News
-
Deleting 19k Lines of Dead Compiler Code Without Trusting the LLM
An engineer describes clearing roughly 19,000 lines of retired compiler code in a week with help from a language model — while trusting none of its output.
-
In Agentic Pentesting, the Harness Beats the Model
A model can write the attacks against your web app on its own. But what makes them safe to run against production, and worth acting on afterward, lives in the deterministic harness around the model — not in the model itself.
-
Attackers Hijack 300 Tor Exit Relays to Steal SSH Passwords
In early October attackers seized more than 300 Tor exit relays and used them to redirect SSH connections to servers that harvested login passwords.
-
India's Largest Bank Confirms Leak: 3,897 Customer Records Surface on Dark Web
State Bank of India told the exchanges it suffered an "incident involving the loss of certain data," identifying 3,897 records with customer personal information among roughly 375,000 offered on the dark web. The source is still unknown.
-
CISA: SafePay ransomware has breached 600+ critical infrastructure orgs
The U.S. agency CISA reports that since August 2024 the SafePay gang has breached over 600 critical infrastructure organizations worldwide, becoming one of the most active ransomware operations.
-
CISA Orders Agencies to Patch Exploited Plex, Siemens, and SiteGuard Flaws
The U.S. cybersecurity agency CISA has added the Plex2Shell bug cluster, plus flaws in Siemens Software Center and SiteGuard, to its catalogue of actively exploited vulnerabilities.
-
PHP Rushes Out-of-Cycle Fix for Two Critical RCE Flaws
PHP's security team scheduled an emergency release for October 21 for two critical vulnerabilities rated 9.2 on CVSS v4.0. watchTowr researchers say both allow remote code execution, but no details have been published yet.
-
PingCAP Reports Cloud Breach and Theft of Source Code
Between September 9 and October 7, 2026, an attacker using stolen service-account credentials accessed PingCAP's internal systems, copied data, and obtained source code. The company learned of the breach on October 7 and began revoking the compromised keys the same day.
-
Stolen UpdraftCentral keys used to backdoor WordPress sites
Attackers breached TeamUpdraft and appear to have stolen UpdraftCentral keys that can issue commands to connected sites. Roughly 400,000 WordPress websites may be exposed.
-
COSMIC Epoch 1.11 Lands xdg-dialog-v1 and Smarter Hybrid Graphics
System76 has rolled out another update to COSMIC, its Rust-written desktop environment. Release 1.11 adds support for the xdg-dialog-v1 protocol and improves GPU selection on systems with more than one graphics processor.
-
Anthropic Floats AI Safety Bill That Could Block a Model If 50+ Could Die
The proposed policy looks like a safeguard against runaway AI, but it actually bars federal agencies from blocking a model's release without a judge's say-so.
-
Court Rules OPM's Data Disclosure to DOGE Was Unlawful
A federal court in New York has ruled that the U.S. Office of Personnel Management broke the law when it opened the personal records of millions of federal employees to DOGE agents.
-
Google open-sources TorchTPU, a native PyTorch backend for TPUs
The company has released torch_tpu, a project that lets PyTorch models and operations run directly on Google's Tensor Processing Units. The code ships under the Apache 2.0 license.
-
Zeabur to shut down after second breach in two months
The developer platform announced it will wind down from December 2026 after a second data breach, in which attackers stole data on more than 321,000 accounts and 3.2 million environment-variable records.
-
PHP preps emergency patches after two critical flaws leak early
The PHP security team is urging administrators to brace for urgent updates after details of two critical vulnerabilities leaked ahead of their planned disclosure.
-
Eight eMudhra intermediate CAs compromised
The private keys of eight eMudhra intermediate certificate authorities have leaked. The certificates chain to roots trusted by major browsers and operating systems.
-
Autonomous AI Agents Breached a Hundred Companies' Sites — and Blew Their Cover on Open Panels
A Chinese-speaking criminal pointed autonomous AI agents at corporate websites and barely intervened. A NorForge researcher watched it all unfold in real time, because the operators left their control panels open on the internet.
-
Pegasus Found on Belgrade University Rector's iPhone Days Before Election
Citizen Lab confirmed that rector Vladan Đokić's phone was infected with Pegasus spyware. The finding surfaced just ahead of Serbia's snap parliamentary vote.
-
DHS bars DeepSeek products from US federal civilian agencies
The U.S. Department of Homeland Security has ordered federal civilian agencies to stop using Chinese firm DeepSeek's products and remove them from government systems.
-
Google Cloud Outage Knocks Banks and Equifax Offline
A disruption in Google's cloud infrastructure temporarily took down the online services of several major UK banks and the credit bureau Equifax.
- More