#безопасность
-
Twitch Extension Leaked OAuth Tokens of Nearly 31,000 Users
The malicious browser extension “Twitch Enhanced Viewer | JeetBot” forwarded viewers' session tokens to the proxy servers of a commercial bot service — except for the sessions of ten Russian streamers.
-
CISA: Critical GitLab Vulnerability Already Being Exploited in Attacks
The CISA agency has warned of active exploitation of a maximum-severity vulnerability in GitLab that allows secrets to be read from vulnerable servers without authentication.
-
Signal Wants Registration Without a Phone Number Based on Zero-Knowledge Proofs
The Signal community forum is discussing a long-standing request — registration without a tied phone number. Zero-knowledge proofs are set to play a key role in it.
-
How an NTP Pool Operator Got Caught in a Tesla “Cyberattack”
The owner of a volunteer NTP server found a flood of exploits in his logs from the Assetnote scanner — which had mistaken his machine for Tesla infrastructure because of a bad DNS setup.
-
Session Context: the site that shows what your browser knows about you
The demonstration page sessioncontext.org vividly reveals how much data a website collects about a visitor without a single permission request — and why erasing those traces is far harder than it seems.
-
Waymo Robotaxi Turns Passengers with Homemade Weapon Over to Police
In San Francisco, a self-driving Waymo taxi pulled over mid-trip and called the police after discovering that its teenage passengers were carrying a loaded weapon.
-
Watches That Hear Everything: Apple Ushers In the Era of “Always-Listening” Devices
Apple is adding always-listening ambient features to the new Apple Watch. Privacy experts warn that the real problem isn’t protecting users — it’s the rights of the people who happen to be nearby.
-
Homebrew 7.0.0: Built-in Vulnerability Scanning, a Sandbox, and Farewell to Intel
Version 7.0.0 of the popular package manager is out: faster installs, tighter isolation, a native macOS app, and its own vulnerability database. And with it, the project bids a final farewell to Intel processors.
-
Sam Altman: an OpenAI IPO in 2026 would be “ill-advised”
In an interview with Fortune, the head of OpenAI said the company is in no rush to go public and certainly has no plans to do so in 2026 — chiefly because of unresolved safety questions.
-
LG Denies Allegations of Spying Through Its TVs
After high-profile reports from Gamers Nexus and independent researchers about data collection from Smart TVs, LG has said journalists created a “false impression” of how its devices work.
-
Debian 13.7 “Trixie” Released with Security and Bug Fixes
The Debian project has released an updated set of Debian 13 “Trixie” installation images with accumulated security fixes and numerous resolved bugs.
-
Anthropic's CEO Calls for Slowing Down AI Development
Dario Amodei has proposed a three-step plan to “slow the movement toward the frontier” of AI, and opened up access to the company's models for outside experts.
-
Revolut confirms customer data breach caused by fake requests impersonating a government body
Fraudsters sent requests from a legitimate government-agency domain and obtained the personal data of some of the fintech company's customers. Revolut said its systems and users' funds were unaffected.
-
How Trail of Bits Verifies the Integrity of Your Signal Chats
Trail of Bits has launched as one of three independent auditors of Signal's automatic key verification system — the mechanism that guards against a compromised server swapping in bogus public keys.
-
OpenAI's AI Agents Carried Out an Undisclosed Attack on RubyGems
In May 2026, a swarm of AI agents believed to belong to OpenAI uploaded hundreds of malicious packages to RubyGems, achieved code execution on RubyDoc.info's servers, and tried to steal users' API keys. The company never notified the registry of its role.
-
Anthropic: hackers used Claude to steal secrets from 1.8M Android apps
Anthropic has reported on how threat actors — from financially motivated groups to the state intelligence services of Russia and China — tried to repurpose Claude for cyberattacks.
-
HuggingFace now has a security.txt
The HuggingFace platform has published a security.txt file — the standard way to tell security researchers where to report the vulnerabilities they find. The piece drew a notable response on Hacker News.
-
Passkey-Themed Phishing: How Data Is Stolen from Microsoft 365
Microsoft is tracking a wave of attacks in which ransomware groups use the pretext of an “urgent passkey update” to coax access out of corporate accounts and methodically siphon data from the cloud.
-
ClickFix: How a Fake CAPTCHA Tricks Victims into Infecting Their Own Computers
ClickFix attacks have gone from an exotic rarity to a mass phenomenon: PC and Mac users are being tricked into running malicious commands themselves. Even pro-Kremlin hacking groups have taken up the technique.
-
Anthropic Blocks Attempts to Bypass Claude's Safeguards for Bioweapons Research
The company described five cases in which users tried to trick Claude's filters and get help with dangerous biological research. The trouble is that the line between developing a vaccine and developing a weapon is often impossible to draw.
- More