News
-
PhantomRaven: An AI-Written npm Stealer Built to Chase Bug Bounties
CrowdStrike has linked a financially motivated threat actor to malicious npm packages that stole developer tokens. In the analysts' assessment, the stealer's code was almost certainly generated by a large language model.
-
Critical Check Point Vulnerability Opens Root Access to Management Servers
Check Point has released security updates for CVE-2026-91843, a critical vulnerability that allows code execution with root privileges on Security Management Server and Log Server management systems.
-
Waymo Heads to Singapore: Robotaxis Coming to the City-State's Roads
Waymo has announced its entry into the Singapore market. The company will start by manually mapping the streets next year, with plans to launch a commercial driverless taxi service by 2028.
-
Lily: an automatic backdoor hunter for the commit and release stages
Researchers have unveiled Lily, a tool that plugs into CI pipelines and release-review processes to catch hidden backdoors in open-source software before they ever reach users.
-
Four Local Root Vulnerabilities in the Linux Kernel: DirtyAH6, TUNderflow, PPPoEject and DiagSpill
Researcher Asim Manizada has disclosed four vulnerabilities in the Linux kernel that let an unprivileged user gain root. The bugs are between 10 and 21 years old, and the fixes have already landed in the stable branches.
-
How a Single GPS Receiver Sent Telstra's Network Back to 2006
Australia's largest mobile operator lost service for several hours because, after routine maintenance, a lone receiver in Melbourne decided it was November 2006 — and convinced the entire network of it.
-
EFF: safety rules for AI labs should be grounded in proven practices
The Electronic Frontier Foundation is urging lawmakers to regulate not abstract "doomsday" scenarios but the concrete risks that have already surfaced in breaches at major AI labs.
-
Bend: The Language That Blocks AI Errors with Mathematical Proofs
Bend promises the speed of C, parallelism across CPU and GPU, and code verification through formal proofs — so that an AI agent physically cannot commit a violation of the rules you set.
-
FAA to Spend $875 Million on AI for Air Traffic Control
The U.S. Federal Aviation Administration is rolling out a cloud-based platform called SMART, meant to help air traffic controllers forecast traffic flows and prevent conflicts in the skies.
-
RatHat: The Android Trojan That Controls the Infected Device with AI
Researchers at Zimperium zLabs have discovered a new Android malware called RatHat, which uses an AI assistant to “intelligently” navigate the interface of an infected smartphone. Based on prompts found in Chinese, the experts link it to Chinese threat actors.
-
Internal Microsoft Documents: AI Training Called “the Largest Theft of Labor in History”
Newly unsealed materials from The New York Times' lawsuit against OpenAI and Microsoft reveal that the companies' top executives, in private correspondence, called data collection “theft” and their own products an “existential threat” to publishers.
-
CrowdSec confirms source code leak from private repositories
CrowdSec has disclosed that part of its source code was leaked in May 2026. By its own assessment, customer data was not affected, and the likely point of entry was a compromised TanStack library.
-
Rust Developers Warned of Targeted Attacks on Their Accounts and Devices
The Rust security working group and the Crates.io team have reported an ongoing campaign against key project contributors and owners of popular crates. The goal: to spread malicious code across the language's ecosystem.
-
University Rescinds Job Offer to Activist Who Wiped His Phone Before a Search
Georgia State University has rescinded a job offer to Samuel Tannick, who is facing charges for allegedly destroying data on a hardened Android smartphone before U.S. border agents could examine it.
-
Apple Softens Tracking-Consent Screens for Apps in the EU
After a years-long antitrust investigation in Germany, Apple will let developers in the European Union show less alarming tracking-consent prompts.
-
Brevo supply-chain attack: a stolen Cloudflare key infected customer sites
Attackers stole a Cloudflare API key and used an edge worker to inject ClickFix scripts into Brevo's sites and into widgets embedded on customer pages. Up to 100,000 sites may have been affected.
-
A Temporary PHP Patch from 2014 Lived On Through 20 Million Installs
Developer Jake Smith has deprecated his http_build_url polyfill — 174 lines of code written as a stopgap for AOL's CMS that spread across millions of sites.
-
OpenAI Discloses Six Cases of “Concerning” Behavior in Its Models
The company published accounts of six incidents in which experimental models concealed errors, used other people's API keys and posted data to public services — and along the way introduced a new framework for reporting AI misalignment.
-
Critical Flaw in Unbound's DNSSEC Validator Threatens Remote Code Execution
NLnet Labs has released Unbound 1.26.1, fixing a critical heap overflow in the DNSSEC validator (CVE-2026-81642) that could lead to RCE via a malicious DNS zone, along with eight other vulnerabilities.
-
Neovim's 10 Bitcoin: An $800,000 Donation Left Untouched Since 2023
A Hacker News user peeked into the Bitcoin wallet listed in the footer of the Neovim site and discovered a forgotten donation of 10 BTC that, at today's exchange rate, is worth $800,000.
- More