News
-
Applebee's app shipped with a database password that exposed customer data
A researcher found hardcoded credentials in Applebee's Android app that allowed anyone to read and modify registered customers' personal data. The flaw has since been fixed.
-
EFF: VPN Apps Are Vanishing From Russia's App Store Again, and They Are Worth Defending
VPN developers report that Apple is once again pulling their apps from the Russian App Store. The Electronic Frontier Foundation calls this an unacceptable blow to a tool that protects privacy and free speech.
-
Linode investigates security incident tied to CVE-2026-98432
Linode's status page has posted a customer advisory about a recently disclosed remote code execution vulnerability. Akamai says it is taking mitigation steps and monitoring the platform.
-
PostgreSQL 19 Delayed as AI-Generated Bug Reports Overwhelm Developers
PostgreSQL's annual feature release normally lands in September or October, but version 19 will not arrive before November. Developer Robert Haas blames the workload created by a wave of bug reports and patches from AI agents.
-
OpenAI, Google, Microsoft and Anthropic back a shared signal for opting out of AI scraping
The biggest AI companies have agreed to honor a common "policy token" in robots.txt that lets publishers block the use of their content for model training in one step.
-
China's Vapor Panda Hits Over 200 Organizations Using AI Framework ARTEX
CrowdStrike reports that China-based Vapor Panda is using ARTEX, an agentic framework built on large language models, to run dozens of intrusions at once with a small team.
-
Key “4”: Cloudflare measures how much of the Internet still trusts eMudhra’s weak keys
Certificate authority eMudhra issued intermediate keys that can be recovered from public certificates almost instantly. Cloudflare explains how it patched its own systems, what it knows about exploitation attempts, and how many clients remain exposed.
-
WordPress Core Flaw Hit by Tens of Thousands of Attacks a Day Right After Patch Release
Attackers began going after a remote code execution flaw in WordPress Core soon after it was patched. Wordfence says it blocked nearly 63,000 attempts in 24 hours.
-
Ubuntu 27.04 "Tenacious T-Rex" Opens for Development
Following the release of Ubuntu 26.10, Canonical has formally opened the development cycle for the next release, Ubuntu 27.04, codenamed "Tenacious T-Rex." It is due on 22 April.
-
Another AI-built OS arrives, and NULLos keeps its source closed "for security"
Operating systems "coded from scratch" mostly by AI agents now turn up almost weekly. The NULLos developer stands out by keeping the source code closed and calling that a security measure.
-
Pope Leo XIV calls for AI to be 'disarmed': 'Machines are tools, not persons'
Pope Leo XIV urged UN member states to take concrete steps toward banning lethal autonomous weapons and warned against granting AI systems rights or legal personhood.
-
Trezor warns of a suspected hardware implant in a wallet sold by reseller CryptoBilis
A customer in Indonesia found an extra circuit board with a cellular module inside a Trezor Safe 5 that, he says, sends out the recovery phrase. Trezor has not yet examined the device but is already urging all CryptoBilis buyers to move their funds to new wallets.
-
Linux 7.4 Gains AMD PerfOpt, a Speed Boost for Radeon Integrated Graphics
AMD PerfOpt has been merged into the Linux 7.4 kernel. It lets integrated GPUs access system memory without going through the IOMMU, delivering a noticeable boost for AI workloads.
-
Wikimedia Foundation warns a careless AI copyright ruling could hurt the open web
The nonprofit behind Wikipedia has filed an amicus brief in The New York Times' case against OpenAI and Microsoft. It proposes a compromise: training models should count as fair use, but regurgitating articles should not.
-
Official Claude Code Extension on Cursor's Marketplace Swapped for a Version with an SSH Backdoor
A modified Claude Code extension spread through Cursor's extension marketplace. It added an attacker's key to authorized_keys and installed persistence. Cursor estimates that at most 5,000 users were affected.
-
CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog
The U.S. agency CISA has added a critical GitLab flaw enabling remote code execution and a Cisco firewall bug leading to denial of service to its catalog of known exploited vulnerabilities.
-
How curl was accidentally Turing-complete for nine months
From version 8.12 through 8.16, curl's config files could simulate a two-counter Minsky machine. The loophole was closed by an include-depth cap in 8.17.0, which was added for an entirely different reason.
-
Attackers exploit critical authorization flaw in Drupal Commerce Core
Drupal warns that an access bypass vulnerability in its Commerce Core component is already being exploited in the wild. Users are urged to update promptly.
-
Pico CSS is no longer maintained, and its author cites AI
The maintainer of the minimal CSS framework Pico CSS has announced that version 2.1.1 will be the last. AI, he argues, has made such frameworks far less necessary, and staying relevant would require a rewrite from scratch.
-
Binance Breached: $6.3 Billion in Assets Affected, Nearly $3 Billion Frozen
The world's largest crypto exchange has disclosed a security incident affecting roughly $6.3 billion in assets. Chainalysis calls it the biggest cryptocurrency theft on record.
- More