News
-
LuaRocks Breach: an RCE Found a Year Late, Exploited All Summer
A flaw in LuaRocks.org allowed arbitrary code execution on the server via rockspec uploads. It was exploited from July 9 to August 20, 2026; the team revoked every credential and moved to a new server.
-
Anthropic turns Claude into an AI marketplace with 2,000+ plugins
The company has launched Claude Marketplace, a single hub for plugins, connectors and agents that is live today. Google, Microsoft, Notion, Salesforce and others are already offering their tools.
-
Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Attack
Security firm watchTowr warned of two unpatched remote-code-execution flaws in NetScaler ADC and Gateway. Citrix has neither confirmed the issue nor shipped a fix, and some administrators have simply powered their appliances off.
-
Insurers say AI is already driving up healthcare costs — by hundreds of millions
The Blue Cross Blue Shield Association estimates that hospitals' use of AI in filing insurance claims added nearly a billion dollars in spending over two years.
-
A Race in AF_ALG: a 14-Year-Old Linux Kernel Hole Worth $113,337
A STAR Labs researcher found a race condition in the Linux kernel's crypto subsystem that lets an ordinary user become root and break out of a Docker container. The flaw, CVE-2025-39964, had lived in the code for roughly fourteen years.
-
TikTok to Pay Alabama at Least $100M in Settlement
The state accused the platform of misleading users about safety and of being designed to make children addicted.
-
The "Human in the Loop" Is Breaking as AI Agents Take Over
Researchers argue on arXiv that today's AI agents not only hamper human oversight but actively erode the very skills that oversight requires.
-
Lunex Stealer Turns an AMD Driver Against the Very Tools Meant to Stop It
Ontinue has detailed the Lunex malware-as-a-service platform, whose Psychedelic stealer abuses a vulnerable AMD Radeon driver to blind security monitoring and harvest browser passwords.
-
GNOME OS Developers Devise "Toolpak" — a Flatpak for Tools
GNOME developer Jordan Petridis has used a blog post to introduce Toolpak, a planned mechanism for shipping tools on GNOME OS that borrows its ideas from Flatpak.
-
Microsoft pauses KB5002907 update after it deactivates Office licenses
After the KB5002907 update, perpetual copies of Office 2016 and Office 2019 began showing up as unlicensed — and in some cases vanished entirely. Microsoft has paused the rollout and is investigating.
-
OpenAI pauses training of its ‘most capable models’
After a string of incidents in which its models slipped out of control, OpenAI has halted training of its most capable systems. The trigger: a model tested inside a sandbox found a loophole and reached the open internet.
-
Infecting a Steam Link with NixOS
After finding a Steam Link forgotten since 2018 in his closet, a developer set out to turn it into a tiny always-on ARM server running NixOS — sidestepping the signed bootloader with a homemade kernel module.
-
Compromised GitHub Actions brought back online with malware still attached
Two third-party GitHub Actions infected in May's Mini Shai-Hulud campaign were re-enabled and kept serving the old malicious payload for more than a week.
-
Attackers Bypass WAFs to Exploit an Oracle PeopleSoft Flaw
Google warns of a renewed wave of mass exploitation against a critical Oracle PeopleSoft flaw, with a ShinyHunters-linked group slipping past WAF rules and dropping web shells.
-
Elementor CSRF Flaw: One Click Hands Attackers Admin Rights
A flaw in the popular WordPress site builder lets an unauthenticated attacker create a rogue administrator account once a logged-in victim clicks a crafted link.
-
CISA Flags SharePoint and MikroTik RouterOS Flaws as Actively Exploited
CISA added two vulnerabilities — in Microsoft SharePoint and MikroTik RouterOS — to its KEV catalog, citing evidence of active exploitation. One RouterOS flaw is part of the MikroTrick chain that hijacks routers without a password.
-
A Single Flock Camera Hit Put an Innocent Woman in Jail for 13 Days
A 23-year-old Florida woman was arrested for a triple-fatal crash on the strength of one license-plate-camera image of her car. Her vehicle didn't have so much as a dent.
-
New Mexico jury finds Facebook liable for deceiving users in Cambridge Analytica case
A Santa Fe jury ruled that the company misled users about how it protected their data. The judge will set the penalty — prosecutors are asking for the maximum $5,000 per violation.
-
What Even Counts as an OS Anymore?
The author of sockpuppet.org is leaving Fly.io to build a new kind of phone — and explains why he believes AI is about to erase the line between programmers and users.
-
Tesla workers reluctant to train Optimus robots meant to replace them
Tesla employees are balking at helping to train the company's Optimus humanoid robots, aware that they are preparing their own replacements. Even so, Tesla still aims to build up to a thousand of the machines per week by the end of 2026.
- More