Inspired by musical greeting cards, DARPA demands tiny, cheap, self-modifying systems
One can't help but see a very clear instance of the triple constraint problem in action here
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Researchers Detail DifyTap Flaws in Dify That Could Expose AI Chats Across Tenants
Cybersecurity researchers have disclosed details of four vulnerabilities in Dify, an open-source agentic workflow platform with more than 146,000 GitHub stars, that could allow att…
Crypto Heist Fueled by Elaborate Fake Reputation-Boosting Campaign
Attackers are using multiple online channels — including GitHub, YouTube, and VirusTotal — to build an illusion of trust to spread a cross-platform clipboard hijacker.
The memory crisis is getting so bad that even retro RAM prices are going to the Moon
Some hardware firms redesigning products to use older DDR2 and DDR3 components
The new database world according to Google: Inexact queries and AI in everything
'Humans are not going to be using data platforms in the next three to five years,' product exec tells us
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
A heap over-read in the Squid web proxy can leak another user's cleartext HTTP request, including any credentials or session tokens it carries, to anyone already allowed to send tr…
Canadian utility fesses up to data breach, but key details remain off-grid
London Hydro says names, addresses, account details may have been exposed, but much about the intrusion is unknown
He Thought He Was Secure; His Phone Number Was Stolen Anyway
Threat actors can easily steal one-time passwords sent by text when they conduct a SIM swap attack. This can lead to account takeovers, so users must layer up their security measur…
A Glimpse into the “Search Your Target” Market for Stolen Credentials
Attackers no longer need to sift through massive credential dumps. They can pay others to do it for them. Flare explores how an emerging underground market searches stolen credenti…
Microsoft tells Windows users to get ready for 26H2 – unless they're on 26H1
Same core as 24H2 and 25H2 means an enablement package, while Search gets a little more forgiving
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data
Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability. The post Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose…
New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer
Cybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER. According to Ela…
As another UK prime minister bites the dust, a contradictory tech legacy remains
Attempting to boost growth, efficiency, and sovereign tech proved too difficult. The next leader will face the same challenges... and temptations
Brazil probes emergency warning system after nationwide rogue alert
Severe weather event alert platform buzzed devices across the country with the word 'misanthropy'
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and the major device-maker app stores are in from the …
Microsoft accidentally kills epic Outlook email threads
Redmond manages to break replying to an email on Outlook for macOS, one of the most basic functions
Stop Your Legacy Infrastructure from Hijacking Your AI Agents
Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still not accounting for - how attackers are circumventin…
Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data
Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable W…
Health board apologizes for phishing staff with with bogus vacation day
IT thought a fake offer of extra time off for hard-pressed Canadian medical workers was the way to go
North Korean Hackers Blamed for Mastra NPM Supply Chain Attack
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The post North Korean Hackers Blamed for Mastra NPM Su…
Professional Athletes and Wearables
I haven’t thought about the privacy issues surrounding professional athletes and wearables. Wearables present serious privacy issues for “Average Joe” consumers, who are entrusting…
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and m…
Humanity trashed Earth orbit – next stop the Moon
Neuraspace CEO floats lunar scrapyards as a cleaner way to handle hardware left behind
What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks
Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage. The post What the Latest ShinyHunters Breach…
New Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhones
The vulnerability exploited by the Usbliter8 exploit cannot be patched and a PoC exploit has been released by researchers. The post New Exploit Bypasses Apple’s Boot Defenses, Affe…
Gizmodo readers hit with ClickFix malware prompts after account compromise
Infosec buffs say Windows users could have been infected with a nasty trojan, while Mac users got off lightly
Fortinet Responds to FortiBleed Campaign
A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign. The post Fortinet Responds to FortiBleed Campaign appeared first on S…
Small island nation tries bold tech education strategy
Is the UK's social media ban for kids just reverse psychiatry?
Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
Canada's spy service got a judge's permission to reach into infected servers, home routers, and IoT gear sitting on Canadian soil and neutralize two foreign-run botnets. The Feder…
More Cybersecurity Firms Disclose Impact From Klue Hack
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers. The post More Cybersecurity Firms Disclose Impact From Klue Hack appea…