Anti-AI open source has an enemy in common, but almost nothing else
Building bot-free alternatives may require lefties, libertarians, and culture warriors to share code
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the crede…
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexP…
DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, a…
OpenAI confirms ChatGPT is down worldwide
ChatGPT, the famous artificial intelligence chatbot that allows users to converse with various personalities and topics, has connectivity issues worldwide. [...]
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any sel…
Rockwell Patches Code Execution Flaws in Arena Simulation Software
A researcher has explained how an attacker could exploit these vulnerabilities to target industrial organizations. The post Rockwell Patches Code Execution Flaws in Arena Simulatio…
BOFH: This printer engineer knows every trick in the book
But so does this customer
Anthropic debuts Opus 5 at half the price of its Fable sibling
And as a bonus, it doesn't require data retention
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
(Security) hole-ier than thou
AMD vibe codes its way past the CUDA moat with ROCm.AI
Hey Claude, optimize this model for me
CISOs vs. Boards: Myth or Misunderstanding?
Escalating threats are forcing boards to prioritize security, but communication gaps persist. Boards and security teams each say they need more support to bridge the divide.
Friday Squid Blogging: Illex Squid Catch in the Falklands
Lower catch this year. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
Europol flags 4,340 'horrific' URLs linked to The Com
Stop the spread (of online recruiting and propaganda)
OnTrac notifies customers of data breach after network hack
OnTrac parcel delivery company is informing that hackers breached its corporate network and may have accessed personal details belonging to its customers. [...]
Tech leaders issue letter to train Uncle Sam about value of open weight AI
Can you guess who didn't sign on to the group letter?
Escape Artists: 'Incorrigible' AI Models Resist Rehabilitation
The hacking of Hugging Face by a rogue OpenAI agent is significant, but unsurprising — and preventing the next AI model escape will be difficult, at best.
Hermes AI agent used to automate attack on Thai Finance Ministry
A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [..…
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts
Hackers are changing the DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages. [...]
HN835: The Pros and Cons of Shortest Path Bridging (SPB)
Shortest Path Bridging (SPB) remains an intriguing and reliable fabric technology, offering a unique approach to Ethernet that differs from more widely deployed fabrics such as EVP…
Cisco, AMD bring enterprise-level security, visibility to Ryzen AI Halo systems
Cisco and AMD have expanded their partnership with a new package of hardware and security software that’s designed to help enterprise customers protect, deploy, and manage distribu…
Dev accidentally commits Copilot binary to FreeBSD ports repo
Git is aptly named: it isn’t easy – but there are alternatives
ChatGPT wants access to your health records so it can be a better not-doctor
Feature launches a day after lawsuit alleges chatbot advice contributed to near-fatal embolism
Cloudflare Internal DNS puts public and private DNS on one policy engine
Enterprises typically operate separate systems for internal and external DNS because the two serve different audiences. Public DNS resolves names for services meant to be reached f…
Microsoft blames massive Microsoft 365 outage on maintenance bug
Microsoft says a bug in its automated network maintenance request system caused Thursday's massive outage by mistakenly removing IP routes from more devices than intended, disrupti…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to im…
Cambodian Prime Minister Hun Manet met with ZTE to deepen cooperation in digital infrastructure and artificial intelligence (AI)
PARTNER CONTENT: Focusing on 5G deployment, AI integration, and ICT talent development to drive the nation's digital transformation
Flock cameras go up in flames as cops hunt suspected firebugs
Two license plate readers torched in Georgia amid backlash against the surveillance network
In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws
Noteworthy stories that might have slipped under the radar: Siemens ROX II industrial switch vulnerabilities, Russian Zimbra webmail espionage campaign, Stadler Rail ransomware ext…
Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenti…