Jensen puts his thumb on the scales against open-weights fearmongering
American AI flag bearers get in line, at least on paper
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Microsoft lays out a buffet of Windows goodies for JavaScript Developers
Just don’t call the WinRT projection for Node.js a lock-in
New Dysphoria DDoS botnet spreads to 200k devices worldwide
A botnet called Dysphoria has compromised around 200,000 devices across the world and is using them for distributed denial of service (DDoS) attacks and traffic relay operations. […
New Certighost PoC exploit lets attackers hijack Windows domains
A proof-of-concept exploit for "Certighost," a Windows Active Directory Certificate Services vulnerability, has been released that can allow authenticated attackers to potentially …
'Confused Deputy' Flaws Persist in Google Cloud, Microsoft Azure
This category of vulnerabilities allows an attacker to easily acquire administrative level permissions and bypass cloud providers' access controls.
Impostor Chinese models pretend they're Claude
Researchers find GLM and Kimi can adopt Claude's identity, but the evidence stops short of proving distillation
FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown
An FBI agent explains how the mulitnational law-enforcement Operation Cronos was successful in disrupting the largest ransomware group of its time.
Microsoft's solution to AI security: more AI and more acronyms
MDASH stuffed with MAI-Cyber-1-Flash and a side of GPT-5.4
Why Resetting Passwords No Longer Stops Attackers
As attackers shift from password theft to session and token theft to bypass multifactor authentication controls, organizations must move beyond login security and protect authentic…
NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelli…
Adversaries Don't Need a Zero-Day — They Read Your Rulebook
Confidence in autonomous security tools is declining, and here's why.
Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin
Apple is being sued by three people who claim approximately $1.8 million in Bitcoin was stolen after downloading and using a fraudulent Sparrow Wallet application from the App Stor…
Up to 50% of data center capacity slated for 2026 could be delayed
A recent market outlook from energy intelligence firm Currence estimates that between 30% and 50% of the large-scale data center capacity expected to come online in 2026 will likel…
Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement o…
NB584: OpenAI Agents Mug Hugging Face; Fortinet Picks Intel for Custom Silicon
Take a Network Break! Scott Robohn steps in for Johna this week. We start with some followup on 3M and then tackle the news. Arista catches up to the rest of the market on a “branc…
Tech giants link hands to praise open AI models after OpenAI - Hugging Face attack
The Open Security AI Alliance says the Hugging Face/OpenAI mess proves frontier labs can't be trusted to properly secure sensitive systems
Cassette simulator rewinds digital audio to a more analog time in hiss-tory
Is there a simulator for the wail when you realize your precious one-off bootleg has just been chewed up?
Coca-Cola confirms data theft in Fairlife ransomware attack
The Coca-Cola Company has confirmed that hackers stole data from its dairy subsidiary, Fairlife, during a ransomware attack earlier this month. [...]
Ernst & Young data breach claimed by ShinyHunters extortion gang
The ShinyHunters extortion gang has claimed responsibility for a recently disclosed Ernst & Young data breach, saying it obtained credentials for some of the company's systems via …
Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The a…
New GitHub, PyPI Policies Boost Supply Chain Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days. The post New GitHub, PyPI Policies Boost Sup…
⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
Monday starts with the usual promise that everything is under control. Then the logs wake up. This week, trusted tools crossed lines, old flaws found new work, exposed systems sta…
Shadow AI agents are multiplying. Here's how to find and secure them.
Shadow AI agents are rapidly spreading across enterprise platforms, often without IT or security visibility. Nudge Security explains how organizations can discover, assess, and gov…
Microsoft Defender for Endpoint leaves some Linux boxes defenseless after update
One bug disabled the security service on restart, another blocked installation on hardened RHEL systems
PTC Windchill Vulnerability Exploited in Ransomware Campaign
The critical unsafe deserialization flaw allows attackers to execute arbitrary code remotely, without authentication. The post PTC Windchill Vulnerability Exploited in Ransomware C…
n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation pla…
Tech sector pours $1T into AI and sends customers the bill
History's biggest infrastructure build-out is pushing up hardware and software prices, analyst says
MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
The malware-as-a-service operation launches legitimate browsers on an invisible desktop, giving attackers persistent and covert remote access to compromised Windows systems. The po…
Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update
Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) …
British Army finds a new eye in the sky after Watchkeeper woes
Tekever AR5 drone regarded as more up-to-date answer to provide battlefield surveillance for soldiers