News
-
Your favorite website could vanish any day: here is how to save it yourself
A web archiving professional lost a beloved old fan site and now argues that people should archive the pages they care about themselves instead of waiting for the Internet Archive.
-
Linux 7.4 makes a RISC-V memory copy optimization portable
The RISC-V architecture changes have been merged into Linux 7.4. The main one moves the decision to skip software alignment during memory copies to run time, so distribution kernel builds can now use the optimization.
-
Hugging Face crypto-mining campaign returns days after takedown
Attackers are publishing fake models on Hugging Face that hijack GPU servers for mining and plant backdoors, with the most popular one downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is set up to fool AI coding agents.
-
Fedora 45 to ship on 3 November after two delays
Fedora developers have declared the release candidate ready: Fedora 45 will be officially released on Tuesday, 3 November. The RC 1.4 images, now deemed stable, are already available for download.
-
Binance investigates possible hack involving up to $5.8 billion in crypto
Cryptocurrency exchange Binance is looking into reports of a potential security incident involving up to $5.8 billion in assets. If the theft is confirmed, it would be the largest in crypto history.
-
Fan fiction hub Archive of Our Own may stay offline for up to four weeks
Routine overnight maintenance has turned into a lengthy outage for AO3: restoring service is expected to take about two weeks, possibly as long as a month.
-
Reddit will make everyone log in to browse the site
Reddit plans to make the site available only to logged-in users. The first tests will run in several markets outside the US, and the news arrived alongside the company's Q3 2026 earnings.
-
GM to pay $220 million over sale of driving habits data
General Motors has agreed to pay $220 million to settle claims from a coalition of 36 US state attorneys general. The states accused the carmaker of illegally selling driver and location data to data brokers.
-
OpenAI updates its Model Spec with five core values for more capable AI
OpenAI has released an updated Model Spec that sets out five core values for its models. They are meant to help more capable AI exercise sound judgment, respect human agency and stay faithful to human intent.
-
319 Chrome extensions with 13.4 million installs hijacked searches for ad revenue
A Socket researcher has detailed a sprawling campaign in which hundreds of Chrome extensions quietly routed users' searches through operator-controlled servers to collect referral payments from Bing and Yahoo.
-
Linux kernel TCP flaw rated 9.8 still unpatched on Ubuntu and RHEL
A race condition in the Linux kernel's TCP code leads to a use-after-free. Anthropic says its Claude model wrote an exploit for it that gives a remote attacker root.
-
Telegram for Android Flaw Let Attackers Run Code Through a Voice Call
Security startup NebuSec has disclosed a flaw in Telegram for Android: an attacker with an ordinary account only had to call the victim and wait for them to answer. The bug is fixed in version 12.10.4.
-
Mistral releases the weights of its flagship Mistral Large 4, aka "Le Chonk"
Mistral AI has published the weights of Mistral Large 4. It is a one-trillion-parameter multimodal model that the company calls the best open-weight model for coding and defensive cybersecurity.
-
CISA warns Fragnesia Linux kernel flaw is being chained with PHP2Shell in attacks
The U.S. agency CISA has ordered federal agencies to fix a Linux kernel privilege escalation flaw. Attackers are already pairing it with the PHP2Shell bugs to gain root access to servers.
-
US Senators Press Meta Over Its 'Pervert Glasses'
Ron Wyden and Edward Markey have sent Meta a letter demanding answers on how its smart glasses threaten the privacy of wearers and bystanders. The move follows an investigation by 404 Media.
-
GitHub Launches npm Firewall to Stop Malicious Packages Before Installation
GitHub has opened a public preview of a package firewall for npm. It checks dependencies against a set of policies and blocks suspicious packages at install time.
-
Cisco patches actively exploited zero-day in ASA and FTD firewalls
CVE-2026-76418 lets unauthenticated remote attackers force Cisco firewalls with SSL VPN enabled to reload. The company has already seen attacks and urges customers to update.
-
China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks
CISA has added CVE-2026-41709 in VMware ESX to its catalog of exploited vulnerabilities. According to CrowdStrike, the Warp Panda group used it as a zero-day to leave fewer traces in audit logs during attacks on U.S. law firms.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Claude Code spends up to a fifth of your tokens on a three-word status line
Independent developers found that Claude Code's background agent_summary feature eats roughly 15–20% of tokens to produce a short status line. There is no built-in way to turn it off, so they published a Bun hook that does.
- More