OpenBSD 7.9 arrives, a diamond in the rough proud of every sharp edge
Sixtieth release adds more cores, delayed hibernation, and basic Wi-Fi 6 without losing its ascetic streak
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack
Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens. The post Over 5,500 GitHub Repositories Infected in…
Anthropic to release Mythos-class models to the public
AI flaw-finder still under lock and key for now while company figures out guardrails, but extends access to more users including governments
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed Tr…
Samsung memory workers call off strike and may score six-figure bonuses
PLUS: Huawei says it’s replaced Moore’s Law; Chinese mobile plans add token allowances; Singtel slinging Optus; And more!
Linus Torvalds to ‘start being more hardnosed’ about ‘pointless pull requests’ – some of which come from AIs
Warns large release candidates ‘are *not* conducive to long-term stability’
Google has seriously leaned into AI enshittification lately
Could the Chocolate Factory's mission to reshape the web backfire?
Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign
A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. […
HP investigating BIOS updates that leave premium laptop users in boot loop limbo
Slowdowns, crashes, BSODs reported on pricey mobile workstations
No captain, my captain: Navantia floats crewless warship
Spanish shipbuilder's 75-meter drone vessel comes with sensors, modular payloads, and no room for sailors
Laravel Lang packages hijacked to deploy credential-stealing malware
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub …
npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the package…
Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware
A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases U…
Italy disrupts CINEMAGOAL piracy app that stole streaming auth codes
Italian authorities have dismantled a piracy ecosystem centered around the CINEMAGOAL app that provided access to various streaming platforms, including Netflix, Disney+, and Spoti…
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most "systemically" important…
‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains
The stealthy vulnerability impacts roughly 88 million domains and can be exploited to bypass DNS filtering and hide command-and-control traffic. The post ‘Underminr’ Vulnerability …
AI eyes scanning for bugs create a worrisome Linux security trend
Dirty Frag, Copy Fail, and Fragesia show the new reality
Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive c…
UK MPs slam digital ID rollout as a 'fiasco' after botched launch
Government's 'rushed' plans damaged public confidence before ministers had even explained how the system would work
The Virtual OS Museum opens its doors
A massive compilation of historic OSes and the emulators to run them
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run Scripts as Root
A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS scor…
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (K…
Feds unwittingly leak pilots' pre-crash conversation
Release of spectrogram of cockpit recorder audio allows conversation recovery with 'emerging' decades-old tech
Minor edits to AI skills can make agents go rogue
Text is the new attack
A Russian speaker and jailbroken Gemini went on a hacking spree and emptied at least one MAGA victim's crypto wallets
Hey, Gemini, how much can we earn from one pump-and-dump cycle?
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific. As usual, you can also use this squid post to talk about…
Zuck defends monitoring employees to win AI race in purported leaked audio
Limping Llama model needs a crutch made of surveillance tools
Megalodon chums the waters in 5.5K+ GitHub repo poisonings
Will Jason Statham save us?
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups
Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service used by criminal actors to obscure the origins of ransomw…
IBM plans $2B quantum chip foundry; government will pay half
The US government has awarded IBM $1 billion to help establish the first purpose-built quantum chip fabrication unit in the US. The Trump administration’s investment is being match…