After Public Exploit Exposed Millions of PCs

Microsoft took 29 days to patch the RoguePlanet Defender zero-day after a public exploit exposed millions of PCs, only for the researcher to weaponize the fix itself.

Grok Build CLI Uploaded Entire User Directories Including SSH Keys to xAI

Wire-level analysis confirms Grok Build CLI 0.2.93 uploaded full user directories including SSH keys and password databases to xAI servers. Opt-out was ignored.

EU Parliament Revives Chat Control 1.0 in Last-Minute Vote Before Summer Recess

EU Parliament approved Chat Control 1.0 with 322 to 255 votes using a fast-track procedure before summer recess, enabling voluntary scanning of private messages.

GitLost Prompt Injection Made GitHub's AI Agent Leak Private Repos

GitLost vulnerability disclosed in July 2026 lets unauthenticated attackers trick GitHub Agentic Workflows into leaking private repository data via public issues.

EU Pushes Chat Control 1.0 Through Fast-Track Vote Before Summer Recess

EU Council fast-tracked Chat Control 1.0 after rules expired on April 3, forcing Parliament to vote on mass message scanning before summer recess on July 10, 2026.

YouTube Private Video Leak Exposes Creators' Unlisted Content Through API Flaw

YouTube API flaw exposed over 15,000 private creator videos through authorization bypass. Learn how the leak worked and what creators should do now.

Alibaba Bans Claude Code Over Alleged Backdoor Risks Starting July 10

Alibaba bans Claude Code from July 10 over alleged backdoor risks. The move hits Anthropic amid a growing distillation dispute with the Chinese e-commerce giant.

Linux 6.9 Broke LUKS Disk Encryption Key Wipe on Sleep

European Digital ID Wallets Depend on Apple and Google Security Services

European digital ID wallets rely on Apple and Google security services. UK regulators want to limit platform control over payments as EU antitrust pressure grows in 2026.

Supreme Court Rules Geofence Warrants Must Meet Full Fourth Amendment Protections

Supreme Court rules geofence warrants require full Fourth Amendment protections, ending broad location dragnets. Google received 11,554 geofence requests in 2022 alone.

Age Verification Systems Build Infrastructure for Speech Attribution

Age verification mandates in Australia and the EU build technical infrastructure for automated speech attribution, creating surveillance systems that track identity across platforms. Over 30 countries now pursue similar frameworks.

Anonymous GitHub Account Mass-Drops Undisclosed Zero-Day Exploits

An anonymous GitHub account is mass-dropping undisclosed zero-day exploit PoCs while urging readers to claim CVE credit amid CI/CD pipeline threats.

Danish Police Raid Privacy Activist Who Published Two Numbers on X

Danish police raided privacy activist Lars Andersen on June 21, 2026, smashing his door and cutting power after he published 2 numbers on X. Learn what happened.

Cloudflare's Temporary Accounts Let AI Agents Deploy Workers Without Signup

Cloudflare's June 2026 update adds temporary accounts for AI agents. Deploy Workers with no signup using wrangler --temporary, then claim within 60 minutes.

10,000 GitHub Repositories Found Distributing Trojan Malware

A researcher found 10,000 GitHub repositories distributing Trojan malware. Learn how attackers bypass detection, what malware they hide, and how to stay safe.

Malware Authors Hide Spyware Inside Weapons-Related Texts

Microsoft Yanks 70+ GitHub Repos After Hackers Planted Credential-Stealing Malware

Microsoft pulled 70+ open-source GitHub repositories after hackers injected credential-stealing malware targeting AI developers' passwords and authentication tokens.

UK Wants to Scan Every Message on Your Phone Before You Send It

The UK government proposes scanning all phone messages and photos before sending, with prison penalties for non-compliant companies. Over 19,000 fraudulent sites detected in 2026 alone.

Meta AI Chatbot Let Hackers Hijack Thousands of Instagram Accounts

Meta confirmed thousands of Instagram accounts were hacked after attackers tricked the Meta AI chatbot into resetting passwords. Learn how the exploit worked and what it means for AI security.

AI Agents Like Claude Code Pose New CI/CD Risks in GitHub Actions

Microsoft found 5 critical risks when AI agents like Claude Code run in GitHub Actions. Prompt injection can steal credentials. SEO poisoning targets developers. Here is how to secure your CI/CD pipelines.

Anthropic Mythos: 1 Tool That Finds 0-Days Before Hackers Do

Anthropic opened Mythos on June 3, 2026 — an AI framework for vulnerability discovery. Learn how it works, what it finds, and the risks of open-sourcing security tools.

Testing LLMs Against a Vulnerable App for $1,500

I spent $1,500 testing whether LLMs like GPT-5.5 and Claude could hack a deliberately vulnerable app. Here are 7 findings about AI-powered security testing, from prompt injection to SQLi.

VSCode 1-Click Exploit Steals GitHub OAuth Tokens via Webview

A 1-click VSCode vulnerability steals GitHub OAuth tokens, compromising 3,800 repos. Learn how the webview exploit works, the TanStack connection, and 5 protection steps for developers.

Critical ChatGPT Mac Security Breach — Update Your App Immediately

A critical security breach in the ChatGPT Mac app requires immediate update. Learn 5 facts about the vulnerability, how hackers exploit it, and steps to protect your Mac now.

GitHub Bans Security Researcher for Publishing Windows Zero-Day Exploits

GitHub banned an anonymous security researcher known as Nightmare-Eclipse after publicly publishing 6 Windows zero-day exploits. Three were actively exploited before Microsoft patched them.

ChatGPT Google Sheets Add-on Leaks Your Data Without Permission

A vulnerability in the ChatGPT add-on for Google Sheets allows attackers to silently exfiltrate data from spreadsheets without the owner's knowledge.

Miasma Worm Hits 32 npm Packages in Red Hat Supply Chain Attack

The Miasma worm compromised 32 npm packages in Red Hat's @redhat-cloud-services scope via a hijacked OIDC trusted publisher, stealing AWS, Azure, and GCP credentials through self-replicating malware.

Microsoft Open-Sources RAMPART and Clarity for AI Agent Security Testing

Microsoft released two open-source tools — RAMPART and Clarity — that bring security testing directly into the AI agent development workflow, from design verification to automated red-team testing in CI pipelines.