It's raining, the transport isn't working, and now an Android app wants to walk out in solidarity
Please release me, let me close...
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory. The post Organizations Warned of 3 Exploited Linux Kernel Vulnerabilitie…
Salesforce wants to charge for AI outcomes, but first it needs to figure out how
Seats, Flex Credits, and all-you-can-eat contracts make for an 'anxiety-filled architecture'
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build…
Your cloud survived everything except the real world
War damage, air traffic chaos, and a storage shortage expose the cost of treating resilience as someone else's problem
Google Confirms Gemini AI Breached Three Firms
Google is the latest AI giant to confirm that its models escaped a testing environment and hacked real companies. The post Google Confirms Gemini AI Breached Three Firms appeared f…
VMware has quietly walked back its SmartNIC ambitions
Virtzilla’s bet on hyperscale hardware going mainstream didn’t excite customers, but may live on
Boss bought cheap 'printer' from a catalog and was left without a leg to stand on
Attempt to prove procurement prowess ended up gathering dust
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services in…
Failed networking vendor Cambium set to turn off its cloudy management portal
Quits enterprise networking hardware business, tells users to install on-prem software ASAP
Google joins the ‘Oops, our agents hacked someone’ club after partner’s internet access error
Kept it secret for months - even after OpenAI 'fessed up
Chinese memory-maker CXMT claims DRAM production breakthrough
PLUS: Toyota's robot hiring spree; China's CDNs struggle; India to charge for some UPI payments; and more!
Malicious npm packages evade install-script defenses at runtime
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by hiding malicious code in a package's normal runtime be…
Researchers escape OpenAI Codex sandbox to run commands on host
Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down mode. OpenAI has patched both. [...]
How Windows turned months of inactivity into a 7-hour update hostage situation
Windows is getting more efficient. The updates, not so much
BragJack attacks hijack AI browser agents through malicious extensions
BragJack, a proof-of-concept attack from Forever Security's Gal Weizman, hijacks the AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome using one mal…
TigerByte Cyber Emerges From Stealth With $3 Million in Funding
The company has secured over $7 million in contracts with US government agencies, including the US Space Force, the US Navy, and DARPA. The post TigerByte Cyber Emerges From Stealt…
Agentic security is the billion-dollar challenge for some clever startup to solve
High time to stop kicking the security can down the road, investor tells The Reg
North Korean WaterPlum hackers infected 30,000 devices worldwide
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transfer…
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
The ShinyHunters extortion gang breached the Clop (aka Cl0p) ransomware operation's data leak site, defacing the Tor site and allegedly stealing server data and the private keys fo…
AI boom could leave an e-waste trail that wraps 6 times around Earth
Report says estimates focused on GPUs miss the mountains of power, cooling, and networking gear destined for scrap
Identity Visibility in 2026: The Foundation of Identity Security
Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in breach…
Viral AI actress' hotline face-scans every caller, watches their mood
AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Tilly" video call service face-scans every caller for an 18+ ag…
Calling viral AI actress Tilly Norwood? Agree to a face scan first
AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her "Talking Tilly" video call service face-scans every caller for an 18+ ag…
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several OpenAI employees, then rea…
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote cod…
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score…
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The develop…
Firefox 156 arrives with a forest of forks in its wake
From Waterfox to LibreWolf and Pale Moon, there's a browser for almost every Mozilla dissenter
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French secu…