News
-
Sandworm and UAC-0099 Hit Ukraine With a Backdoor Hidden in the Yggdrasil Mesh Network
ESET reports that two Russia-linked groups joined forces for a destructive wiper attack on a Ukrainian logistics firm, running a backdoor over the Yggdrasil peer-to-peer network for the first time.
-
Millions of PHP2Shell Attack Attempts — Yet Not One Has Worked
Attackers are mass-probing the freshly disclosed PHP2Shell flaws to pull servers into a Mirai botnet, but a reliable working exploit still eludes them.
-
Node2Shell: Crafted Brotli Data Runs Attacker Code on an Official Node.js Build
Imperva researchers showed that an application on an official Node.js build can be made to run attacker-supplied code by feeding it a crafted Brotli stream (CVE-2026-111497). Node.js shipped fixes on October 21.
-
Left to their own devices, AI agents started playing
MIT researchers dropped 13 AI agents onto a virtual desert island with no task at all — and they began inventing their own games. A side effect: the ones that played ended up better at their jobs.
-
Etsy cracks down on AI slop in listings
The marketplace will require at least one unedited photo of the actual item and mandatory disclosure when AI is used to create an image or content.
-
Linux 7.4 Makes Workqueue Flushing 10-100x Faster on Big Servers
A workqueue optimization in Linux 7.4 makes flushes visit only the queues used since the last flush, dramatically speeding things up on high-core-count machines.
-
Canada's C-22 Bill Threatens to Weaken the Encryption Everyone Relies On
Bill C-22, already passed by the House of Commons, is now before the Senate. Rights groups warn it opens the door to backdoors and mass metadata retention.
-
Fedora 45 Hits a Second NO-GO: Release Pushed to November
At the latest Go/No-Go meeting the Fedora team delayed Fedora 45 by at least another week over open blocker bugs. The new tentative release date is 3 November.
-
OpenAI eyes $30B raise at $1.25T valuation, delaying its IPO
Rather than rushing to the public markets, OpenAI is reportedly close to another mega private round: up to $30 billion at a $1.25 trillion pre-money valuation. If it lands, OpenAI becomes the most valuable private company ever.
-
Two CVSS 9.0 KSMBD RCE Flaws Go Public on Mailing Lists Before Any Kernel Fix
KSMBD, the Linux kernel's built-in SMB server, is exposed to two remote-code-execution flaws rated 9.0, with no mainline fix yet — and the reports landed on public mailing lists.
-
Capcom confirms data breach affecting 11.7 million accounts
Japanese publisher Capcom says attackers breached its CAPCOM ID service, exposing more than 11.7 million email addresses along with related account information.
-
eMudhra Quits Global SSL/TLS Business After Eight CA Keys Turn Out to Be Guessable
The Indian certificate authority is leaving the global TLS market five days after a researcher recovered the private keys of eight of its intermediate CAs. Chrome and Firefox are dropping trust in the emSign ECC Root CA — G3.
-
Someone jailbroke the Switch 2 with an old game and AI
The Nintendo Switch 2 appears to have its first jailbreak, built with help from OpenAI's Codex. As a demo, a modder loaded a custom Mario Kart World full of guest characters.
-
Quad9 to Leave France After Refusing a Court Order to Block Domains
The Swiss nonprofit DNS resolver Quad9 will stop serving French users on November 24, after a court sided with the company beIN and ordered it to block certain domains — a demand Quad9 says it cannot reconcile with its mission.
-
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Arista has shipped fixes for on-premises VeloCloud Orchestrator: a critical SQL injection flaw is already being exploited and lets authenticated users escalate to superuser privileges.
-
Woman Faces Six Years in Prison Over a Cash App Account She Never Opened
A woman reportedly faces up to six years behind bars over a Cash App account she says she never opened — a case that has struck a nerve online.
-
KeePassXC 2.8.0: Qt6 migration and Auto-Type on Wayland
A new release of the open-source password manager KeePassXC is out. It brings long-awaited features, numerous bugfixes, and a set of security updates.
-
DeepSeek reportedly raises $15B just days after US ban
The Chinese AI lab has closed one of the country's largest funding rounds — only two days after US authorities ordered its technology stripped from federal systems.
-
Railway Breach: Intruder May Have Reached Customer Secrets
PaaS provider Railway disclosed unauthorized access to encrypted environment variables — and, in some cases, their decrypted contents. Customers are urged to rotate all keys immediately.
-
Linux Kernel Vulnerabilities Accidentally Dumped Onto Public LKML
Zero Day Initiative researchers mistakenly sent reports on several unpatched kernel flaws to the public mailing list instead of the private security one. Some of the bugs carry a CVSS score of 9.0.
- More