News
-
China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks
CISA has added CVE-2026-41709 in VMware ESX to its catalog of exploited vulnerabilities. According to CrowdStrike, the Warp Panda group used it as a zero-day to leave fewer traces in audit logs during attacks on U.S. law firms.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Claude Code spends up to a fifth of your tokens on a three-word status line
Independent developers found that Claude Code's background agent_summary feature eats roughly 15–20% of tokens to produce a short status line. There is no built-in way to turn it off, so they published a Bun hook that does.
-
Gnoppix Linux 26_11 Released with Disposable Email and a Tor-Capable Post-Quantum Messenger
Andreas Mueller has announced Gnoppix Linux 26_11, an updated build of the Debian Testing-based distribution with the Xfce desktop. The release improves networking tools and privacy services and adds a disposable email service.
-
A computer in the weights: a working RISC-V CPU compiled into Qwen 3.5
Developer Divyansh Agrawal has compiled a 32-bit RISC-V processor directly into the weights of Qwen 3.5 4B. The model's own Gated DeltaNet layers serve as RAM, and no external tools are involved.
-
Stack Overflow now gets fewer than 1,000 questions a month
A Stack Exchange Data Explorer query suggests that new questions on Stack Overflow have dropped below a thousand a month. The chart drew an active discussion on Hacker News.
-
Linux Plumbers in Prague: what the sched_ext microconference discussed
The Linux Plumbers Conference blog has published a report from the sched_ext microconference. Three topics dominated: priority inversion, paravirtualized scheduling, and hardware topology in task placement.
-
Akai opens up the MPC Sample Key firmware and bets on AI-coded mods
Akai hasn't formally announced the MPC Sample Key yet, but it is already showing off mods that enthusiasts are vibe-coding for it. The device will ship with open-source firmware, and developers are getting early access.
-
Alpine Linux rebuilds its GitLab after an attempted exploit of a critical vulnerability
An attacker came close to compromising Alpine Linux's GitLab instance via CVE-2026-97229. No evidence of a breach was found, but the server was rebuilt from scratch and all passwords were reset as a precaution.
-
iOS 27.2 Lets You Wall Off Apps from Siri AI
Apple has added an "Excluded Apps" setting that blocks Siri AI from reading the contents of chosen apps. The EFF counts it as a win for its Encrypt It Already campaign, though it thinks Apple should go further.
-
Volt Typhoon Ran Four Zero-Day Campaigns Through the Covert Silent Train Network
Black Lotus Labs (Lumen Technologies) has linked Volt Typhoon to Silent Train, a now-disrupted covert network of constantly rotating chains of compromised routers, IoT devices and enterprise equipment. The group used it to exploit zero-days and hold on to access in strategically important US networks.
-
Hacker steals and leaks data on more than 40,000 US Homeland Security employees
A hacker calling themselves Department of Peace has published names, job titles, and work contact details of more than 40,000 DHS staff, including CBP and ICE agents. The hacker says the data came from an Okta single sign-on system.
-
Canonical Revives Its Immutable Ubuntu Core Desktop
The immutable desktop built on Ubuntu Core, quiet since 2024, now has a new team and ambitious plans, with daily builds expected during the Ubuntu 27.04 cycle.
-
Sony ISP subsidiary breach exposes about 2.5 million customer records
Sony Network Communications has confirmed that attackers accessed its So-net member database, exposing 2.58 million records with personal data of current and former customers.
-
Google DeepMind unveils Gemini 4 Carbon, built for cybersecurity and long-horizon tasks
Gemini 4 Carbon tops the Artificial Analysis index and leads benchmarks for finding, exploiting and patching vulnerabilities. Cyber defenders get access first.
-
Attackers scan for unpatched Oracle E-Business Suite systems with critical flaw
A week after Oracle shipped a fix for the critical CVE-2026-101767 vulnerability in E-Business Suite, the first scanning and exploratory exploitation attempts have been observed.
-
Kentucky man becomes the first humanist granted a religious exemption from using AI
A Kentucky resident with humanist convictions has, for the first time, obtained a religious exemption from using artificial intelligence. So far, only the broad outlines of the story are known.
-
Meta Will Train AI on Business Account Content: How to Object From the EU and UK
Meta has updated its commercial terms to let it use business accounts' content to develop its products. Users in the EU and UK can object for now, while everyone else gets no such option.
-
Google and Meta subsea cables in the Pacific among the most exposed to sabotage
US-owned trans-Pacific undersea cables face growing risks from sabotage. China's activity around this infrastructure is adding to Big Tech's concerns.
-
Researchers set up a fake start-up to study North Korean IT job fraudsters
To understand how North Korean IT workers obtain jobs under false pretences, researchers founded a start-up company that does not really exist.
- More