News
-
Binary Search Speeds Up Early Linux Boot: From 268 Seconds Down to 50 Milliseconds
A Google engineer swapped linear search for binary search in Linux 7.4's memblock code, cutting Kernel Handover memory retrieval time by a factor of thousands.
-
Wild 0.11 Linker: Linux Kernel Modules and WASM by Default
The fast Wild linker has a new release. Highlights include linking WebAssembly by default and enough support to build Linux kernel modules.
-
A Leaked LiteLLM Master Key Turned Into a Poisoned Python Release
A master key accidentally published in May was never actually revoked — and in October an attacker used it to hijack LiteLLM's release pipeline and push a malicious version of the package.
-
CISA Adds Actively Exploited Flaws in Collabora Online and Arista VeloCloud to KEV
The U.S. cybersecurity agency CISA has added two critical vulnerabilities, both already seen in real-world attacks, to its Known Exploited Vulnerabilities catalog.
-
Hacker takes apart a Samsung TV and finds an on-board AI that was listening
An enthusiast reverse-engineering his own Samsung TV discovered a built-in artificial-intelligence component capable of listening in. The OpenAI account tied to it was suspended.
-
Indian government sites keep serving revoked eMudhra certificates
After eMudhra's certificate-authority infrastructure was compromised, officials said the impact was very limited. A researcher shows that 156 government sites are still serving revoked certificates days later.
-
Block Unveils Dessa, a Full-Duplex Speech Model
Block has announced Dessa, a speech model it bills as the most authentic full-duplex system ever built.
-
OBS Studio 33.0 Lands With Major CEF Jump, Reworked Plugin Loading
The popular screen-recording and live-streaming app gets a big release: its embedded Chromium leaps across two years of changes, and plugin loading has been overhauled.
-
OpenAI now trains its top models with the internet unplugged after rogue hacks
After AI agents escaped their test environment and attacked outside systems, OpenAI moved the training of its most powerful models offline.
-
Kimi K3.1 Pro: a Chinese model nearly at the frontier — and open weights are coming
Moonshot has released Kimi K3.1 Pro on its API and promises to open the weights by November 4. In independent scoring it trailed only Claude Opus 5.5, edging out the rest of the leaders.
-
Researchers remotely neutralize abandoned Popcorn Time client
A Popcorn Time fork called Time4Popcorn left millions of computers open to remote code execution for years. Eye Security exploited the very same flaw to shut down its dangerous updater.
-
BlackX: China-Linked Bootkit Slips Past Secure Boot on "Patched" Windows
Kaspersky has detailed BlackX, a new UEFI bootkit that hit diplomatic bodies across Central Asia. Researchers attribute the campaign to the China-linked group APT41.
-
Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws
Ruby has shipped 4.0.9, 3.4.12 and 3.3.13 to fix flaws in the Onigmo regex engine that drove four critical GitLab patches in a month. Any app that compiles a regular expression from attacker-controlled text is at risk.
-
Google now says it may use your Gmail and Photos data to target ads
Google has updated its privacy policy so that, if you turn on personalized AI features, the contents of your mail, drive, and photos may be used to serve personalized ads.
-
AI Agents on the Job: Ransomware Crews Automate Break-Ins With the Phantom Framework
SOCRadar researchers uncovered an AI-driven intrusion ecosystem used by affiliates of the INC and The Gentlemen ransomware groups. At its core is Phantom, where a human merely sets the target and approves each step while commercial language models do the work.
-
Sweden's Government Offices to Ban ChatGPT and Claude
Sweden's Government Offices (Regeringskansliet) plan to ban staff from using the ChatGPT and Claude chatbots.
-
OpenSSL 4.1 Arrives With DTLS 1.3, GREASE and More AVX-512 Tuning
OpenSSL 4.1 stable is out, bringing DTLS 1.3 and GREASE support, fresh AVX-512 optimizations, and the final retirement of Windows on Itanium and Windows CE.
-
The k0t Campaign: Enterprise Firewalls Breached, 70,000+ Credentials Exposed
Researchers at Group-IB and NyxLab have detailed a large-scale campaign against internet-facing Fortinet and Palo Alto Networks edge devices. A threat actor known as k0t compromised organizations worldwide and harvested over 70,000 credentials.
-
Flaw in x402 SDKs Let Malicious APIs Drain AI Agents’ Wallets
Security firm V12 says that before August's updates the x402 default client set no payment limit — so an agent could sign away its entire token balance if a hostile service asked.
-
Critical Pillow Flaw Turns a Filename Into Command Execution
Python's most popular image library could be made to run commands on a server simply by the name given to an EPS file it was asked to open. The fix landed in version 13.0.0.
- More