News
-
Linux Kernel Flaw Gives ARM64 KVM Guests Access to Host Memory
The CVE-2026-89775 bug in the Linux kernel's nested-virtualization code for ARM64 lets a guest read and write host memory — and, the researcher says, escape the guest to run code on the host.
-
New BigDiskBuster zero-day cuts off Windows Defender updates
Researcher Abdelhamid Naceri has dropped yet another exploit against Microsoft's built-in antivirus — this one keeps Defender from updating. It is roughly the tenth flaw in his drawn-out feud with the company.
-
Can gzip be a language model?
A developer showed that the plain archiver shipping with every OS can continue text with no neural network at all — simply because compression is prediction.
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
CISA Flags Active Attacks on Zyxel Switches and Veeam Windows Agent
A Zyxel GS1900 switch flaw has been added to the known-exploited catalog, while researchers warn of attacks on a local Veeam Agent bug that grants SYSTEM-level access.
-
Why 0xCAFEBABE: the story behind Java's class-file magic number
Every Java class file begins with the four bytes 0xCAFEBABE. In 1996 programmer Bill Venners wondered where the value came from — and got an answer from one of the language's creators.
-
Spymarks, Not Watermarks
The author argues that hidden tracking signals embedded in images, audio and text should be called "spymarks" rather than "watermarks" — to put the privacy threat front and center.
-
Jev: the LLM that returns a number instead of text
TypeSafe AI has unveiled Jev, a new kind of model dubbed a "decision model": text goes in, and a floating point number with a confidence score comes out.
-
BigCommerce warns merchants of breach tied to Ribon apps
BigCommerce has alerted merchants to a breach after attackers stole credentials for the third-party Ribon apps and used them to inject malicious scripts into online stores.
-
Meta's highly privileged AI assistant Muse hit by a serious 0-day
Muse, Meta's new AI agent with sweeping permissions, turns out to be vulnerable: one way to fully hijack it is a simple ClickFix attack.
-
Xiaomi Unveils MiMo v2.6
Xiaomi has published a new release of its MiMo AI model — version 2.6. The announcement drew attention on Hacker News.
-
California makes AI data centers pay for grid and water strain
Governor Gavin Newsom has signed a package of seven bills to keep data center operators from shifting their electricity and water costs onto the state's residents.
-
Fake LastPass Installer Kills Antivirus With a Microsoft-Signed Driver
A bogus LastPass Authenticator page on GitHub served an installer that used a legitimately signed kernel driver to switch off security software before stealing passwords.
-
xAI Unveils Grok 4.7, Betting on Long Tasks and Safety
The company released Grok 4.7, calling it its most capable model for coding and knowledge work: same price and speed as its predecessor, but with a larger base and a focus on multi-hour tasks.
-
Google fined €403 million over location data violations
Ireland's Data Protection Commission has fined Google €403 million for multiple GDPR violations in how it handled users' location data.
-
Google confirms Gemini models hacked three companies in May 2026
A third-party cybersecurity firm accidentally gave experimental Gemini models access to the Internet — and they went on to hack three companies.
-
Reverse-Engineering a Flock Camera: It Detects People, and the Encryption Key Sat in the Open
Hackers got hold of a Flock automatic license plate reader and dug into its software. It turned out the device detects not just plates and cars, but people, bicycles, and even bumper stickers.
-
EFF: The EU Kids Act Will Undermine Privacy for Everyone
The European Commission has unveiled the EU Kids Act, imposing age-based access rules for social media and games. EFF warns the price will be pervasive age verification and eroded privacy for all users.
-
Meet the first five Googlebooks from Acer, Asus, Dell, HP and Lenovo
Google and its partners have unveiled the first laptops under the Googlebook banner. Five models are up for preorder now and reach stores on October 4th, priced from $899 to $1,299.
-
ZuckOff: an app that spots camera glasses by their Bluetooth signature
Camera glasses announce themselves over Bluetooth when they power on or pair. ZuckOff listens for those signals and warns you when Ray-Ban Meta, Snap Spectacles or similar hardware is nearby.
- More