News
-
Plex2Shell Attacks: Hackers Drop Crypto Miners and a Proxy Backdoor on Plex Servers
Just a day after a proof-of-concept went public, attackers began chaining four Plex Media Server vulnerabilities to achieve remote code execution and plant miners and a reverse proxy.
-
Nvidia unveils open Nemotron 3.5 models for enterprise and on-device AI agents
The company released the large Super VL model for enterprise data centers and two compact Bolt models designed to run directly on new PCs powered by RTX Spark chips.
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
Massive Florida DMV data breach hits current and former residents
Florida has begun issuing alerts after a statewide breach at its Department of Motor Vehicles, an incident tied to the ShinyHunters group.
-
F5 ships out-of-band patches for critical NGINX flaws
F5 has closed several NGINX web server vulnerabilities, including three critical ones that could let attackers run code on affected systems.
-
How a Chinese Crime Ring Hacked Staples to Steal Millions
Hackers broke into Staples' internal systems, issued gift cards worth millions, and went on a nationwide shopping spree across the U.S.
-
An AI That Gets Better at Cracking CAPTCHAs the More It Tries
Researchers built a system that solves visual CAPTCHAs and grows more accurate with every encounter — even recovering after defenders scramble the images against it.
-
Linux 7.4 Gains TAINT_FORCED_BIND to Fight AI-Driven Fuzzing
A new kernel taint flag marks cases where devices are forcibly bound to drivers via sysfs — a response to the flood of pointless bug reports generated by fuzzing tools.
-
Fake Web3 Accelerator Pushed Malicious npm Packages Posing as Free AI Credits
A crew masquerading as a venture accelerator for crypto startups spread infostealers and backdoors through npm, dangling free Claude and Gemini credits — while quietly hijacking the traffic of AI agents.
-
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
On the night of October 16 an intruder reached a legacy system at OpenCode and may have exposed the third-party AI provider keys that users had stored in OpenCode Console.
-
October Windows Server updates break Exchange sign-in and mail flow
Microsoft has confirmed that this month's Windows Server security updates break Outlook on the web sign-in and leave messages stuck in the Outbox on some Exchange Server systems.
-
Unpatched Broadcom Wi-Fi Flaw Hands Nearby Attackers Root on Routers
Researcher Quentin Kaiser showed that a bug in Broadcom's own WPS code lets an attacker within Wi-Fi range run code as root — with no network password and no pairing. There is no patch and no CVE.
-
How Brute Force Out-Thought a Programmer Inside an FPU Emulator
The author of the purplesyringa blog explains how, instead of a clever bit trick, they let brute force hunt for the optimal formula — and got a solution they never would have found themselves.
-
Hybrid agents: thinking in latent space, acting through text
Researchers propose HybridAgent, an architecture that switches between "latent" reasoning and text-based interaction — which, they report, speeds things up and saves tokens without sacrificing quality.
-
A Savannah officer handed her Flock login to her ICE agent husband
A former Savannah police officer was fired after an investigation found she had shared her login for the Flock license-plate system with her husband, an immigration agent.
-
A Philadelphia woman was arrested for blocking a delivery robot
Carolyn Marvin was charged with disorderly conduct for repeatedly standing in front of Uber's delivery robots in protest against machines taking jobs from human couriers.
-
Anthropic pledges 5% of its shares to a ‘public benefit fund’
The company is setting up a dedicated fund for socially beneficial projects — and stands ready to hand it even more as its valuation climbs.
-
macOS 15.8.2 Update Breaks OpenGL
Users report that the macOS 15.8.2 release breaks OpenGL. The thread drew a lively discussion on Hacker News.
-
ASMC: Wiring Ghidra to CBMC for Assembly Model Checking
Philip Zucker has released ASMC, a tool that lifts Ghidra's assembly semantics into the CBMC model checker. Notably, most of the glue code was written by AI.
-
Disney to hire the majority of bankrupt Character.AI’s staff
After chatbot startup Character.AI filed for bankruptcy, dozens of its employees will be offered jobs at Disney. The startup’s former CEO recently became the entertainment giant’s first-ever CTO.
- More