DEF CON crowd suspected in fake-hotspot attack on Delta flight
FBI Atlanta confirms it’s looking into the incident, no arrests made.
Cyrus Farivar
–
|
104
Biz & IT // Informed technology
Chrome adopts what may be the best protection yet against account takeovers
Device-bound session credentials thwart an increasingly common form of account takeover.
Dan Goodin
–
|
34
New Pass-ta-key attack reveals all the things we didn’t know about passkeys
Why passkey apps treat Windows differently than other operating systems.
Dan Goodin
–
|
220
Thousands of servers can be backdoored by exploiting buggy motherboard controllers
Baseboard management controllers from the world’s biggest manufacturers are a security mess.
Dan Goodin
–
|
54
Claude published malicious code to the Internet and attacked 3 real companies
Had the hacks used conventional methods, someone would likely go to prison.
Dan Goodin
–
|
191
Max-severity Exchange server flaw under active exploitation by Kremlin hackers
Exploits can give persistent server access that survives credential rotation and disk re-imaging.
Dan Goodin
–
|
49
Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission
HAWK withstood years of testing that had yet to uncover a fatal weakness found through Mythos.
Dan Goodin
–
|
68
We now have a better understanding how OpenAI hacked into Hugging Face
10 days passed from OpenAI models exploiting JFrog Artifactory 0-day to release of a patch.
Dan Goodin
–
|
105
Most Read
Microsoft unveils AI security tools it says outperform competing platforms
Microsoft says tools cost less than competing ones and outperform them, too.
Dan Goodin
–
|
78
TreeSize won’t renew perpetual-license support unless users subscribe
“Current economic conditions” have shifted TreeSize’s business model.
Scharon Harding
–
|
181
HP fined 1.4 billion rupees for “cartelization” of ink cartridges, toner, PCs
Resellers threatened to ditch HP printing supplies for counterfeits.
Scharon Harding
–
|
49
Now, even Russia’s most elite hackers are using Clickfix to infect devices
The social-engineering technique has primarily been a tool of financially motivated criminals.
Dan Goodin
–
|
16
Energy IPOs surge as investors hunt for ways to play AI boom
Companies coming to market are raising money at fastest pace this century.
Financial Times
–
|
42
Sheetz is quitting VMware, migrating 11,000 virtual machines
The convenience store chain will use StorMagic instead.
Scharon Harding
–
|
178
Windows 0-day drops the same day Microsoft releases record number of patches
HiveLegacy is a “powerful primitive” that’s likely capable of other nefarious actions.
Dan Goodin
–
|
50
Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
Old and forgotten “shims” Microsoft failed to revoke have made Secure Boot bypasses simple.
Dan Goodin
–
|
130
The US government warns that Russia state hackers are coming after your router
With residential proxies all the rage, CISA urges router users to be vigilant.
Dan Goodin
–
|
123
Now, defenders are embracing the prompt injection, too
“Context bombing” tricks hacking agents into shutting down before they can do harm.
Dan Goodin
–
|
72
Patch for Windows Defender 0-day could allow attackers to fill hard disk
The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.
Dan Goodin
–
|
45
Allstate accuses Broadcom of auditing it because it quit VMware, CA
Broadcom accuses Allstate of dodging VMware audits.
Scharon Harding
–
|
94
Google pays $250K for Linux vulnerability allowing guest VM escapes
Both vulnerabilities allow untrusted users to gain root privileges.
Dan Goodin
–
|
24
Aussie gov’t tells volunteers to throw out thousands of functioning test routers
But the devices could “easily be reflashed.”
Scharon Harding
–
|
66
US rare earths flow to Asia as domestic demand is slow to emerge
Miners backed by Trump admin sell to Japan, South Korea despite push to develop domestic supply chain.
Financial Times
–
|
58
Hackers can use 9 of the most popular AI tools to assemble massive botnets
“HalluSquatting” weaponizes LLMs’ inability to say “I don’t know.”
Dan Goodin
–
|
64
Newly discovered PamStealer isn’t your typical macOS malware
The discovery underscores the increased effort being poured into Mac infostealers.
Dan Goodin
–
|
48
T-Mobile moving tens of thousands of virtual machines off VMware amid lawsuit
T-Mobile wants Broadcom to keep supporting its VMware perpetual licenses.
Scharon Harding
–
|
101
New attack provides one more reason why AI browsers are a bad idea
Telling an LLM that 2 + 2 = 5 is enough to make it follow forbidden instructions.
Dan Goodin
–
|
75
US offers $10 million for info on group behind Signal and WhatsApp hacking spree
Operation by two Russia-state groups has been ongoing since at least March.
Dan Goodin
–
|
52
Notion killing Skiff-influenced email app since most users use AI agents instead
Notion is “going all in on using agents to run your inbox.”
Scharon Harding
–
|
62
One-two punch delivered in global operation disrupts cybercrime “assembly line”
“Operation Endgame” simultaneously disrupts two widely used crime tools.
Dan Goodin
–
|
13
White House drastically shortens deadline for dropping quantum-vulnerable crypto
Order warns of national security risks if post-quantum cryptography isn’t adopted in time.
Dan Goodin
–
|
55
Oracle’s 21,000 layoffs help drive its debt-fueled AI investments
Oracle is spending billions on data center infrastructure to support AI.
Scharon Harding
–
|
91
Following user outcry, AMD reinstates memory encryption in consumer CPUs
Critics saw the move as an underhanded way to steer them toward more costly chips.
Dan Goodin
–
|
49
Microsoft discovers new lightweight backdoor that steals cryptocurrency
Crypto Clipper spreads over USB and communicates over Tor.
Dan Goodin
–
|
83
Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds
The vulnerability, disclosed 12 months ago, affects multiple manufacturers.
Dan Goodin
–
|
15
Before SpaceX IPO, investors in China secretly acquired stakes
One previously unreported SpaceX investor has ties to Chinese military contractors.
ProPublica
–
|
43